1 // SPDX-License-Identifier: GPL-2.0 2 /* OpenVPN data channel offload 3 * 4 * Copyright (C) 2020-2025 OpenVPN, Inc. 5 * 6 * Author: Antonio Quartulli <antonio@openvpn.net> 7 */ 8 9 #include <linux/netdevice.h> 10 #include <linux/types.h> 11 #include <net/genetlink.h> 12 13 #include <uapi/linux/ovpn.h> 14 15 #include "ovpnpriv.h" 16 #include "main.h" 17 #include "netlink.h" 18 #include "netlink-gen.h" 19 #include "bind.h" 20 #include "crypto.h" 21 #include "peer.h" 22 #include "socket.h" 23 24 MODULE_ALIAS_GENL_FAMILY(OVPN_FAMILY_NAME); 25 26 /** 27 * ovpn_get_dev_from_attrs - retrieve the ovpn private data from the netdevice 28 * a netlink message is targeting 29 * @net: network namespace where to look for the interface 30 * @info: generic netlink info from the user request 31 * @tracker: tracker object to be used for the netdev reference acquisition 32 * 33 * Return: the ovpn private data, if found, or an error otherwise 34 */ 35 static struct ovpn_priv * 36 ovpn_get_dev_from_attrs(struct net *net, const struct genl_info *info, 37 netdevice_tracker *tracker) 38 { 39 struct ovpn_priv *ovpn; 40 struct net_device *dev; 41 int ifindex; 42 43 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_IFINDEX)) 44 return ERR_PTR(-EINVAL); 45 46 ifindex = nla_get_u32(info->attrs[OVPN_A_IFINDEX]); 47 48 rcu_read_lock(); 49 dev = dev_get_by_index_rcu(net, ifindex); 50 if (!dev) { 51 rcu_read_unlock(); 52 NL_SET_ERR_MSG_MOD(info->extack, 53 "ifindex does not match any interface"); 54 return ERR_PTR(-ENODEV); 55 } 56 57 if (!ovpn_dev_is_valid(dev)) { 58 rcu_read_unlock(); 59 NL_SET_ERR_MSG_MOD(info->extack, 60 "specified interface is not ovpn"); 61 NL_SET_BAD_ATTR(info->extack, info->attrs[OVPN_A_IFINDEX]); 62 return ERR_PTR(-EINVAL); 63 } 64 65 ovpn = netdev_priv(dev); 66 netdev_hold(dev, tracker, GFP_ATOMIC); 67 rcu_read_unlock(); 68 69 return ovpn; 70 } 71 72 int ovpn_nl_pre_doit(const struct genl_split_ops *ops, struct sk_buff *skb, 73 struct genl_info *info) 74 { 75 netdevice_tracker *tracker = (netdevice_tracker *)&info->user_ptr[1]; 76 struct ovpn_priv *ovpn = ovpn_get_dev_from_attrs(genl_info_net(info), 77 info, tracker); 78 79 if (IS_ERR(ovpn)) 80 return PTR_ERR(ovpn); 81 82 info->user_ptr[0] = ovpn; 83 84 return 0; 85 } 86 87 void ovpn_nl_post_doit(const struct genl_split_ops *ops, struct sk_buff *skb, 88 struct genl_info *info) 89 { 90 netdevice_tracker *tracker = (netdevice_tracker *)&info->user_ptr[1]; 91 struct ovpn_priv *ovpn = info->user_ptr[0]; 92 93 if (ovpn) 94 netdev_put(ovpn->dev, tracker); 95 } 96 97 static bool ovpn_nl_attr_sockaddr_remote(struct nlattr **attrs, 98 struct sockaddr_storage *ss) 99 { 100 struct sockaddr_in6 *sin6; 101 struct sockaddr_in *sin; 102 struct in6_addr *in6; 103 struct nlattr *scope; 104 u32 