1 // SPDX-License-Identifier: GPL-2.0
2 /* OpenVPN data channel offload
3 *
4 * Copyright (C) 2020-2025 OpenVPN, Inc.
5 *
6 * Author: James Yonan <james@openvpn.net>
7 * Antonio Quartulli <antonio@openvpn.net>
8 */
9
10 #include <linux/skbuff.h>
11 #include <linux/list.h>
12 #include <linux/hashtable.h>
13 #include <net/ip6_route.h>
14
15 #include "ovpnpriv.h"
16 #include "bind.h"
17 #include "pktid.h"
18 #include "crypto.h"
19 #include "io.h"
20 #include "main.h"
21 #include "netlink.h"
22 #include "peer.h"
23 #include "socket.h"
24
unlock_ovpn(struct ovpn_priv * ovpn,struct llist_head * release_list)25 static void unlock_ovpn(struct ovpn_priv *ovpn,
26 struct llist_head *release_list)
27 __releases(&ovpn->lock)
28 {
29 struct ovpn_peer *peer, *next;
30
31 spin_unlock_bh(&ovpn->lock);
32
33 llist_for_each_entry_safe(peer, next, release_list->first,
34 release_entry) {
35 ovpn_socket_release(peer);
36 ovpn_peer_put(peer);
37 }
38 }
39
40 /**
41 * ovpn_peer_keepalive_set - configure keepalive values for peer
42 * @peer: the peer to configure
43 * @interval: outgoing keepalive interval
44 * @timeout: incoming keepalive timeout
45 */
ovpn_peer_keepalive_set(struct ovpn_peer * peer,u32 interval,u32 timeout)46 void ovpn_peer_keepalive_set(struct ovpn_peer *peer, u32 interval, u32 timeout)
47 {
48 time64_t now = ktime_get_boottime_seconds();
49
50 netdev_dbg(peer->ovpn->dev,
51 "scheduling keepalive for peer %u: interval=%u timeout=%u\n",
52 peer->id, interval, timeout);
53
54 peer->keepalive_interval = interval;
55 WRITE_ONCE(peer->last_sent, now);
56 peer->keepalive_xmit_exp = now + interval;
57
58 peer->keepalive_timeout = timeout;
59 WRITE_ONCE(peer->last_recv, now);
60 peer->keepalive_recv_exp = now + timeout;
61
62 /* now that interval and timeout have been changed, kick
63 * off the worker so that the next delay can be recomputed
64 */
65 mod_delayed_work(ovpn_wq, &peer->ovpn->keepalive_work, 0);
66 }
67
68 /**
69 * ovpn_peer_keepalive_send - periodic worker sending keepalive packets
70 * @work: pointer to the work member of the related peer object
71 *
72 * NOTE: the reference to peer is not dropped because it gets inherited
73 * by ovpn_xmit_special()
74 */
ovpn_peer_keepalive_send(struct work_struct * work)75 static void ovpn_peer_keepalive_send(struct work_struct *work)
76 {
77 struct ovpn_peer *peer = container_of(work, struct ovpn_peer,
78 keepalive_work);
79
80 local_bh_disable();
81 ovpn_xmit_special(peer, ovpn_keepalive_message,
82 sizeof(ovpn_keepalive_message));
83 local_bh_enable();
84 }
85
86 /**
87 * ovpn_peer_new - allocate and initialize a new peer object
88 * @ovpn: the openvpn instance inside which the peer should be created
89 * @id: the ID assigned to this peer
90 *
91 * Return: a pointer to the new peer on success or an error code otherwise
92 */
ovpn_peer_new(struct ovpn_priv * ovpn,u32 id)93 struct ovpn_peer *ovpn_peer_new(struct ovpn_priv *ovpn, u32 id)
94 {
95 struct ovpn_peer *peer;
96 int ret;
97
98 /* alloc and init peer object */
99 peer = kzalloc_obj(*peer);
100 if (!peer)
101 return ERR_PTR(-ENOMEM);
102
103 /* in the default case TX and RX IDs are the same.
104 * the user may set a different TX ID via netlink
105 */
106 peer->id = id;
107 peer->tx_id = id;
108 peer->ovpn = ovpn;
109
110 peer->vpn_addrs.ipv4.s_addr = htonl(INADDR_ANY);
111 peer->vpn_addrs.ipv6 = in6addr_any;
112
113 RCU_INIT_POINTER(peer->bind, NULL);
114 ovpn_crypto_state_init(&peer->crypto);
115 spin_lock_init(&peer->lock);
116 seqcount_spinlock_init(&peer->route_key_seq, &peer->lock);
117 kref_init(&peer->refcount);
118 ovpn_peer_stats_init(&peer->vpn_stats);
119 ovpn_peer_stats_init(&peer->link_stats);
120 INIT_WORK(&peer->keepalive_work, ovpn_peer_keepalive_send);
121
122 ret = dst_cache_init(&peer->dst_cache, GFP_KERNEL);
123 if (ret < 0) {
124 netdev_err(ovpn->dev,
125 "cannot initialize dst cache for peer %u\n",
126 peer->id);
127 kfree(peer);
128 return ERR_PTR(ret);
129 }
130
131 netdev_hold(ovpn->dev, &peer->dev_tracker, GFP_KERNEL);
132
133 return peer;
134 }
135
136 /**
137 * ovpn_peer_reset_sockaddr - recreate binding for peer
138 * @peer: peer to recreate the binding for
139 * @ss: sockaddr to use as remote endpoint for the binding
140 * @local_ip: local IP for the binding
141 *
142 * Return: 0 on success or a negative error code otherwise
143 */
ovpn_peer_reset_sockaddr(struct ovpn_peer * peer,const struct sockaddr_storage * ss,const void * local_ip)144 int ovpn_peer_reset_sockaddr(struct ovpn_peer *peer,
145 const struct sockaddr_storage *ss,
146 const void *local_ip)
147 {
148 struct ovpn_bind *bind;
149 size_t ip_len;
150
151 lockdep_assert_held(&peer->lock);
152
153 /* create new ovpn_bind object */
154 bind = ovpn_bind_from_sockaddr(ss);
155 if (IS_ERR(bind))
156 return PTR_ERR(bind);
157
158 if (local_ip) {
159 if (ss->ss_family == AF_INET) {
160 ip_len = sizeof(struct in_addr);
161 } else if (ss->ss_family == AF_INET6) {
162 ip_len = sizeof(struct in6_addr);
163 } else {
164 net_dbg_ratelimited("%s: invalid family %u for remote endpoint for peer %u\n",
165 netdev_name(peer->ovpn->dev),
166 ss->ss_family, peer->id);
167 kfree(bind);
168 return -EINVAL;
169 }
170
171 memcpy(&bind->local, local_ip, ip_len);
172 }
173
174 /* set binding */
175 ovpn_bind_reset(peer, bind);
176
177 return 0;
178 }
179
180 /* variable name __tbl2 needs to be different from __tbl1
181 * in the macro below to avoid confusing clang
182 */
183 #define ovpn_get_hash_slot(_tbl, _key, _key_len) ({ \
184 typeof(_tbl) *__tbl2 = &(_tbl); \
185 jhash(_key, _key_len, 0) % HASH_SIZE(*__tbl2); \
186 })
187
188 #define ovpn_get_hash_head(_tbl, _key, _key_len) ({ \
189 typeof(_tbl) *__tbl1 = &(_tbl); \
190 &(*__tbl1)[ovpn_get_hash_slot(*__tbl1, _key, _key_len)];\
191 })
192
193 static void __ovpn_peer_hash_transp_addr(struct ovpn_peer *peer,
194 const struct ovpn_bind *bind);
195
196 /**
197 * ovpn_peer_endpoints_update - update remote or local endpoint for peer
198 * @peer: peer to update the remote endpoint for
199 * @skb: incoming packet to retrieve the source/destination address from
200 */
ovpn_peer_endpoints_update(struct ovpn_peer * peer,struct sk_buff * skb)201 void ovpn_peer_endpoints_update(struct ovpn_peer *peer, struct sk_buff *skb)
202 {
203 const void *local_ip = NULL;
204 struct sockaddr_storage ss;
205 struct sockaddr_in6 *sa6;
206 struct sockaddr_in *sa;
207 struct ovpn_bind *bind;
208 bool floated = false;
209
210 spin_lock_bh(&peer->lock);
211 bind = rcu_dereference_protected(peer->bind,
212 lockdep_is_held(&peer->lock));
213 if (unlikely(!bind))
214 goto unlock;
215
216 switch (skb->protocol) {
217 case htons(ETH_P_IP):
218 /* float check */
219 if (unlikely(!ovpn_bind_skb_src_match(bind, skb))) {
220 /* unconditionally save local endpoint in case
221 * of float, as it may have changed as well
222 */
223 local_ip = &ip_hdr(skb)->daddr;
224 sa = (struct sockaddr_in *)&ss;
225 /* use a designated initializer so the sin_zero padding
