1 // SPDX-License-Identifier: GPL-2.0 2 /* OpenVPN data channel offload 3 * 4 * Copyright (C) 2020-2025 OpenVPN, Inc. 5 * 6 * Author: Antonio Quartulli <antonio@openvpn.net> 7 * James Yonan <james@openvpn.net> 8 */ 9 10 #include <linux/ethtool.h> 11 #include <linux/genetlink.h> 12 #include <linux/module.h> 13 #include <linux/netdevice.h> 14 #include <linux/inetdevice.h> 15 #include <linux/workqueue.h> 16 #include <net/gro_cells.h> 17 #include <net/ip.h> 18 #include <net/rtnetlink.h> 19 #include <uapi/linux/if_arp.h> 20 21 #include "ovpnpriv.h" 22 #include "main.h" 23 #include "netlink.h" 24 #include "io.h" 25 #include "peer.h" 26 #include "proto.h" 27 #include "tcp.h" 28 #include "udp.h" 29 30 /* module-owned workqueue on which all ovpn-specific work is queued */ 31 struct workqueue_struct *ovpn_wq; 32 33 static void ovpn_priv_free(struct net_device *net) 34 { 35 struct ovpn_priv *ovpn = netdev_priv(net); 36 37 kfree(ovpn->peers); 38 } 39 40 static int ovpn_mp_alloc(struct ovpn_priv *ovpn) 41 { 42 int i; 43 44 if (ovpn->mode != OVPN_MODE_MP) 45 return 0; 46 47 /* the peer container is fairly large, therefore we allocate it only in 48 * MP mode 49 */ 50 ovpn->peers = kzalloc_obj(*ovpn->peers); 51 if (!ovpn->peers) 52 return -ENOMEM; 53 54 for (i = 0; i < ARRAY_SIZE(ovpn->peers->by_id); i++) { 55 INIT_HLIST_HEAD(&ovpn->peers->by_id[i]); 56 INIT_HLIST_NULLS_HEAD(&ovpn->peers->by_vpn_addr4[i], i); 57 INIT_HLIST_NULLS_HEAD(&ovpn->peers->by_vpn_addr6[i], i); 58 INIT_HLIST_NULLS_HEAD(&ovpn->peers->by_transp_addr[i], i); 59 } 60 61 return 0; 62 } 63 64 static int ovpn_net_init(struct net_device *dev) 65 { 66 struct ovpn_priv *ovpn = netdev_priv(dev); 67 int err = gro_cells_init(&ovpn->gro_cells, dev); 68 69 if (err < 0) 70 return err; 71 72 err = ovpn_mp_alloc(ovpn); 73 if (err < 0) { 74 gro_cells_destroy(&ovpn->gro_cells); 75 return err; 76 } 77 78 return 0; 79 } 80 81 static void ovpn_net_uninit(struct net_device *dev) 82 { 83 struct ovpn_priv *ovpn = netdev_priv(dev); 84 85 disable_delayed_work_sync(&ovpn->keepalive_work); 86 ovpn_peers_free(ovpn, NULL, OVPN_DEL_PEER_REASON_TEARDOWN); 87 gro_cells_destroy(&ovpn->gro_cells); 88 } 89 90 static int ovpn_net_open(struct net_device *dev) 91 { 92 struct ovpn_priv *ovpn = netdev_priv(dev); 93 struct in_device *dev_v4; 94 95 /* the IPv4 in_device (and thus its config) is recreated whenever the 96 * interface is moved to a new netns, so redirects must be disabled on 97 * every bring-up rather than once at creation time, otherwise the 98 * setting is silently lost after such a move 99 */ 100 if (ovpn->mode == OVPN_MODE_MP) { 101 dev_v4 = __in_dev_get_rtnl(dev); 102 if (dev_v4) { 103 /* disable redirects as Linux gets confused by ovpn 104 * handling same-LAN routing. 