scope_id = 0; 105 __be16 port = 0; 106 __be32 *in; 107 108 ss->ss_family = AF_UNSPEC; 109 110 if (attrs[OVPN_A_PEER_REMOTE_PORT]) 111 port = nla_get_be16(attrs[OVPN_A_PEER_REMOTE_PORT]); 112 113 if (attrs[OVPN_A_PEER_REMOTE_IPV4]) { 114 ss->ss_family = AF_INET; 115 in = nla_data(attrs[OVPN_A_PEER_REMOTE_IPV4]); 116 } else if (attrs[OVPN_A_PEER_REMOTE_IPV6]) { 117 ss->ss_family = AF_INET6; 118 in6 = nla_data(attrs[OVPN_A_PEER_REMOTE_IPV6]); 119 scope = attrs[OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID]; 120 if (scope) 121 scope_id = nla_get_u32(scope); 122 } else { 123 return false; 124 } 125 126 switch (ss->ss_family) { 127 case AF_INET6: 128 /* If this is a regular IPv6 just break and move on, 129 * otherwise switch to AF_INET and extract the IPv4 accordingly 130 */ 131 if (!ipv6_addr_v4mapped(in6)) { 132 sin6 = (struct sockaddr_in6 *)ss; 133 sin6->sin6_port = port; 134 sin6->sin6_scope_id = scope_id; 135 memcpy(&sin6->sin6_addr, in6, sizeof(*in6)); 136 break; 137 } 138 139 /* v4-mapped-v6 address */ 140 ss->ss_family = AF_INET; 141 in = &in6->s6_addr32[3]; 142 fallthrough; 143 case AF_INET: 144 sin = (struct sockaddr_in *)ss; 145 sin->sin_port = port; 146 sin->sin_addr.s_addr = *in; 147 break; 148 } 149 150 return true; 151 } 152 153 static u8 *ovpn_nl_attr_local_ip(struct nlattr **attrs) 154 { 155 u8 *addr6; 156 157 if (!attrs[OVPN_A_PEER_LOCAL_IPV4] && !attrs[OVPN_A_PEER_LOCAL_IPV6]) 158 return NULL; 159 160 if (attrs[OVPN_A_PEER_LOCAL_IPV4]) 161 return nla_data(attrs[OVPN_A_PEER_LOCAL_IPV4]); 162 163 addr6 = nla_data(attrs[OVPN_A_PEER_LOCAL_IPV6]); 164 /* this is an IPv4-mapped IPv6 address, therefore extract the actual 165 * v4 address from the last 4 bytes 166 */ 167 if (ipv6_addr_v4mapped((struct in6_addr *)addr6)) 168 return addr6 + 12; 169 170 return addr6; 171 } 172 173 static sa_family_t ovpn_nl_family_get(struct nlattr *addr4, 174 struct nlattr *addr6) 175 { 176 if (addr4) 177 return AF_INET; 178 179 if (addr6) { 180 if (ipv6_addr_v4mapped((struct in6_addr *)nla_data(addr6))) 181 return AF_INET; 182 return AF_INET6; 183 } 184 185 return AF_UNSPEC; 186 } 187 188 static int ovpn_nl_peer_check_vpn_addrs(const struct in_addr *addr4, 189 const struct in6_addr *addr6, 190 struct genl_info *info) 191 { 192 int addr6_type; 193 194 if (addr4->s_addr == htonl(INADDR_ANY) && ipv6_addr_any(addr6)) { 195 NL_SET_ERR_MSG_MOD(info->extack, 196 "at least one VPN IP must be configured in MP mode"); 197 return -EINVAL; 198 } 199 200 if (ipv4_is_multicast(addr4->s_addr) || ipv4_is_lbcast(addr4->s_addr) || 201 ipv4_is_loopback(addr4->s_addr)) { 202 NL_SET_ERR_MSG_MOD(info->extack, 203 "VPN IPv4 address must be valid unicast or any"); 204 return -EADDRNOTAVAIL; 205 } 206 207 if (!ipv6_addr_any(addr6)) { 208 addr6_type = ipv6_addr_type(addr6); 209 210 if (!