226 * is zeroed (it ends up in the by_transp_addr hash key)
227 * without memset-ing the whole sockaddr_storage on the
228 * RX fast path
229 */
230 *sa = (struct sockaddr_in) {
231 .sin_family = AF_INET,
232 .sin_addr.s_addr = ip_hdr(skb)->saddr,
233 .sin_port = udp_hdr(skb)->source,
234 };
235 floated = true;
236 break;
237 }
238
239 /* if no float happened, let's double check if the local endpoint
240 * has changed
241 */
242 if (unlikely(bind->local.ipv4.s_addr != ip_hdr(skb)->daddr)) {
243 net_dbg_ratelimited("%s: learning local IPv4 for peer %d (%pI4 -> %pI4)\n",
244 netdev_name(peer->ovpn->dev),
245 peer->id, &bind->local.ipv4.s_addr,
246 &ip_hdr(skb)->daddr);
247 local_ip = &ip_hdr(skb)->daddr;
248 memcpy(&ss, &bind->remote, sizeof(struct sockaddr_in));
249 break;
250 }
251 /* nothing changed */
252 goto unlock;
253 case htons(ETH_P_IPV6):
254 /* float check */
255 if (unlikely(!ovpn_bind_skb_src_match(bind, skb))) {
256 /* unconditionally save local endpoint in case
257 * of float, as it may have changed as well
258 */
259 local_ip = &ipv6_hdr(skb)->daddr;
260 sa6 = (struct sockaddr_in6 *)&ss;
261 /* use a designated initializer so the sin6_flowinfo
262 * padding is zeroed (it ends up in the by_transp_addr
263 * hash key) without memset-ing the whole
264 * sockaddr_storage on the RX fast path
265 */
266 *sa6 = (struct sockaddr_in6) {
267 .sin6_family = AF_INET6,
268 .sin6_addr = ipv6_hdr(skb)->saddr,
269 .sin6_port = udp_hdr(skb)->source,
270 .sin6_scope_id =
271 ipv6_iface_scope_id(&ipv6_hdr(skb)->saddr,
272 skb->skb_iif),
273 };
274 floated = true;
275 break;
276 }
277
278 /* if no float happened, let's double check if the local endpoint
279 * has changed
280 */
281 if (unlikely(!ipv6_addr_equal(&bind->local.ipv6,
282 &ipv6_hdr(skb)->daddr))) {
283 net_dbg_ratelimited("%s: learning local IPv6 for peer %d (%pI6c -> %pI6c)\n",
284 netdev_name(peer->ovpn->dev),
285 peer->id, &bind->local.ipv6,
286 &ipv6_hdr(skb)->daddr);
287 local_ip = &ipv6_hdr(skb)->daddr;
288 memcpy(&ss, &bind->remote, sizeof(struct sockaddr_in6));
289 break;
290 }
291 /* nothing changed */
292 goto unlock;
293 default:
294 goto unlock;
295 }
296
297 if (unlikely(ovpn_peer_reset_sockaddr(peer,
298 (struct sockaddr_storage *)&ss,
299 local_ip) < 0))
300 goto unlock;
301
302 /* reset the cache only after a successful bind update to avoid useless
303 * cache misses on concurrent TX
304 */
305 dst_cache_reset(&peer->dst_cache);
306
307 /* if only the local address changed, bail out now */
308 if (!floated)
309 goto unlock;
310
311 net_dbg_ratelimited("%s: peer %d floated to %pIScp",
312 netdev_name(peer->ovpn->dev), peer->id, &ss);
313
314 spin_unlock_bh(&peer->lock);
315
316 ovpn_nl_peer_float_notify(peer, &ss);
317
318 /* rehashing is required only in MP mode as P2P has one peer
319 * only and thus there is no hashtable.
320 *
321 * This function may be invoked concurrently, so re-read peer->bind
322 * under the proper locks and rehash against its current value.
323 */
324 if (peer->ovpn->mode != OVPN_MODE_MP)
325 return;
326
327 /* This function may be invoked concurrently, therefore another
328 * float may have happened in parallel: re-acquire the locks and
329 * rehash using the peer->bind->remote directly as key
330 */
331 spin_lock_bh(&peer->ovpn->lock);
332 spin_lock_bh(&peer->lock);
333 bind = rcu_dereference_protected(peer->bind,
334 lockdep_is_held(&peer->lock));
335 __ovpn_peer_hash_transp_addr(peer, bind);
336 spin_unlock_bh(&peer->lock);
337 spin_unlock_bh(&peer->ovpn->lock);
338 return;
339 unlock:
340 spin_unlock_bh(&peer->lock);
341 }
342
343 /**
344 * ovpn_peer_release_rcu - RCU callback performing last peer release steps
345 * @head: RCU member of the ovpn_peer
346 */
ovpn_peer_release_rcu(struct rcu_head * head)347 static void ovpn_peer_release_rcu(struct rcu_head *head)
348 {
349 struct ovpn_peer *peer = container_of(head, struct ovpn_peer, rcu);
350
351 /* this call will immediately free the dst_cache, therefore we
352 * perform it in the RCU callback, when all contexts are done
353 */
354 dst_cache_destroy(&peer->dst_cache);
355 kfree(peer);
356 }
357
358 /**
359 * ovpn_peer_release - release peer private members
360 * @peer: the peer to release
361 */
ovpn_peer_release(struct ovpn_peer * peer)362 static void ovpn_peer_release(struct ovpn_peer *peer)
363 {
364 ovpn_crypto_state_release(&peer->crypto);
365 spin_lock_bh(&peer->lock);
366 ovpn_bind_reset(peer, NULL);
367 spin_unlock_bh(&peer->lock);
368 call_rcu(&peer->rcu, ovpn_peer_release_rcu);
369 netdev_put(peer->ovpn->dev, &peer->dev_tracker);
370 }
371
372 /**
373 * ovpn_peer_release_kref - callback for kref_put
374 * @kref: the kref object belonging to the peer
375 */
ovpn_peer_release_kref(struct kref * kref)376 void ovpn_peer_release_kref(struct kref *kref)
377 {
378 struct ovpn_peer *peer = container_of(kref, struct ovpn_peer, refcount);
379
380 ovpn_peer_release(peer);
381 }
382
383 /**
384 * ovpn_peer_skb_to_sockaddr - fill sockaddr with skb source address
385 * @skb: the packet to extract data from
386 * @ss: the sockaddr to fill
387 *
388 * Return: sockaddr length on success or -1 otherwise
389 */
ovpn_peer_skb_to_sockaddr(struct sk_buff * skb,struct sockaddr_storage * ss)390 static int ovpn_peer_skb_to_sockaddr(struct sk_buff *skb,
391 struct sockaddr_storage *ss)
392 {
393 struct sockaddr_in6 *sa6;
394 struct sockaddr_in *sa4;
395
396 switch (skb->protocol) {
397 case htons(ETH_P_IP):
398 sa4 = (struct sockaddr_in *)ss;
399 sa4->sin_family = AF_INET;
400 sa4->sin_addr.s_addr = ip_hdr(skb)->saddr;
401 sa4->sin_port = udp_hdr(skb)->source;
402 return sizeof(*sa4);
403 case htons(ETH_P_IPV6):
404 sa6 = (struct sockaddr_in6 *)ss;
405 sa6->sin6_family = AF_INET6;
406 sa6->sin6_addr = ipv6_hdr(skb)->saddr;
407 sa6->sin6_port = udp_hdr(skb)->source;
408 return sizeof(*sa6);
409 }
410
411 return -1;
412 }
413
414 /**
415 * ovpn_nexthop_from_skb4 - retrieve IPv4 nexthop for outgoing skb
416 * @skb: the outgoing packet
417 *
418 * Return: the IPv4 of the nexthop
419 */
ovpn_nexthop_from_skb4(struct sk_buff * skb)420 static __be32 ovpn_nexthop_from_skb4(struct sk_buff *skb)
421 {
422 const struct rtable *rt = skb_rtable(skb);
423
424 if (rt && rt->rt_uses_gateway)
425 return rt->rt_gw4;
426
427 return ip_hdr(skb)->daddr;
428 }
429
430 /**
431 * ovpn_nexthop_from_skb6 - retrieve IPv6 nexthop for outgoing skb
432 * @skb: the outgoing packet
433 *
434 * Return: the IPv6 of the nexthop
435 */
ovpn_nexthop_from_skb6(struct sk_buff * skb)436 static struct in6_addr ovpn_nexthop_from_skb6(struct sk_buff *skb)
437 {
438 const struct rt6_info *rt = skb_rt6_info(skb);
439
440 if (!rt || !(rt->rt6i_flags & RTF_GATEWAY))
441 return ipv6_hdr(skb)->daddr;
442
443 return rt->rt6i_gateway;
444 }
445
446 /**
447 * ovpn_peer_get_by_vpn_addr4 - retrieve peer by its VPN IPv4 address
448 * @ovpn: the openvpn instance to search
449 * @addr: VPN IPv4 to use as search key
450 *
451 * Refcounter is not increased for the returned peer.
