1 // SPDX-License-Identifier: GPL-2.0
2 /* OpenVPN data channel offload
3 *
4 * Copyright (C) 2020-2025 OpenVPN, Inc.
5 *
6 * Author: Antonio Quartulli <antonio@openvpn.net>
7 * James Yonan <james@openvpn.net>
8 */
9
10 #include <linux/ethtool.h>
11 #include <linux/genetlink.h>
12 #include <linux/module.h>
13 #include <linux/netdevice.h>
14 #include <linux/inetdevice.h>
15 #include <linux/workqueue.h>
16 #include <net/gro_cells.h>
17 #include <net/ip.h>
18 #include <net/rtnetlink.h>
19 #include <uapi/linux/if_arp.h>
20
21 #include "ovpnpriv.h"
22 #include "main.h"
23 #include "netlink.h"
24 #include "io.h"
25 #include "peer.h"
26 #include "proto.h"
27 #include "tcp.h"
28 #include "udp.h"
29
30 /* module-owned workqueue on which all ovpn-specific work is queued */
31 struct workqueue_struct *ovpn_wq;
32
ovpn_priv_free(struct net_device * net)33 static void ovpn_priv_free(struct net_device *net)
34 {
35 struct ovpn_priv *ovpn = netdev_priv(net);
36
37 kfree(ovpn->peers);
38 }
39
ovpn_mp_alloc(struct ovpn_priv * ovpn)40 static int ovpn_mp_alloc(struct ovpn_priv *ovpn)
41 {
42 int i;
43
44 if (ovpn->mode != OVPN_MODE_MP)
45 return 0;
46
47 /* the peer container is fairly large, therefore we allocate it only in
48 * MP mode
49 */
50 ovpn->peers = kzalloc_obj(*ovpn->peers);
51 if (!ovpn->peers)
52 return -ENOMEM;
53
54 for (i = 0; i < ARRAY_SIZE(ovpn->peers->by_id); i++) {
55 INIT_HLIST_HEAD(&ovpn->peers->by_id[i]);
56 INIT_HLIST_NULLS_HEAD(&ovpn->peers->by_vpn_addr4[i], i);
57 INIT_HLIST_NULLS_HEAD(&ovpn->peers->by_vpn_addr6[i], i);
58 INIT_HLIST_NULLS_HEAD(&ovpn->peers->by_transp_addr[i], i);
59 }
60
61 return 0;
62 }
63
ovpn_net_init(struct net_device * dev)64 static int ovpn_net_init(struct net_device *dev)
65 {
66 struct ovpn_priv *ovpn = netdev_priv(dev);
67 int err = gro_cells_init(&ovpn->gro_cells, dev);
68
69 if (err < 0)
70 return err;
71
72 err = ovpn_mp_alloc(ovpn);
73 if (err < 0) {
74 gro_cells_destroy(&ovpn->gro_cells);
75 return err;
76 }
77
78 return 0;
79 }
80
ovpn_net_uninit(struct net_device * dev)81 static void ovpn_net_uninit(struct net_device *dev)
82 {
83 struct ovpn_priv *ovpn = netdev_priv(dev);
84
85 disable_delayed_work_sync(&ovpn->keepalive_work);
86 ovpn_peers_free(ovpn, NULL, OVPN_DEL_PEER_REASON_TEARDOWN);
87 gro_cells_destroy(&ovpn->gro_cells);
88 }
89
ovpn_net_open(struct net_device * dev)90 static int ovpn_net_open(struct net_device *dev)
91 {
92 struct ovpn_priv *ovpn = netdev_priv(dev);
93 struct in_device *dev_v4;
94
95 /* the IPv4 in_device (and thus its config) is recreated whenever the
96 * interface is moved to a new netns, so redirects must be disabled on
97 * every bring-up rather than once at creation time, otherwise the
98 * setting is silently lost after such a move
99 */
100 if (ovpn->mode == OVPN_MODE_MP) {
101 dev_v4 = __in_dev_get_rtnl(dev);
102 if (dev_v4) {
103 /* disable redirects as Linux gets confused by ovpn
104 * handling same-LAN routing.