(addr6_type & IPV6_ADDR_UNICAST) || 211 (addr6_type & (IPV6_ADDR_LOOPBACK | IPV6_ADDR_COMPATv4))) { 212 NL_SET_ERR_MSG_MOD(info->extack, 213 "VPN IPv6 address must be valid unicast or any"); 214 return -EADDRNOTAVAIL; 215 } 216 } 217 218 return 0; 219 } 220 221 static int ovpn_nl_peer_precheck(struct ovpn_priv *ovpn, 222 struct genl_info *info, 223 struct nlattr **attrs) 224 { 225 sa_family_t local_fam, remote_fam; 226 227 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_PEER], attrs, 228 OVPN_A_PEER_ID)) 229 return -EINVAL; 230 231 if (attrs[OVPN_A_PEER_REMOTE_IPV4] && attrs[OVPN_A_PEER_REMOTE_IPV6]) { 232 NL_SET_ERR_MSG_MOD(info->extack, 233 "cannot specify both remote IPv4 or IPv6 address"); 234 return -EINVAL; 235 } 236 237 if (!attrs[OVPN_A_PEER_REMOTE_IPV4] && 238 !attrs[OVPN_A_PEER_REMOTE_IPV6] && attrs[OVPN_A_PEER_REMOTE_PORT]) { 239 NL_SET_ERR_MSG_MOD(info->extack, 240 "cannot specify remote port without IP address"); 241 return -EINVAL; 242 } 243 244 if ((attrs[OVPN_A_PEER_REMOTE_IPV4] || 245 attrs[OVPN_A_PEER_REMOTE_IPV6]) && 246 !attrs[OVPN_A_PEER_REMOTE_PORT]) { 247 NL_SET_ERR_MSG_MOD(info->extack, 248 "cannot specify remote IP address without port"); 249 return -EINVAL; 250 } 251 252 if (!attrs[OVPN_A_PEER_REMOTE_IPV4] && 253 attrs[OVPN_A_PEER_LOCAL_IPV4]) { 254 NL_SET_ERR_MSG_MOD(info->extack, 255 "cannot specify local IPv4 address without remote"); 256 return -EINVAL; 257 } 258 259 if (!attrs[OVPN_A_PEER_REMOTE_IPV6] && 260 attrs[OVPN_A_PEER_LOCAL_IPV6]) { 261 NL_SET_ERR_MSG_MOD(info->extack, 262 "cannot specify local IPV6 address without remote"); 263 return -EINVAL; 264 } 265 266 /* check that local and remote address families are the same even 267 * after parsing v4mapped IPv6 addresses. 268 * (if addresses are not provided, family will be AF_UNSPEC and 269 * the check is skipped) 270 */ 271 local_fam = ovpn_nl_family_get(attrs[OVPN_A_PEER_LOCAL_IPV4], 272 attrs[OVPN_A_PEER_LOCAL_IPV6]); 273 remote_fam = ovpn_nl_family_get(attrs[OVPN_A_PEER_REMOTE_IPV4], 274 attrs[OVPN_A_PEER_REMOTE_IPV6]); 275 if (local_fam != AF_UNSPEC && remote_fam != AF_UNSPEC && 276 local_fam != remote_fam) { 277 NL_SET_ERR_MSG_MOD(info->extack, 278 "mismatching local and remote address families"); 279 return -EINVAL; 280 } 281 282 if (remote_fam != AF_INET6 && attrs[OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID]) { 283 NL_SET_ERR_MSG_MOD(info->extack, 284 "cannot specify scope id without remote IPv6 address"); 285 return -EINVAL; 286 } 287 288 /* VPN IPs are needed only in MP mode for selecting the right peer */ 289 if (ovpn->mode == OVPN_MODE_P2P && (attrs[OVPN_A_PEER_VPN_IPV4] || 290 attrs[OVPN_A_PEER_VPN_IPV6])) { 291 NL_SET_ERR_MSG_FMT_MOD(info->extack, 292 "unexpected VPN IP in P2P mode"); 293 