452 *
453 * Return: the peer if found or NULL otherwise
454 */
ovpn_peer_get_by_vpn_addr4(struct ovpn_priv * ovpn,__be32 addr)455 static struct ovpn_peer *ovpn_peer_get_by_vpn_addr4(struct ovpn_priv *ovpn,
456 __be32 addr)
457 {
458 struct hlist_nulls_head *nhead;
459 struct hlist_nulls_node *ntmp;
460 struct ovpn_peer *tmp;
461 unsigned int slot;
462
463 begin:
464 slot = ovpn_get_hash_slot(ovpn->peers->by_vpn_addr4, &addr,
465 sizeof(addr));
466 nhead = &ovpn->peers->by_vpn_addr4[slot];
467
468 hlist_nulls_for_each_entry_rcu(tmp, ntmp, nhead, hash_entry_addr4)
469 if (addr == tmp->vpn_addrs.ipv4.s_addr)
470 return tmp;
471
472 /* item may have moved during lookup - check nulls and restart
473 * if that's the case
474 */
475 if (get_nulls_value(ntmp) != slot)
476 goto begin;
477
478 return NULL;
479 }
480
481 /**
482 * ovpn_peer_get_by_vpn_addr6 - retrieve peer by its VPN IPv6 address
483 * @ovpn: the openvpn instance to search
484 * @addr: VPN IPv6 to use as search key
485 *
486 * Refcounter is not increased for the returned peer.
487 *
488 * Return: the peer if found or NULL otherwise
489 */
ovpn_peer_get_by_vpn_addr6(struct ovpn_priv * ovpn,const struct in6_addr * addr)490 static struct ovpn_peer *ovpn_peer_get_by_vpn_addr6(struct ovpn_priv *ovpn,
491 const struct in6_addr *addr)
492 {
493 struct hlist_nulls_head *nhead;
494 struct hlist_nulls_node *ntmp;
495 struct ovpn_peer *tmp;
496 unsigned int slot;
497
498 begin:
499 slot = ovpn_get_hash_slot(ovpn->peers->by_vpn_addr6, addr,
500 sizeof(*addr));
501 nhead = &ovpn->peers->by_vpn_addr6[slot];
502
503 hlist_nulls_for_each_entry_rcu(tmp, ntmp, nhead, hash_entry_addr6)
504 if (ipv6_addr_equal(addr, &tmp->vpn_addrs.ipv6))
505 return tmp;
506
507 /* item may have moved during lookup - check nulls and restart
508 * if that's the case
509 */
510 if (get_nulls_value(ntmp) != slot)
511 goto begin;
512
513 return NULL;
514 }
515
516 /**
517 * ovpn_peer_vpn_addr_conflict4 - check if the VPN v4 address is already in use
518 * @ovpn: the openvpn instance to search
519 * @peer: peer being added or updated, or NULL
520 * @addr: VPN IPv4 address to check
521 *
522 * Check whether @addr is already assigned to another peer. @peer is ignored
523 * when found, allowing peer updates that keep an existing address.
524 * Unspecified addresses are ignored.
525 *
526 * Note: the caller must hold @ovpn->lock.
527 *
528 * Return: true on conflict, false otherwise.
529 */
ovpn_peer_vpn_addr_conflict4(struct ovpn_priv * ovpn,const struct ovpn_peer * peer,const struct in_addr * addr)530 bool ovpn_peer_vpn_addr_conflict4(struct ovpn_priv *ovpn,
531 const struct ovpn_peer *peer,
532 const struct in_addr *addr)
533 {
534 struct ovpn_peer *tmp = NULL;
535
536 lockdep_assert_held(&ovpn->lock);
537
538 /* we don't hash INADDR_ANY, no conflict in that case */
539 if (addr->s_addr != htonl(INADDR_ANY))
540 tmp = ovpn_peer_get_by_vpn_addr4(ovpn, addr->s_addr);
541
542 return tmp && tmp != peer;
543 }
544
545 /**
546 * ovpn_peer_vpn_addr_conflict6 - check if the VPN v6 address is already in use
547 * @ovpn: the openvpn instance to search
548 * @peer: peer being added or updated, or NULL
549 * @addr: VPN IPv6 address to check
550 *
551 * Check whether @addr is already assigned to another peer. @peer is ignored
552 * when found, allowing peer updates that keep an existing address.
553 * Unspecified addresses are ignored.
554 *
555 * Note: the caller must hold @ovpn->lock.
556 *
557 * Return: true on conflict, false otherwise.
