1 // SPDX-License-Identifier: GPL-2.0 2 /* OpenVPN data channel offload 3 * 4 * Copyright (C) 2020-2025 OpenVPN, Inc. 5 * 6 * Author: Antonio Quartulli <antonio@openvpn.net> 7 * James Yonan <james@openvpn.net> 8 */ 9 10 #include <linux/ethtool.h> 11 #include <linux/genetlink.h> 12 #include <linux/module.h> 13 #include <linux/netdevice.h> 14 #include <linux/inetdevice.h> 15 #include <net/gro_cells.h> 16 #include <net/ip.h> 17 #include <net/rtnetlink.h> 18 #include <uapi/linux/if_arp.h> 19 20 #include "ovpnpriv.h" 21 #include "main.h" 22 #include "netlink.h" 23 #include "io.h" 24 #include "peer.h" 25 #include "proto.h" 26 #include "tcp.h" 27 #include "udp.h" 28 29 static void ovpn_priv_free(struct net_device *net) 30 { 31 struct ovpn_priv *ovpn = netdev_priv(net); 32 33 kfree(ovpn->peers); 34 } 35 36 static int ovpn_mp_alloc(struct ovpn_priv *ovpn) 37 { 38 int i; 39 40 if (ovpn->mode != OVPN_MODE_MP) 41 return 0; 42 43 /* the peer container is fairly large, therefore we allocate it only in 44 * MP mode 45 */ 46 ovpn->peers = kzalloc_obj(*ovpn->peers); 47 if (!ovpn->peers) 48 return -ENOMEM; 49 50 for (i = 0; i < ARRAY_SIZE(ovpn->peers->by_id); i++) { 51 INIT_HLIST_HEAD(&ovpn->peers->by_id[i]); 52 INIT_HLIST_NULLS_HEAD(&ovpn->peers->by_vpn_addr4[i], i); 53 INIT_HLIST_NULLS_HEAD(&ovpn->peers->by_vpn_addr6[i], i); 54 INIT_HLIST_NULLS_HEAD(&ovpn->peers->by_transp_addr[i], i); 55 } 56 57 return 0; 58 } 59 60 static int ovpn_net_init(struct net_device *dev) 61 { 62 struct ovpn_priv *ovpn = netdev_priv(dev); 63 int err = gro_cells_init(&ovpn->gro_cells, dev); 64 65 if (err < 0) 66 return err; 67 68 err = ovpn_mp_alloc(ovpn); 69 if (err < 0) { 70 gro_cells_destroy(&ovpn->gro_cells); 71 return err; 72 } 73 74 return 0; 75 } 76 77 static void ovpn_net_uninit(struct net_device *dev) 78 { 79 struct ovpn_priv *ovpn = netdev_priv(dev); 80 81 disable_delayed_work_sync(&ovpn->keepalive_work); 82 ovpn_peers_free(ovpn, NULL, OVPN_DEL_PEER_REASON_TEARDOWN); 83 gro_cells_destroy(&ovpn->gro_cells); 84 } 85 86 static int ovpn_net_open(struct net_device *dev) 87 { 88 struct ovpn_priv *ovpn = netdev_priv(dev); 89 struct in_device *dev_v4; 90 91 /* the IPv4 in_device (and thus its config) is recreated whenever the 92 * interface is moved to a new netns, so redirects must be disabled on 93 * every bring-up rather than once at creation time, otherwise the 94 * setting is silently lost after such a move 95 */ 96 if (ovpn->mode == OVPN_MODE_MP) { 97 dev_v4 = __in_dev_get_rtnl(dev); 98 if (dev_v4) { 99 /* disable redirects as Linux gets confused by ovpn 100 * handling same-LAN routing. 101 * This happens because a multipeer interface is used as 102 * relay point between hosts in the same subnet, while 103 * in a classic LAN this would not be needed because the 104 * two hosts would be able to talk directly. 105 */ 106 IN_DEV_CONF_SET(dev_v4, SEND_REDIRECTS, false); 107 IPV4_DEVCONF_ALL(dev_net(dev), SEND_REDIRECTS) = false; 108 } 109 } 110 111 return 0; 112 } 113 114 static const struct net_device_ops ovpn_netdev_ops = { 115 .ndo_init = ovpn_net_init, 116 .ndo_uninit = ovpn_net_uninit, 117 .ndo_open = ovpn_net_open, 118 .ndo_start_xmit = ovpn_net_xmit, 119 }; 120 121 static const struct device_type ovpn_type = { 122 .name = OVPN_FAMILY_NAME, 123 }; 124 125 static const struct nla_policy ovpn_policy[IFLA_OVPN_MAX + 1] = { 126 [IFLA_OVPN_MODE] = NLA_POLICY_RANGE(NLA_U8, OVPN_MODE_P2P, 127 OVPN_MODE_MP), 128 }; 129 130 /** 131 * ovpn_dev_is_valid - check if the netdevice is of type 'ovpn' 132 * @dev: the interface to check 133 * 134 * Return: whether the netdevice is of type 'ovpn' 135 */ 136 bool ovpn_dev_is_valid(const struct net_device *dev) 137 { 138 return dev->netdev_ops == &ovpn_netdev_ops; 139 } 140 141 static void ovpn_get_drvinfo(struct net_device *dev, 142 struct ethtool_drvinfo *info) 143 { 144 strscpy(info->driver, "ovpn", sizeof(info->driver)); 145 strscpy(info->bus_info, "ovpn", sizeof(info->bus_info)); 146 } 147 148 