return -EINVAL; 294 } 295 296 if ((attrs[OVPN_A_PEER_KEEPALIVE_INTERVAL] && 297 !attrs[OVPN_A_PEER_KEEPALIVE_TIMEOUT]) || 298 (!attrs[OVPN_A_PEER_KEEPALIVE_INTERVAL] && 299 attrs[OVPN_A_PEER_KEEPALIVE_TIMEOUT])) { 300 NL_SET_ERR_MSG_FMT_MOD(info->extack, 301 "keepalive interval and timeout are required together"); 302 return -EINVAL; 303 } 304 305 return 0; 306 } 307 308 /** 309 * ovpn_nl_peer_modify - modify the peer attributes according to the incoming msg 310 * @peer: the peer to modify 311 * @info: generic netlink info from the user request 312 * @attrs: the attributes from the user request 313 * 314 * Return: a negative error code in case of failure, 0 on success or 1 on 315 * success and the VPN IPs have been modified (requires rehashing in MP 316 * mode) 317 */ 318 static int ovpn_nl_peer_modify(struct ovpn_peer *peer, struct genl_info *info, 319 struct nlattr **attrs) 320 { 321 struct sockaddr_storage ss = {}; 322 void *local_ip = NULL; 323 u32 interv, timeout; 324 bool rehash = false; 325 int ret; 326 327 spin_lock_bh(&peer->lock); 328 329 if (ovpn_nl_attr_sockaddr_remote(attrs, &ss)) { 330 /* we carry the local IP in a generic container. 331 * ovpn_peer_reset_sockaddr() will properly interpret it 332 * based on ss.ss_family 333 */ 334 local_ip = ovpn_nl_attr_local_ip(attrs); 335 336 /* set peer sockaddr */ 337 ret = ovpn_peer_reset_sockaddr(peer, &ss, local_ip); 338 if (ret < 0) { 339 NL_SET_ERR_MSG_FMT_MOD(info->extack, 340 "cannot set peer sockaddr: %d", 341 ret); 342 goto err_unlock; 343 } 344 dst_cache_reset(&peer->dst_cache); 345 } 346 347 /* In a multipeer-to-multipeer setup we may have asymmetric peer IDs, 348 * that is peer->id might be different from peer->tx_id. 349 */ 350 if (attrs[OVPN_A_PEER_TX_ID]) 351 peer->tx_id = nla_get_u32(attrs[OVPN_A_PEER_TX_ID]); 352 353 if (attrs[OVPN_A_PEER_VPN_IPV4]) { 354 rehash = true; 355 peer->vpn_addrs.ipv4.s_addr = 356 nla_get_in_addr(attrs[OVPN_A_PEER_VPN_IPV4]); 357 } 358 359 if (attrs[OVPN_A_PEER_VPN_IPV6]) { 360 rehash = true; 361 peer->vpn_addrs.ipv6 = 362 nla_get_in6_addr(attrs[OVPN_A_PEER_VPN_IPV6]); 363 } 364 365 /* when setting the keepalive, both parameters have to be configured */ 366 if (attrs[OVPN_A_PEER_KEEPALIVE_INTERVAL] && 367 attrs[OVPN_A_PEER_KEEPALIVE_TIMEOUT]) { 368 interv = nla_get_u32(attrs[OVPN_A_PEER_KEEPALIVE_INTERVAL]); 369 timeout = nla_get_u32(attrs[OVPN_A_PEER_KEEPALIVE_TIMEOUT]); 370 ovpn_peer_keepalive_set(peer, interv, timeout); 371 } 372 373 netdev_dbg(peer->ovpn->dev, 374 "modify peer id=%u tx_id=%u endpoint=%pIScp VPN-IPv4=%pI4 VPN-IPv6=%pI6c\n", 375 peer->id, peer->tx_id, &ss, 376 &peer->vpn_addrs.ipv4.s_addr, &peer->vpn_addrs.ipv6); 377 378 spin_unlock_bh(&peer->lock); 379 380 return rehash ? 