558 */
ovpn_peer_vpn_addr_conflict6(struct ovpn_priv * ovpn,const struct ovpn_peer * peer,const struct in6_addr * addr)559 bool ovpn_peer_vpn_addr_conflict6(struct ovpn_priv *ovpn,
560 const struct ovpn_peer *peer,
561 const struct in6_addr *addr)
562 {
563 struct ovpn_peer *tmp = NULL;
564
565 lockdep_assert_held(&ovpn->lock);
566
567 /* we don't hash ::, no conflict in that case */
568 if (!ipv6_addr_any(addr))
569 tmp = ovpn_peer_get_by_vpn_addr6(ovpn, addr);
570
571 return tmp && tmp != peer;
572 }
573
574 /**
575 * ovpn_peer_transp_match - check if sockaddr and peer binding match
576 * @peer: the peer to get the binding from
577 * @ss: the sockaddr to match
578 *
579 * Return: true if sockaddr and binding match or false otherwise
580 */
ovpn_peer_transp_match(const struct ovpn_peer * peer,const struct sockaddr_storage * ss)581 static bool ovpn_peer_transp_match(const struct ovpn_peer *peer,
582 const struct sockaddr_storage *ss)
583 {
584 struct ovpn_bind *bind = rcu_dereference(peer->bind);
585 struct sockaddr_in6 *sa6;
586 struct sockaddr_in *sa4;
587
588 if (unlikely(!bind))
589 return false;
590
591 if (ss->ss_family != bind->remote.in4.sin_family)
592 return false;
593
594 switch (ss->ss_family) {
595 case AF_INET:
596 sa4 = (struct sockaddr_in *)ss;
597 if (sa4->sin_addr.s_addr != bind->remote.in4.sin_addr.s_addr)
598 return false;
599 if (sa4->sin_port != bind->remote.in4.sin_port)
600 return false;
601 break;
602 case AF_INET6:
603 sa6 = (struct sockaddr_in6 *)ss;
604 if (!ipv6_addr_equal(&sa6->sin6_addr,
605 &bind->remote.in6.sin6_addr))
606 return false;
607 if (sa6->sin6_port != bind->remote.in6.sin6_port)
608 return false;
609 break;
610 default:
611 return false;
612 }
613
614 return true;
615 }
616
617 /**
618 * ovpn_peer_get_by_transp_addr_p2p - get peer by transport address in a P2P
619 * instance
620 * @ovpn: the openvpn instance to search
621 * @ss: the transport socket address
622 *
623 * Return: the peer if found or NULL otherwise
624 */
625 static struct ovpn_peer *
ovpn_peer_get_by_transp_addr_p2p(struct ovpn_priv * ovpn,struct sockaddr_storage * ss)626 ovpn_peer_get_by_transp_addr_p2p(struct ovpn_priv *ovpn,
627 struct sockaddr_storage *ss)
628 {
629 struct ovpn_peer *tmp, *peer = NULL;
630
631 rcu_read_lock();
632 tmp = rcu_dereference(ovpn->peer);
633 if (likely(tmp && ovpn_peer_transp_match(tmp, ss) &&
634 ovpn_peer_hold(tmp)))
635 peer = tmp;
636 rcu_read_unlock();
637
638 return peer;
639 }
640
641 /**
642 * ovpn_peer_get_by_transp_addr - retrieve peer by transport address
643 * @ovpn: the openvpn instance to search
644 * @skb: the skb to retrieve the source transport address from
645 *
646 * Return: a pointer to the peer if found or NULL otherwise
647 */
ovpn_peer_get_by_transp_addr(struct ovpn_priv * ovpn,struct sk_buff * skb)648 struct ovpn_peer *ovpn_peer_get_by_transp_addr(struct ovpn_priv *ovpn,
649 struct sk_buff *skb)
650 {
651 struct ovpn_peer *tmp, *peer = NULL;
652 struct sockaddr_storage ss = { 0 };
653 struct hlist_nulls_head *nhead;
654 struct hlist_nulls_node *ntmp;
655 unsigned int slot;
656 ssize_t sa_len;
657
658 sa_len = ovpn_peer_skb_to_sockaddr(skb, &ss);
659 if (unlikely(sa_len < 0))
660 return NULL;
661
662 if (ovpn->mode == OVPN_MODE_P2P)
663 return ovpn_peer_get_by_transp_addr_p2p(ovpn, &ss);
664
665 rcu_read_lock();
666 begin:
667 slot = ovpn_get_hash_slot(ovpn->peers->by_transp_addr, &ss, sa_len);
668 nhead = &ovpn->peers->by_transp_addr[slot];
669
670 hlist_nulls_for_each_entry_rcu(tmp, ntmp, nhead,
671 hash_entry_transp_addr) {
672 if (!ovpn_peer_transp_match(tmp, &ss))
673 continue;
674
675 if (!ovpn_peer_hold(tmp))
676 continue;
677
678 peer = tmp;
679 break;
680 }
681
682 /* item may have moved during lookup - check nulls and restart
683 * if that's the case
684 */
685 if (!peer && get_nulls_value(ntmp) != slot)
686 goto begin;
687 rcu_read_unlock();
688
689 return peer;
690 }
691
692 /**
693 * ovpn_peer_get_by_id_p2p - get peer by ID in a P2P instance
694 * @ovpn: the openvpn instance to search
695 * @peer_id: the ID of the peer to find
696 *
697 * Return: the peer if found or NULL otherwise
698 */
ovpn_peer_get_by_id_p2p(struct ovpn_priv * ovpn,u32 peer_id)699 static struct ovpn_peer *ovpn_peer_get_by_id_p2p(struct ovpn_priv *ovpn,
700 u32 peer_id)
701 {
702 struct ovpn_peer *tmp, *peer = NULL;
703
704 rcu_read_lock();
705 tmp = rcu_dereference(ovpn->peer);
706 if (likely(tmp && tmp->id == peer_id && ovpn_peer_hold(tmp)))
707 peer = tmp;
708 rcu_read_unlock();
709
710 return peer;
711 }
712
713 /**
714 * ovpn_peer_get_by_id - retrieve peer by ID
715 * @ovpn: the openvpn instance to search
716 * @peer_id: the unique peer identifier to match
717 *
718 * Return: a pointer to the peer if found or NULL otherwise
719 */
ovpn_peer_get_by_id(struct ovpn_priv * ovpn,u32 peer_id)720 struct ovpn_peer *ovpn_peer_get_by_id(struct ovpn_priv *ovpn, u32 peer_id)
721 {
722 struct ovpn_peer *tmp, *peer = NULL;
723 struct hlist_head *head;
724
725 if (ovpn->mode == OVPN_MODE_P2P)
726 return ovpn_peer_get_by_id_p2p(ovpn, peer_id);
727
728 head = ovpn_get_hash_head(ovpn->peers->by_id, &peer_id,
729 sizeof(peer_id));
730
731 rcu_read_lock();
732 hlist_for_each_entry_rcu(tmp, head, hash_entry_id) {
733 if (tmp->id != peer_id)
734 continue;
735
736 if (!ovpn_peer_hold(tmp))
737 continue;
738
739 peer = tmp;
740 break;
741 }
742 rcu_read_unlock();
743
744 return peer;
745 }
746
ovpn_peer_remove(struct ovpn_peer * peer,enum ovpn_del_peer_reason reason,struct llist_head * release_list)747 static void ovpn_peer_remove(struct ovpn_peer *peer,
748 enum ovpn_del_peer_reason reason,
749 struct llist_head *release_list)
750 {
751 lockdep_assert_held(&peer->ovpn->lock);
752
753 switch (peer->ovpn->mode) {
754 case OVPN_MODE_MP:
755 /* prevent double remove */
756 if (hlist_unhashed(&peer->hash_entry_id))
757 return;
758
759 hlist_del_init_rcu(&peer->hash_entry_id);
760 hlist_nulls_del_init_rcu(&peer->hash_entry_addr4);
761 hlist_nulls_del_init_rcu(&peer->hash_entry_addr6);
762 hlist_nulls_del_init_rcu(&peer->hash_entry_transp_addr);
763 break;
764 case OVPN_MODE_P2P:
765 /* prevent double remove */
766 if (peer != rcu_access_pointer(peer->ovpn->peer))
767 return;
768
769 RCU_INIT_POINTER(peer->ovpn->peer, NULL);
770 /* in P2P mode the carrier is switched off when the peer is
771 * deleted so that third party protocols can react accordingly
772 */
773 netif_carrier_off(peer->ovpn->dev);
774 break;
775 }
776
777 peer->delete_reason = reason;
778 ovpn_nl_peer_del_notify(peer);
779
780 /* append to provided list for later socket release and ref drop */
781 llist_add(&peer->release_entry, release_list);
782 }
783
784 /**
785 * ovpn_peer_get_by_dst - Lookup peer to send skb to
786 * @ovpn: the private data representing the current VPN session
787 * @skb: the skb to extract the destination address from
788 *
789 * This function takes a tunnel packet and looks up the peer to send it to
790 * after encapsulation. The skb is expected to be the in-tunnel packet, without
791 * any OpenVPN related header.