105 * This happens because a multipeer interface is used as 106 * relay point between hosts in the same subnet, while 107 * in a classic LAN this would not be needed because the 108 * two hosts would be able to talk directly. 109 */ 110 IN_DEV_CONF_SET(dev_v4, SEND_REDIRECTS, false); 111 IPV4_DEVCONF_ALL(dev_net(dev), SEND_REDIRECTS) = false; 112 } 113 } 114 115 return 0; 116 } 117 118 static const struct net_device_ops ovpn_netdev_ops = { 119 .ndo_init = ovpn_net_init, 120 .ndo_uninit = ovpn_net_uninit, 121 .ndo_open = ovpn_net_open, 122 .ndo_start_xmit = ovpn_net_xmit, 123 }; 124 125 static const struct device_type ovpn_type = { 126 .name = OVPN_FAMILY_NAME, 127 }; 128 129 static const struct nla_policy ovpn_policy[IFLA_OVPN_MAX + 1] = { 130 [IFLA_OVPN_MODE] = NLA_POLICY_RANGE(NLA_U8, OVPN_MODE_P2P, 131 OVPN_MODE_MP), 132 }; 133 134 /** 135 * ovpn_dev_is_valid - check if the netdevice is of type 'ovpn' 136 * @dev: the interface to check 137 * 138 * Return: whether the netdevice is of type 'ovpn' 139 */ 140 bool ovpn_dev_is_valid(const struct net_device *dev) 141 { 142 return dev->netdev_ops == &ovpn_netdev_ops; 143 } 144 145 static void ovpn_get_drvinfo(struct net_device *dev, 146 struct ethtool_drvinfo *info) 147 { 148 strscpy(info->driver, "ovpn", sizeof(info->driver)); 149 strscpy(info->bus_info, "ovpn", sizeof(info->bus_info)); 150 } 151 152 static const struct ethtool_ops ovpn_ethtool_ops = { 153 .get_drvinfo = ovpn_get_drvinfo, 154 .get_link = ethtool_op_get_link, 155 .get_ts_info = ethtool_op_get_ts_info, 156 }; 157 158 static void ovpn_setup(struct net_device *dev) 159 { 160 netdev_features_t feat = NETIF_F_SG | NETIF_F_GSO | 161 NETIF_F_GSO_SOFTWARE | NETIF_F_HIGHDMA; 162 163 dev->needs_free_netdev = true; 164 165 dev->pcpu_stat_type = NETDEV_PCPU_STAT_DSTATS; 166 167 dev->ethtool_ops = &ovpn_ethtool_ops; 168 dev->netdev_ops = &ovpn_netdev_ops; 169 170 dev->priv_destructor = ovpn_priv_free; 171 172 dev->hard_header_len = 0; 173 dev->addr_len = 0; 174 dev->mtu = ETH_DATA_LEN - OVPN_HEAD_ROOM; 175 dev->min_mtu = IPV4_MIN_MTU; 176 dev->max_mtu = IP_MAX_MTU - OVPN_HEAD_ROOM; 177 178 dev->type = ARPHRD_NONE; 179 dev->flags = IFF_POINTOPOINT | IFF_NOARP; 180 dev->priv_flags |= IFF_NO_QUEUE; 181 /* when routing packets to a LAN behind a client, we rely on the 182 * route entry that originally brought the packet into ovpn, so 183 * don't release it 184 */ 185 netif_keep_dst(dev); 186 187 dev->lltx = true; 188 dev->features |= feat; 189 dev->hw_features |= feat; 190 dev->hw_enc_features |= feat; 191 192 dev->needed_headroom = ALIGN(OVPN_HEAD_ROOM, 4); 193 dev->needed_tailroom = OVPN_MAX_PADDING; 194 195 SET_NETDEV_DEVTYPE(dev, &ovpn_type); 196 } 197 198 static int ovpn_newlink(struct net_device *dev, 199 struct rtnl_newlink_params *params, 200 struct netlink_ext_ack *extack) 201 { 202 struct