105 * This happens because a multipeer interface is used as
106 * relay point between hosts in the same subnet, while
107 * in a classic LAN this would not be needed because the
108 * two hosts would be able to talk directly.
109 */
110 IN_DEV_CONF_SET(dev_v4, SEND_REDIRECTS, false);
111 IPV4_DEVCONF_ALL(dev_net(dev), SEND_REDIRECTS) = false;
112 }
113 }
114
115 return 0;
116 }
117
118 static const struct net_device_ops ovpn_netdev_ops = {
119 .ndo_init = ovpn_net_init,
120 .ndo_uninit = ovpn_net_uninit,
121 .ndo_open = ovpn_net_open,
122 .ndo_start_xmit = ovpn_net_xmit,
123 };
124
125 static const struct device_type ovpn_type = {
126 .name = OVPN_FAMILY_NAME,
127 };
128
129 static const struct nla_policy ovpn_policy[IFLA_OVPN_MAX + 1] = {
130 [IFLA_OVPN_MODE] = NLA_POLICY_RANGE(NLA_U8, OVPN_MODE_P2P,
131 OVPN_MODE_MP),
132 };
133
134 /**
135 * ovpn_dev_is_valid - check if the netdevice is of type 'ovpn'
136 * @dev: the interface to check
137 *
138 * Return: whether the netdevice is of type 'ovpn'
139 */
ovpn_dev_is_valid(const struct net_device * dev)140 bool ovpn_dev_is_valid(const struct net_device *dev)
141 {
142 return dev->netdev_ops == &ovpn_netdev_ops;
143 }
144
ovpn_get_drvinfo(struct net_device * dev,struct ethtool_drvinfo * info)145 static void ovpn_get_drvinfo(struct net_device *dev,
146 struct ethtool_drvinfo *info)
147 {
148 strscpy(info->driver, "ovpn", sizeof(info->driver));
149 strscpy(info->bus_info, "ovpn", sizeof(info->bus_info));
150 }
151
152 static const struct ethtool_ops ovpn_ethtool_ops = {
153 .get_drvinfo = ovpn_get_drvinfo,
154 .get_link = ethtool_op_get_link,
155 .get_ts_info = ethtool_op_get_ts_info,
156 };
157
ovpn_setup(struct net_device * dev)158 static void ovpn_setup(struct net_device *dev)
159 {
160 netdev_features_t feat = NETIF_F_SG | NETIF_F_GSO |
161 NETIF_F_GSO_SOFTWARE | NETIF_F_HIGHDMA;
162
163 dev->needs_free_netdev = true;
164
165 dev->pcpu_stat_type = NETDEV_PCPU_STAT_DSTATS;
166
167 dev->ethtool_ops = &ovpn_ethtool_ops;
168 dev->netdev_ops = &ovpn_netdev_ops;
169
170 dev->priv_destructor = ovpn_priv_free;
171
172 dev->hard_header_len = 0;
173 dev->addr_len = 0;
174 dev->mtu = ETH_DATA_LEN - OVPN_HEAD_ROOM;
175 dev->min_mtu = IPV4_MIN_MTU;
176 dev->max_mtu = IP_MAX_MTU - OVPN_HEAD_ROOM;
177
178 dev->type = ARPHRD_NONE;
179 dev->flags = IFF_POINTOPOINT | IFF_NOARP;
180 dev->priv_flags |= IFF_NO_QUEUE;
181 /* when routing packets to a LAN behind a client, we rely on the
182 * route entry that originally brought the packet into ovpn, so
183 * don't release it
184 */
185 netif_keep_dst(dev);
186
187 dev->lltx = true;
188 dev->features |= feat;
189 dev->hw_features |= feat;
190 dev->hw_enc_features |= feat;
191
192 dev->needed_headroom = ALIGN(OVPN_HEAD_ROOM, 4);
193 dev->needed_tailroom = OVPN_MAX_PADDING;
194
195 SET_NETDEV_DEVTYPE(dev, &ovpn_type);
196 }
197
ovpn_newlink(struct net_device * dev,struct rtnl_newlink_params * params,struct netlink_ext_ack * extack)198 static int ovpn_newlink(struct net_device *dev,
199 struct rtnl_newlink_params *params,
200 struct netlink_ext_ack *extack)
201 {
202 struct ovpn_priv *ovpn = netdev_priv(dev);
203 struct nlattr **data = params->data;
204 enum ovpn_mode mode = OVPN_MODE_P2P;
205 int ret;
206
207 if (data && data[IFLA_OVPN_MODE]) {
208 mode = nla_get_u8(data[IFLA_OVPN_MODE]);
209 netdev_dbg(dev, "setting device mode: %u\n", mode);
210 }
211
212 ovpn->dev = dev;
213 ovpn->mode = mode;
214 spin_lock_init(&ovpn->lock);
215 INIT_DELAYED_WORK(&ovpn->keepalive_work, ovpn_peer_keepalive_work);
216
217 /* Set carrier explicitly after registration, this way state is
218 * clearly defined.