792 *
793 * Assume that the IP header is accessible in the skb data.
794 *
795 * Return: the peer if found or NULL otherwise.
796 */
ovpn_peer_get_by_dst(struct ovpn_priv * ovpn,struct sk_buff * skb)797 struct ovpn_peer *ovpn_peer_get_by_dst(struct ovpn_priv *ovpn,
798 struct sk_buff *skb)
799 {
800 struct ovpn_peer *peer = NULL;
801 struct in6_addr addr6;
802 __be32 addr4;
803
804 /* in P2P mode, no matter the destination, packets are always sent to
805 * the single peer listening on the other side
806 */
807 if (ovpn->mode == OVPN_MODE_P2P) {
808 rcu_read_lock();
809 peer = rcu_dereference(ovpn->peer);
810 if (unlikely(peer && !ovpn_peer_hold(peer)))
811 peer = NULL;
812 rcu_read_unlock();
813 return peer;
814 }
815
816 rcu_read_lock();
817 switch (skb->protocol) {
818 case htons(ETH_P_IP):
819 addr4 = ovpn_nexthop_from_skb4(skb);
820 peer = ovpn_peer_get_by_vpn_addr4(ovpn, addr4);
821 break;
822 case htons(ETH_P_IPV6):
823 addr6 = ovpn_nexthop_from_skb6(skb);
824 peer = ovpn_peer_get_by_vpn_addr6(ovpn, &addr6);
825 break;
826 }
827
828 if (unlikely(peer && !ovpn_peer_hold(peer)))
829 peer = NULL;
830 rcu_read_unlock();
831
832 return peer;
833 }
834
835 /**
836 * ovpn_nexthop_from_rt4 - look up the IPv4 nexthop for the given destination
837 * @ovpn: the private data representing the current VPN session
838 * @dest: the destination to be looked up
839 *
840 * Looks up in the IPv4 system routing table the IP of the nexthop to be used
841 * to reach the destination passed as argument. If no nexthop can be found, the
842 * destination itself is returned as it probably has to be used as nexthop.
843 *
844 * Return: the IP of the next hop if found or dest itself otherwise
845 */
ovpn_nexthop_from_rt4(struct ovpn_priv * ovpn,__be32 dest)846 static __be32 ovpn_nexthop_from_rt4(struct ovpn_priv *ovpn, __be32 dest)
847 {
848 struct rtable *rt;
849 struct flowi4 fl = {
850 .daddr = dest
851 };
852
853 rt = ip_route_output_flow(dev_net(ovpn->dev), &fl, NULL);
854 if (IS_ERR(rt)) {
855 net_dbg_ratelimited("%s: no route to host %pI4\n",
856 netdev_name(ovpn->dev), &dest);
857 /* if we end up here this packet is probably going to be
858 * thrown away later
859 */
860 return dest;
861 }
862
863 if (!rt->rt_uses_gateway)
864 goto out;
865
866 dest = rt->rt_gw4;
867 out:
868 ip_rt_put(rt);
869 return dest;
870 }
871
872 /**
873 * ovpn_nexthop_from_rt6 - look up the IPv6 nexthop for the given destination
874 * @ovpn: the private data representing the current VPN session
875 * @dest: the destination to be looked up
876 *
877 * Looks up in the IPv6 system routing table the IP of the nexthop to be used
878 * to reach the destination passed as argument. If no nexthop can be found, the
879 * destination itself is returned as it probably has to be used as nexthop.
880 *
881 * Return: the IP of the next hop if found or dest itself otherwise
882 */
ovpn_nexthop_from_rt6(struct ovpn_priv * ovpn,struct in6_addr dest)883 static struct in6_addr ovpn_nexthop_from_rt6(struct ovpn_priv *ovpn,
884 struct in6_addr dest)
885 {
886 #if IS_ENABLED(CONFIG_IPV6)
887 struct dst_entry *entry;
888 struct rt6_info *rt;
889 struct flowi6 fl = {
890 .daddr = dest,
891 };
892
893 entry = ip6_dst_lookup_flow(dev_net(ovpn->dev), NULL, &fl, NULL);
894 if (IS_ERR(entry)) {
895 net_dbg_ratelimited("%s: no route to host %pI6c\n",
896 netdev_name(ovpn->dev), &dest);
897 /* if we end up here this packet is probably going to be
898 * thrown away later
899 */
900 return dest;
901 }
902
903 rt = dst_rt6_info(entry);
904
905 if (!(rt->rt6i_flags & RTF_GATEWAY))
906 goto out;
907
908 dest = rt->rt6i_gateway;
909 out:
910 dst_release((struct dst_entry *)rt);
911 #endif
912 return dest;
913 }
914
915 /**
916 * ovpn_peer_check_by_src - check that skb source is routed via peer
917 * @ovpn: the openvpn instance to search
918 * @skb: the packet to extract source address from
919 * @peer: the peer to check against the source address
920 *
921 * Return: true if the peer is matching or false otherwise
922 */
ovpn_peer_check_by_src(struct ovpn_priv * ovpn,struct sk_buff * skb,struct ovpn_peer * peer)923 bool ovpn_peer_check_by_src(struct ovpn_priv *ovpn, struct sk_buff *skb,
924 struct ovpn_peer *peer)
925 {
926 bool match = false;
927 struct in6_addr addr6;
928 __be32 addr4;
929
930 if (ovpn->mode == OVPN_MODE_P2P) {
931 /* in P2P mode, no matter the destination, packets are always
932 * sent to the single peer listening on the other side
933 */
934 return peer == rcu_access_pointer(ovpn->peer);
935 }
936
937 /* This function performs a reverse path check, therefore we now
938 * lookup the nexthop we would use if we wanted to route a packet
939 * to the source IP. If the nexthop matches the sender we know the
940 * latter is valid and we allow the packet to come in
941 */
942
943 switch (skb->protocol) {
944 case htons(ETH_P_IP):
945 addr4 = ovpn_nexthop_from_rt4(ovpn, ip_hdr(skb)->saddr);
946 rcu_read_lock();
947 match = (peer == ovpn_peer_get_by_vpn_addr4(ovpn, addr4));
948 rcu_read_unlock();
949 break;
950 case htons(ETH_P_IPV6):
951 addr6 = ovpn_nexthop_from_rt6(ovpn, ipv6_hdr(skb)->saddr);
952 rcu_read_lock();
953 match = (peer == ovpn_peer_get_by_vpn_addr6(ovpn, &addr6));
954 rcu_read_unlock();
955 break;
956 }
957
958 return match;
959 }
960
961 /* Move @peer to the by_transp_addr bucket matching its current bind.
962 *
963 * Caller must hold both peer->ovpn->lock and peer->lock, and must have
964 * already dereferenced a valid (non-NULL) peer->bind, passed in as @bind.
965 */
__ovpn_peer_hash_transp_addr(struct ovpn_peer * peer,const struct ovpn_bind * bind)966 static void __ovpn_peer_hash_transp_addr(struct ovpn_peer *peer,
967 const struct ovpn_bind *bind)
968 {
969 struct sockaddr_storage sa = {};
970 struct hlist_nulls_head *nhead;
971 struct sockaddr_in6 *sa6;
972 struct sockaddr_in *sa4;
973 size_t salen;
974
975 lockdep_assert_held(&peer->ovpn->lock);
976 lockdep_assert_held(&peer->lock);
977
978 if (WARN_ON_ONCE(!bind))
979 return;
980
981 /* peer may have been concurrently removed between the caller's
982 * initial lookup and our acquisition of ovpn->lock; skip the
983 * rehash so we don't re-insert a removed peer
984 */
985 if (unlikely(hlist_unhashed(&peer->hash_entry_id)))
986 return;
987
988 /* Build the hash key from the transport identity only
989 * (family/address/port), matching ovpn_peer_add_mp() and the lookup
990 * in ovpn_peer_get_by_transp_addr(). Hashing bind->remote directly
991 * would fold in sin6_scope_id (set on the float path but never by the
992 * lookup), scattering the peer into a bucket lookups cannot reach.