static const struct ethtool_ops ovpn_ethtool_ops = { 149 .get_drvinfo = ovpn_get_drvinfo, 150 .get_link = ethtool_op_get_link, 151 .get_ts_info = ethtool_op_get_ts_info, 152 }; 153 154 static void ovpn_setup(struct net_device *dev) 155 { 156 netdev_features_t feat = NETIF_F_SG | NETIF_F_GSO | 157 NETIF_F_GSO_SOFTWARE | NETIF_F_HIGHDMA; 158 159 dev->needs_free_netdev = true; 160 161 dev->pcpu_stat_type = NETDEV_PCPU_STAT_DSTATS; 162 163 dev->ethtool_ops = &ovpn_ethtool_ops; 164 dev->netdev_ops = &ovpn_netdev_ops; 165 166 dev->priv_destructor = ovpn_priv_free; 167 168 dev->hard_header_len = 0; 169 dev->addr_len = 0; 170 dev->mtu = ETH_DATA_LEN - OVPN_HEAD_ROOM; 171 dev->min_mtu = IPV4_MIN_MTU; 172 dev->max_mtu = IP_MAX_MTU - OVPN_HEAD_ROOM; 173 174 dev->type = ARPHRD_NONE; 175 dev->flags = IFF_POINTOPOINT | IFF_NOARP; 176 dev->priv_flags |= IFF_NO_QUEUE; 177 /* when routing packets to a LAN behind a client, we rely on the 178 * route entry that originally brought the packet into ovpn, so 179 * don't release it 180 */ 181 netif_keep_dst(dev); 182 183 dev->lltx = true; 184 dev->features |= feat; 185 dev->hw_features |= feat; 186 dev->hw_enc_features |= feat; 187 188 dev->needed_headroom = ALIGN(OVPN_HEAD_ROOM, 4); 189 dev->needed_tailroom = OVPN_MAX_PADDING; 190 191 SET_NETDEV_DEVTYPE(dev, &ovpn_type); 192 } 193 194 static int ovpn_newlink(struct net_device *dev, 195 struct rtnl_newlink_params *params, 196 struct netlink_ext_ack *extack) 197 { 198 struct ovpn_priv *ovpn = netdev_priv(dev); 199 struct nlattr **data = params->data; 200 enum ovpn_mode mode = OVPN_MODE_P2P; 201 int ret; 202 203 if (data && data[IFLA_OVPN_MODE]) { 204 mode = nla_get_u8(data[IFLA_OVPN_MODE]); 205 netdev_dbg(dev, "setting device mode: %u\n", mode); 206 } 207 208 ovpn->dev = dev; 209 ovpn->mode = mode; 210 spin_lock_init(&ovpn->lock); 211 INIT_DELAYED_WORK(&ovpn->keepalive_work, ovpn_peer_keepalive_work); 212 213 /* Set carrier explicitly after registration, this way state is 214 * clearly defined. 215 * 216 * In case of MP interfaces we keep the carrier always on. 217 * 218 * Carrier for P2P interfaces is initially off and it is then 219 * switched on and off when the remote peer is added or deleted. 220 */ 221 if (ovpn->mode == OVPN_MODE_MP) 222 netif_carrier_on(dev); 223 else 224 netif_carrier_off(dev); 225 226 ret = register_netdevice(dev); 227 if (ret < 0) 228 return ret; 229 230 return 0; 231 } 232 233 static size_t ovpn_get_size(const struct net_device *dev) 234 { 235 /* IFLA_OVPN_MODE */ 236 return nla_total_size(sizeof(u8)); 237 } 238 239 static int ovpn_fill_info(struct sk_buff *skb, const struct net_device *dev) 240 { 241 struct ovpn_priv *ovpn = netdev_priv(dev); 242 243 if (nla_put_u8(skb, IFLA_OVPN_MODE, ovpn->mode)) 244 return -EMSGSIZE; 245 246 return 0; 247 } 248 249 static struct rtnl_link_ops ovpn_link_ops = { 250 .kind = "ovpn", 251 .netns_refund = false, 252 .priv_size = sizeof(struct ovpn_priv), 253 .setup = ovpn_setup, 254 .policy = ovpn_policy, 255 .maxtype = IFLA_OVPN_MAX, 256 .newlink = ovpn_newlink, 257 .get_size = ovpn_get_size, 258 .fill_info = ovpn_fill_info, 259 }; 260 261 static int __init ovpn_init(void) 262 { 263 int err; 264 265 ovpn_tcp_init(); 266 267 err = rtnl_link_register(&ovpn_link_ops); 268 if (err) { 269 pr_err("ovpn: can't register rtnl link ops: %d\n", err); 270 return err; 271 } 272 273 err = ovpn_nl_register(); 274 if (err) { 275 pr_err("ovpn: can't register netlink family: %d\n", err); 276 goto unreg_rtnl; 277 } 278 279 return 0; 280 281 unreg_rtnl: 282 rtnl_link_unregister(&ovpn_link_ops); 283 return err; 284 } 285 286 static __exit void ovpn_cleanup(void) 287 { 288 ovpn_nl_unregister(); 289 rtnl_link_unregister(&ovpn_link_ops); 290 291 rcu_barrier(); 292 } 293 294 module_init(ovpn_init); 295 module_exit(ovpn_cleanup); 296 297 MODULE_DESCRIPTION("OpenVPN data channel offload (ovpn)"); 298 MODULE_AUTHOR("Antonio Quartulli <antonio@openvpn.net>"); 299 MODULE_LICENSE("GPL"); 300