219 *
220 * In case of MP interfaces we keep the carrier always on.
221 *
222 * Carrier for P2P interfaces is initially off and it is then
223 * switched on and off when the remote peer is added or deleted.
224 */
225 if (ovpn->mode == OVPN_MODE_MP)
226 netif_carrier_on(dev);
227 else
228 netif_carrier_off(dev);
229
230 ret = register_netdevice(dev);
231 if (ret < 0)
232 return ret;
233
234 return 0;
235 }
236
ovpn_get_size(const struct net_device * dev)237 static size_t ovpn_get_size(const struct net_device *dev)
238 {
239 /* IFLA_OVPN_MODE */
240 return nla_total_size(sizeof(u8));
241 }
242
ovpn_fill_info(struct sk_buff * skb,const struct net_device * dev)243 static int ovpn_fill_info(struct sk_buff *skb, const struct net_device *dev)
244 {
245 struct ovpn_priv *ovpn = netdev_priv(dev);
246
247 if (nla_put_u8(skb, IFLA_OVPN_MODE, ovpn->mode))
248 return -EMSGSIZE;
249
250 return 0;
251 }
252
253 static struct rtnl_link_ops ovpn_link_ops = {
254 .kind = "ovpn",
255 .netns_refund = false,
256 .priv_size = sizeof(struct ovpn_priv),
257 .setup = ovpn_setup,
258 .policy = ovpn_policy,
259 .maxtype = IFLA_OVPN_MAX,
260 .newlink = ovpn_newlink,
261 .get_size = ovpn_get_size,
262 .fill_info = ovpn_fill_info,
263 };
264
ovpn_init(void)265 static int __init ovpn_init(void)
266 {
267 int err;
268
269 ovpn_tcp_init();
270
271 ovpn_wq = alloc_workqueue("ovpn", WQ_PERCPU, 0);
272 if (!ovpn_wq) {
273 pr_err("ovpn: cannot allocate workqueue\n");
274 return -ENOMEM;
275 }
276
277 err = rtnl_link_register(&ovpn_link_ops);
278 if (err) {
279 pr_err("ovpn: can't register rtnl link ops: %d\n", err);
280 goto destroy_wq;
281 }
282
283 err = ovpn_nl_register();
284 if (err) {
285 pr_err("ovpn: can't register netlink family: %d\n", err);
286 goto unreg_rtnl;
287 }
288
289 return 0;
290
291 unreg_rtnl:
292 rtnl_link_unregister(&ovpn_link_ops);
293 destroy_wq:
294 destroy_workqueue(ovpn_wq);
295 ovpn_wq = NULL;
296 return err;
297 }
298
ovpn_cleanup(void)299 static __exit void ovpn_cleanup(void)
300 {
301 ovpn_nl_unregister();
302 rtnl_link_unregister(&ovpn_link_ops);
303
304 flush_workqueue(ovpn_wq);
305 rcu_barrier();
306
307 destroy_workqueue(ovpn_wq);
308 ovpn_wq = NULL;
309 }
310
311 module_init(ovpn_init);
312 module_exit(ovpn_cleanup);
313
314 MODULE_DESCRIPTION("OpenVPN data channel offload (ovpn)");
315 MODULE_AUTHOR("Antonio Quartulli <antonio@openvpn.net>");
316 MODULE_LICENSE("GPL");
317