993 */
994 switch (bind->remote.in4.sin_family) {
995 case AF_INET:
996 sa4 = (struct sockaddr_in *)&sa;
997 sa4->sin_family = AF_INET;
998 sa4->sin_addr.s_addr = bind->remote.in4.sin_addr.s_addr;
999 sa4->sin_port = bind->remote.in4.sin_port;
1000 salen = sizeof(*sa4);
1001 break;
1002 case AF_INET6:
1003 sa6 = (struct sockaddr_in6 *)&sa;
1004 sa6->sin6_family = AF_INET6;
1005 sa6->sin6_addr = bind->remote.in6.sin6_addr;
1006 sa6->sin6_port = bind->remote.in6.sin6_port;
1007 salen = sizeof(*sa6);
1008 break;
1009 default:
1010 return;
1011 }
1012
1013 /* remove old hashing (no-op if entry is not currently linked) */
1014 hlist_nulls_del_init_rcu(&peer->hash_entry_transp_addr);
1015 /* re-add with current transport address */
1016 nhead = ovpn_get_hash_head(peer->ovpn->peers->by_transp_addr, &sa,
1017 salen);
1018 hlist_nulls_add_head_rcu(&peer->hash_entry_transp_addr, nhead);
1019 }
1020
ovpn_peer_hash_transp_addr(struct ovpn_peer * peer)1021 void ovpn_peer_hash_transp_addr(struct ovpn_peer *peer)
1022 {
1023 struct ovpn_bind *bind;
1024
1025 lockdep_assert_held(&peer->ovpn->lock);
1026
1027 /* rehashing makes sense only in multipeer mode */
1028 if (peer->ovpn->mode != OVPN_MODE_MP)
1029 return;
1030
1031 spin_lock_bh(&peer->lock);
1032 bind = rcu_dereference_protected(peer->bind,
1033 lockdep_is_held(&peer->lock));
1034 __ovpn_peer_hash_transp_addr(peer, bind);
1035 spin_unlock_bh(&peer->lock);
1036 }
1037
ovpn_peer_hash_vpn_ip(struct ovpn_peer * peer)1038 void ovpn_peer_hash_vpn_ip(struct ovpn_peer *peer)
1039 {
1040 struct hlist_nulls_head *nhead;
1041
1042 lockdep_assert_held(&peer->ovpn->lock);
1043
1044 /* rehashing makes sense only in multipeer mode */
1045 if (peer->ovpn->mode != OVPN_MODE_MP)
1046 return;
1047
1048 /* peer may have been concurrently removed between the caller's
1049 * initial lookup and our acquisition of ovpn->lock; skip the
1050 * rehash so we don't re-insert a removed peer
1051 */
1052 if (hlist_unhashed(&peer->hash_entry_id))
1053 return;
1054
1055 /* remove potential old hashing */
1056 hlist_nulls_del_init_rcu(&peer->hash_entry_addr4);
1057 hlist_nulls_del_init_rcu(&peer->hash_entry_addr6);
1058
1059 if (peer->vpn_addrs.ipv4.s_addr != htonl(INADDR_ANY)) {
1060 nhead = ovpn_get_hash_head(peer->ovpn->peers->by_vpn_addr4,
1061 &peer->vpn_addrs.ipv4,
1062 sizeof(peer->vpn_addrs.ipv4));
1063 hlist_nulls_add_head_rcu(&peer->hash_entry_addr4, nhead);
1064 }
1065
1066 if (!ipv6_addr_any(&peer->vpn_addrs.ipv6)) {
1067 nhead = ovpn_get_hash_head(peer->ovpn->peers->by_vpn_addr6,
1068 &peer->vpn_addrs.ipv6,
1069 sizeof(peer->vpn_addrs.ipv6));
1070 hlist_nulls_add_head_rcu(&peer->hash_entry_addr6, nhead);
1071 }
1072 }
1073
1074 /**
1075 * ovpn_peer_add_mp - add peer to related tables in a MP instance
1076 * @ovpn: the instance to add the peer to
1077 * @peer: the peer to add
1078 *
1079 * Return: 0 on success or a negative error code otherwise
1080 */
ovpn_peer_add_mp(struct ovpn_priv * ovpn,struct ovpn_peer * peer)1081 static int ovpn_peer_add_mp(struct ovpn_priv *ovpn, struct ovpn_peer *peer)
1082 {
1083 struct sockaddr_storage sa = { 0 };
1084 struct hlist_nulls_head *nhead;
1085 struct sockaddr_in6 *sa6;
1086 struct sockaddr_in *sa4;
1087 struct ovpn_bind *bind;
1088 struct ovpn_peer *tmp;
1089 size_t salen;
1090 int ret = 0;
1091
1092 spin_lock_bh(&ovpn->lock);
1093 /* do not add duplicates */
1094 tmp = ovpn_peer_get_by_id(ovpn, peer->id);
1095 if (tmp) {
1096 ovpn_peer_put(tmp);
1097 ret = -EEXIST;
1098 goto out;
1099 }
1100
1101 /* reject peer with conflicting VPN address */
1102 if (ovpn_peer_vpn_addr_conflict4(ovpn, NULL, &peer->vpn_addrs.ipv4) ||
1103 ovpn_peer_vpn_addr_conflict6(ovpn, NULL, &peer->vpn_addrs.ipv6)) {
1104 ret = -EADDRINUSE;
1105 goto out;
1106 }
1107
1108 bind = rcu_dereference_protected(peer->bind, true);
1109 /* peers connected via TCP have bind == NULL */
1110 if (bind) {
1111 switch (bind->remote.in4.sin_family) {
1112 case AF_INET:
1113 sa4 = (struct sockaddr_in *)&sa;
1114
1115 sa4->sin_family = AF_INET;
1116 sa4->sin_addr.s_addr = bind->remote.in4.sin_addr.s_addr;
1117 sa4->sin_port = bind->remote.in4.sin_port;
1118 salen = sizeof(*sa4);
1119 break;
1120 case AF_INET6:
1121 sa6 = (struct sockaddr_in6 *)&sa;
1122
1123 sa6->sin6_family = AF_INET6;
1124 sa6->sin6_addr = bind->remote.in6.sin6_addr;
1125 sa6->sin6_port = bind->remote.in6.sin6_port;
1126 salen = sizeof(*sa6);
1127 break;
1128 default:
1129 ret = -EPROTONOSUPPORT;
1130 goto out;
1131 }
1132
1133 nhead = ovpn_get_hash_head(ovpn->peers->by_transp_addr, &sa,
1134 salen);
1135 hlist_nulls_add_head_rcu(&peer->hash_entry_transp_addr, nhead);
1136 }
1137
1138 hlist_add_head_rcu(&peer->hash_entry_id,
1139 ovpn_get_hash_head(ovpn->peers->by_id, &peer->id,
1140 sizeof(peer->id)));
1141
1142 ovpn_peer_hash_vpn_ip(peer);
1143 out:
1144 spin_unlock_bh(&ovpn->lock);
1145 return ret;
1146 }
1147
1148 /**
1149 * ovpn_peer_add_p2p - add peer to related tables in a P2P instance
1150 * @ovpn: the instance to add the peer to
1151 * @peer: the peer to add
1152 *
1153 * Return: 0 on success or a negative error code otherwise
1154 */
ovpn_peer_add_p2p(struct ovpn_priv * ovpn,struct ovpn_peer * peer)1155 static int ovpn_peer_add_p2p(struct ovpn_priv *ovpn, struct ovpn_peer *peer)
1156 {
1157 LLIST_HEAD(release_list);
1158 struct ovpn_peer *tmp;
1159
1160 spin_lock_bh(&ovpn->lock);
1161 /* in p2p mode it is possible to have a single peer only, therefore the
1162 * old one is released and substituted by the new one
1163 */
1164 tmp = rcu_dereference_protected(ovpn->peer,
1165 lockdep_is_held(&ovpn->lock));
1166 if (tmp)
1167 ovpn_peer_remove(tmp, OVPN_DEL_PEER_REASON_TEARDOWN,
1168 &release_list);
1169
1170 rcu_assign_pointer(ovpn->peer, peer);
1171 /* in P2P mode the carrier is switched on when the peer is added */
1172 netif_carrier_on(ovpn->dev);
1173 unlock_ovpn(ovpn, &release_list);
1174
1175 return 0;
1176 }
1177
1178 /**
1179 * ovpn_peer_add - add peer to the related tables
1180 * @ovpn: the openvpn instance the peer belongs to
1181 * @peer: the peer object to add
1182 *
1183 * Assume refcounter was increased by caller
1184 *
1185 * Return: 0 on success or a negative error code otherwise
1186 */
ovpn_peer_add(struct ovpn_priv * ovpn,struct ovpn_peer * peer)1187 int ovpn_peer_add(struct ovpn_priv *ovpn, struct ovpn_peer *peer)
1188 {
1189 int ret = -ENODEV;
1190
1191 /* Prevent adding new peers while destroying the ovpn interface.