ovpn_priv *ovpn = netdev_priv(dev); 203 struct nlattr **data = params->data; 204 enum ovpn_mode mode = OVPN_MODE_P2P; 205 int ret; 206 207 if (data && data[IFLA_OVPN_MODE]) { 208 mode = nla_get_u8(data[IFLA_OVPN_MODE]); 209 netdev_dbg(dev, "setting device mode: %u\n", mode); 210 } 211 212 ovpn->dev = dev; 213 ovpn->mode = mode; 214 spin_lock_init(&ovpn->lock); 215 INIT_DELAYED_WORK(&ovpn->keepalive_work, ovpn_peer_keepalive_work); 216 217 /* Set carrier explicitly after registration, this way state is 218 * clearly defined. 219 * 220 * In case of MP interfaces we keep the carrier always on. 221 * 222 * Carrier for P2P interfaces is initially off and it is then 223 * switched on and off when the remote peer is added or deleted. 224 */ 225 if (ovpn->mode == OVPN_MODE_MP) 226 netif_carrier_on(dev); 227 else 228 netif_carrier_off(dev); 229 230 ret = register_netdevice(dev); 231 if (ret < 0) 232 return ret; 233 234 return 0; 235 } 236 237 static size_t ovpn_get_size(const struct net_device *dev) 238 { 239 /* IFLA_OVPN_MODE */ 240 return nla_total_size(sizeof(u8)); 241 } 242 243 static int ovpn_fill_info(struct sk_buff *skb, const struct net_device *dev) 244 { 245 struct ovpn_priv *ovpn = netdev_priv(dev); 246 247 if (nla_put_u8(skb, IFLA_OVPN_MODE, ovpn->mode)) 248 return -EMSGSIZE; 249 250 return 0; 251 } 252 253 static struct rtnl_link_ops ovpn_link_ops = { 254 .kind = "ovpn", 255 .netns_refund = false, 256 .priv_size = sizeof(struct ovpn_priv), 257 .setup = ovpn_setup, 258 .policy = ovpn_policy, 259 .maxtype = IFLA_OVPN_MAX, 260 .newlink = ovpn_newlink, 261 .get_size = ovpn_get_size, 262 .fill_info = ovpn_fill_info, 263 }; 264 265 static int __init ovpn_init(void) 266 { 267 int err; 268 269 ovpn_tcp_init(); 270 271 ovpn_wq = alloc_workqueue("ovpn", WQ_PERCPU, 0); 272 if (!ovpn_wq) { 273 pr_err("ovpn: cannot allocate workqueue\n"); 274 return -ENOMEM; 275 } 276 277 err = rtnl_link_register(&ovpn_link_ops); 278 if (err) { 279 pr_err("ovpn: can't register rtnl link ops: %d\n", err); 280 goto destroy_wq; 281 } 282 283 err = ovpn_nl_register(); 284 if (err) { 285 pr_err("ovpn: can't register netlink family: %d\n", err); 286 goto unreg_rtnl; 287 } 288 289 return 0; 290 291 unreg_rtnl: 292 rtnl_link_unregister(&ovpn_link_ops); 293 destroy_wq: 294 destroy_workqueue(ovpn_wq); 295 ovpn_wq = NULL; 296 return err; 297 } 298 299 static __exit void ovpn_cleanup(void) 300 { 301 ovpn_nl_unregister(); 302 rtnl_link_unregister(&ovpn_link_ops); 303 304 flush_workqueue(ovpn_wq); 305 rcu_barrier(); 306 307 destroy_workqueue(ovpn_wq); 308 ovpn_wq = NULL; 309 } 310 311 module_init(ovpn_init); 312 module_exit(ovpn_cleanup); 313 314 MODULE_DESCRIPTION("OpenVPN data channel offload (ovpn)"); 315 MODULE_AUTHOR("Antonio Quartulli <antonio@openvpn.net>"); 316 MODULE_LICENSE("GPL"); 317