1192 * Failing to do so would end up holding the device reference
1193 * endlessly hostage of the new peer object with no chance of
1194 * release..
1195 */
1196 netdev_lock(ovpn->dev);
1197 if (ovpn->dev->reg_state != NETREG_REGISTERED)
1198 goto out;
1199
1200 switch (ovpn->mode) {
1201 case OVPN_MODE_MP:
1202 ret = ovpn_peer_add_mp(ovpn, peer);
1203 break;
1204 case OVPN_MODE_P2P:
1205 ret = ovpn_peer_add_p2p(ovpn, peer);
1206 break;
1207 }
1208 out:
1209 netdev_unlock(ovpn->dev);
1210
1211 return ret;
1212 }
1213
1214 /**
1215 * ovpn_peer_del_mp - delete peer from related tables in a MP instance
1216 * @peer: the peer to delete
1217 * @reason: reason why the peer was deleted (sent to userspace)
1218 * @release_list: list where delete peer should be appended
1219 *
1220 * Return: 0 on success or a negative error code otherwise
1221 */
ovpn_peer_del_mp(struct ovpn_peer * peer,enum ovpn_del_peer_reason reason,struct llist_head * release_list)1222 static int ovpn_peer_del_mp(struct ovpn_peer *peer,
1223 enum ovpn_del_peer_reason reason,
1224 struct llist_head *release_list)
1225 {
1226 struct ovpn_peer *tmp;
1227 int ret = -ENOENT;
1228
1229 lockdep_assert_held(&peer->ovpn->lock);
1230
1231 tmp = ovpn_peer_get_by_id(peer->ovpn, peer->id);
1232 if (tmp == peer) {
1233 ovpn_peer_remove(peer, reason, release_list);
1234 ret = 0;
1235 }
1236
1237 if (tmp)
1238 ovpn_peer_put(tmp);
1239
1240 return ret;
1241 }
1242
1243 /**
1244 * ovpn_peer_del_p2p - delete peer from related tables in a P2P instance
1245 * @peer: the peer to delete
1246 * @reason: reason why the peer was deleted (sent to userspace)
1247 * @release_list: list where delete peer should be appended
1248 *
1249 * Return: 0 on success or a negative error code otherwise
1250 */
ovpn_peer_del_p2p(struct ovpn_peer * peer,enum ovpn_del_peer_reason reason,struct llist_head * release_list)1251 static int ovpn_peer_del_p2p(struct ovpn_peer *peer,
1252 enum ovpn_del_peer_reason reason,
1253 struct llist_head *release_list)
1254 {
1255 struct ovpn_peer *tmp;
1256
1257 lockdep_assert_held(&peer->ovpn->lock);
1258
1259 tmp = rcu_dereference_protected(peer->ovpn->peer,
1260 lockdep_is_held(&peer->ovpn->lock));
1261 if (tmp != peer)
1262 return -ENOENT;
1263
1264 ovpn_peer_remove(peer, reason, release_list);
1265
1266 return 0;
1267 }
1268
1269 /**
1270 * ovpn_peer_del - delete peer from related tables
1271 * @peer: the peer object to delete
1272 * @reason: reason for deleting peer (will be sent to userspace)
1273 *
1274 * Return: 0 on success or a negative error code otherwise
1275 */
ovpn_peer_del(struct ovpn_peer * peer,enum ovpn_del_peer_reason reason)1276 int ovpn_peer_del(struct ovpn_peer *peer, enum ovpn_del_peer_reason reason)
1277 {
1278 LLIST_HEAD(release_list);
1279 int ret = -EOPNOTSUPP;
1280
1281 spin_lock_bh(&peer->ovpn->lock);
1282 switch (peer->ovpn->mode) {
1283 case OVPN_MODE_MP:
1284 ret = ovpn_peer_del_mp(peer, reason, &release_list);
1285 break;
1286 case OVPN_MODE_P2P:
1287 ret = ovpn_peer_del_p2p(peer, reason, &release_list);
1288 break;
1289 default:
1290 break;
1291 }
1292 unlock_ovpn(peer->ovpn, &release_list);
1293
1294 return ret;
1295 }
1296
1297 /**
1298 * ovpn_peer_release_p2p - release peer upon P2P device teardown
1299 * @ovpn: the instance being torn down
1300 * @sk: if not NULL, release peer only if it's using this specific socket
1301 * @reason: the reason for releasing the peer
1302 */
ovpn_peer_release_p2p(struct ovpn_priv * ovpn,struct sock * sk,enum ovpn_del_peer_reason reason)1303 static void ovpn_peer_release_p2p(struct ovpn_priv *ovpn, struct sock *sk,
1304 enum ovpn_del_peer_reason reason)
1305 {
1306 struct ovpn_socket *ovpn_sock;
1307 LLIST_HEAD(release_list);
1308 struct ovpn_peer *peer;
1309
1310 spin_lock_bh(&ovpn->lock);
1311 peer = rcu_dereference_protected(ovpn->peer,
1312 lockdep_is_held(&ovpn->lock));
1313 if (!peer) {
1314 spin_unlock_bh(&ovpn->lock);
1315 return;
1316 }
1317
1318 if (sk) {
1319 ovpn_sock = rcu_dereference_bh(peer->sock);
1320 if (!ovpn_sock || ovpn_sock->sk != sk) {
1321 spin_unlock_bh(&ovpn->lock);
1322 return;
1323 }
1324 }
1325
1326 ovpn_peer_remove(peer, reason, &release_list);
1327 unlock_ovpn(ovpn, &release_list);
1328 }
1329
ovpn_peers_release_mp(struct ovpn_priv * ovpn,struct sock * sk,enum ovpn_del_peer_reason reason)1330 static void ovpn_peers_release_mp(struct ovpn_priv *ovpn, struct sock *sk,
1331 enum ovpn_del_peer_reason reason)
1332 {
1333 struct ovpn_socket *ovpn_sock;
1334 LLIST_HEAD(release_list);
1335 struct ovpn_peer *peer;
1336 struct hlist_node *tmp;
1337 int bkt;
1338
1339 spin_lock_bh(&ovpn->lock);
1340 hash_for_each_safe(ovpn->peers->by_id, bkt, tmp, peer, hash_entry_id) {
1341 bool remove = true;
1342
1343 /* if a socket was passed as argument, skip all peers except
1344 * those using it
1345 */
1346 if (sk) {
1347 rcu_read_lock();
1348 ovpn_sock = rcu_dereference(peer->sock);
1349 remove = ovpn_sock && ovpn_sock->sk == sk;
1350 rcu_read_unlock();
1351 }
1352
1353 if (remove)
1354 ovpn_peer_remove(peer, reason, &release_list);
1355 }
1356 unlock_ovpn(ovpn, &release_list);
1357 }
1358
1359 /**
1360 * ovpn_peers_free - free all peers in the instance
1361 * @ovpn: the instance whose peers should be released
1362 * @sk: if not NULL, only peers using this socket are removed and the socket
1363 * is released immediately
1364 * @reason: the reason for releasing all peers
1365 */
ovpn_peers_free(struct ovpn_priv * ovpn,struct sock * sk,enum ovpn_del_peer_reason reason)1366 void ovpn_peers_free(struct ovpn_priv *ovpn, struct sock *sk,
1367 enum ovpn_del_peer_reason reason)
1368 {
1369 switch (ovpn->mode) {
1370 case OVPN_MODE_P2P:
1371 ovpn_peer_release_p2p(ovpn, sk, reason);
1372 break;
1373 case OVPN_MODE_MP:
1374 ovpn_peers_release_mp(ovpn, sk, reason);
1375 break;
1376 }
1377 }
1378
ovpn_peer_keepalive_work_single(struct ovpn_peer * peer,time64_t now,struct llist_head * release_list)1379 static time64_t ovpn_peer_keepalive_work_single(struct ovpn_peer *peer,
1380 time64_t now,
1381 struct llist_head *release_list)
1382 {
1383 time64_t last_recv, last_sent, next_run1, next_run2;
1384 unsigned long timeout, interval;
1385 bool expired;
1386
1387 spin_lock_bh(&peer->lock);
1388 /* we expect both timers to be configured at the same time,
1389 * therefore bail out if either is not set
1390 */
1391 if (!peer->keepalive_timeout || !peer->keepalive_interval) {
1392 spin_unlock_bh(&peer->lock);
1393 return 0;
1394 }
1395
1396 /* check for peer timeout */
1397 expired = false;
1398 timeout = peer->keepalive_timeout;
1399 last_recv = READ_ONCE(peer->last_recv);
1400 if (now < last_recv + timeout) {
1401 peer->keepalive_recv_exp = last_recv + timeout;
1402 next_run1 = peer->keepalive_recv_exp;
1403 } else if (peer->keepalive_recv_exp > now) {
1404 next_run1 = peer->keepalive_recv_exp;
1405 } else {
1406 expired = true;
1407 }
1408
1409 if (expired) {
1410 /* peer is dead -> kill it and move on */
1411 spin_unlock_bh(&peer->lock);
1412 netdev_dbg(peer->ovpn->dev, "peer %u expired\n",
1413 peer->id);
1414 ovpn_peer_remove(peer, OVPN_DEL_PEER_REASON_EXPIRED,
1415 release_list);
1416 return 0;
1417 }
1418
1419 /* check for peer keepalive */
1420 expired = false;
1421 interval = peer->keepalive_interval;
1422 last_sent = READ_ONCE(peer->last_sent);
1423 if (now < last_sent + interval) {
1424 peer->keepalive_xmit_exp = last_sent + interval;
1425 next_run2 = peer->keepalive_xmit_exp;
1426 } else if (peer->keepalive_xmit_exp > now) {
1427 next_run2 = peer->keepalive_xmit_exp;
1428 } else {
1429 expired = true;
1430 next_run2 = now + interval;
1431 }
1432 spin_unlock_bh(&peer->lock);
1433
1434 if (expired) {
1435 /* a keepalive packet is required */
1436 netdev_dbg(peer->ovpn->dev,
1437 "sending keepalive to peer %u\n",
1438 peer->id);
1439 if (WARN_ON(!ovpn_peer_hold(peer)))
1440 return 0;
1441 if (!queue_work(ovpn_wq, &peer->keepalive_work))
1442 ovpn_peer_put(peer);
1443 }
1444
1445 if (next_run1 < next_run2)
1446 return next_run1;
1447
1448 return next_run2;
1449 }
1450
ovpn_peer_keepalive_work_mp(struct ovpn_priv * ovpn,time64_t now,struct llist_head * release_list)1451 static time64_t ovpn_peer_keepalive_work_mp(struct ovpn_priv *ovpn,
1452 time64_t now,
1453 struct llist_head *release_list)
1454 {
1455 time64_t tmp_next_run, next_run = 0;
1456 struct hlist_node *tmp;
1457 struct ovpn_peer *peer;
1458 int bkt;
1459
1460 lockdep_assert_held(&ovpn->lock);
1461
1462 hash_for_each_safe(ovpn->peers->by_id, bkt, tmp, peer, hash_entry_id) {
1463 tmp_next_run = ovpn_peer_keepalive_work_single(peer, now,
1464 release_list);
1465 if (!tmp_next_run)
1466 continue;
1467
1468 /* the next worker run will be scheduled based on the shortest
1469 * required interval across all peers
1470 */
1471 if (!next_run || tmp_next_run < next_run)
1472 next_run = tmp_next_run;
1473 }
1474
1475 return next_run;
1476 }
1477
ovpn_peer_keepalive_work_p2p(struct ovpn_priv * ovpn,time64_t now,struct llist_head * release_list)1478 static time64_t ovpn_peer_keepalive_work_p2p(struct ovpn_priv *ovpn,
1479 time64_t now,
1480 struct llist_head *release_list)
1481 {
1482 struct ovpn_peer *peer;
1483 time64_t next_run = 0;
1484
1485 lockdep_assert_held(&ovpn->lock);
1486
1487 peer = rcu_dereference_protected(ovpn->peer,
1488 lockdep_is_held(&ovpn->lock));
1489 if (peer)
1490 next_run = ovpn_peer_keepalive_work_single(peer, now,
1491 release_list);
1492
1493 return next_run;
1494 }
1495
1496 /**
1497 * ovpn_peer_keepalive_work - run keepalive logic on each known peer
1498 * @work: pointer to the work member of the related ovpn object
1499 *
1500 * Each peer has two timers (if configured):
1501 * 1. peer timeout: when no data is received for a certain interval,
1502 * the peer is considered dead and it gets killed.
1503 * 2. peer keepalive: when no data is sent to a certain peer for a
1504 * certain interval, a special 'keepalive' packet is explicitly sent.
1505 *
1506 * This function iterates across the whole peer collection while
1507 * checking the timers described above.
1508 */
ovpn_peer_keepalive_work(struct work_struct * work)1509 void ovpn_peer_keepalive_work(struct work_struct *work)
1510 {
1511 struct ovpn_priv *ovpn = container_of(work, struct ovpn_priv,
1512 keepalive_work.work);
1513 time64_t next_run = 0, now = ktime_get_boottime_seconds();
1514 LLIST_HEAD(release_list);
1515
1516 spin_lock_bh(&ovpn->lock);
1517 switch (ovpn->mode) {
1518 case OVPN_MODE_MP:
1519 next_run = ovpn_peer_keepalive_work_mp(ovpn, now,
1520 &release_list);
1521 break;
1522 case OVPN_MODE_P2P:
1523 next_run = ovpn_peer_keepalive_work_p2p(ovpn, now,
1524 &release_list);
1525 break;
1526 }
1527
1528 /* prevent rearming if the interface is being destroyed */
1529 if (next_run > 0) {
1530 netdev_dbg(ovpn->dev,
1531 "scheduling keepalive work: now=%llu next_run=%llu delta=%llu\n",
1532 next_run, now, next_run - now);
1533 queue_delayed_work(ovpn_wq, &ovpn->keepalive_work,
1534 (next_run - now) * HZ);
1535 }
1536 unlock_ovpn(ovpn, &release_list);
1537 }
1538