1 : 0; 381 err_unlock: 382 spin_unlock_bh(&peer->lock); 383 return ret; 384 } 385 386 int ovpn_nl_peer_new_doit(struct sk_buff *skb, struct genl_info *info) 387 { 388 struct in_addr vpn_addr4 = { .s_addr = htonl(INADDR_ANY) }; 389 struct in6_addr vpn_addr6 = IN6ADDR_ANY_INIT; 390 struct ovpn_priv *ovpn = info->user_ptr[0]; 391 struct nlattr *attrs[OVPN_A_PEER_MAX + 1]; 392 struct ovpn_socket *ovpn_sock; 393 struct socket *sock = NULL; 394 struct ovpn_peer *peer; 395 u32 sockfd, peer_id; 396 int ret; 397 398 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_PEER)) 399 return -EINVAL; 400 401 ret = nla_parse_nested(attrs, OVPN_A_PEER_MAX, info->attrs[OVPN_A_PEER], 402 ovpn_peer_new_input_nl_policy, info->extack); 403 if (ret) 404 return ret; 405 406 ret = ovpn_nl_peer_precheck(ovpn, info, attrs); 407 if (ret < 0) 408 return ret; 409 410 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_PEER], attrs, 411 OVPN_A_PEER_SOCKET)) 412 return -EINVAL; 413 414 /* in MP mode VPN IPs are required for selecting the right peer */ 415 if (ovpn->mode == OVPN_MODE_MP) { 416 if (attrs[OVPN_A_PEER_VPN_IPV4]) 417 vpn_addr4.s_addr = 418 nla_get_in_addr(attrs[OVPN_A_PEER_VPN_IPV4]); 419 if (attrs[OVPN_A_PEER_VPN_IPV6]) 420 vpn_addr6 = 421 nla_get_in6_addr(attrs[OVPN_A_PEER_VPN_IPV6]); 422 423 ret = ovpn_nl_peer_check_vpn_addrs(&vpn_addr4, &vpn_addr6, 424 info); 425 if (ret < 0) 426 return ret; 427 } 428 429 peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]); 430 431 peer = ovpn_peer_new(ovpn, peer_id); 432 if (IS_ERR(peer)) { 433 NL_SET_ERR_MSG_FMT_MOD(info->extack, 434 "cannot create new peer object for peer %u: %ld", 435 peer_id, PTR_ERR(peer)); 436 return PTR_ERR(peer); 437 } 438 439 /* lookup the fd in the kernel table and extract the socket object */ 440 sockfd = nla_get_u32(attrs[OVPN_A_PEER_SOCKET]); 441 /* sockfd_lookup() increases sock's refcounter */ 442 sock = sockfd_lookup(sockfd, &ret); 443 if (!sock) { 444 NL_SET_ERR_MSG_FMT_MOD(info->extack, 445 "cannot lookup peer socket (fd=%u): %d", 446 sockfd, ret); 447 ret = -ENOTSOCK; 448 goto peer_release; 449 } 450 451 /* Only when using UDP as transport protocol the remote endpoint 452 * can be configured so that ovpn knows where to send packets to. 453 */ 454 if (sock->sk->sk_protocol == IPPROTO_UDP && 455 !attrs[OVPN_A_PEER_REMOTE_IPV4] && 456 !attrs[OVPN_A_PEER_REMOTE_IPV6]) { 457 NL_SET_ERR_MSG_FMT_MOD(info->extack, 458 "missing remote IP address for UDP socket"); 459 sockfd_put(sock); 460 ret = -EINVAL; 461 goto peer_release; 462 } 463 464 /* In case of TCP, the socket is connected to the peer and ovpn 465 * will just send bytes over it, without the need to specify a 466 * destination. 467 */ 468 if (sock->sk->sk_protocol == IPPROTO_TCP && 469 (attrs[OVPN_A_PEER_REMOTE_IPV4] || 470 attrs[OVPN_A_PEER_REMOTE_IPV6])) { 471 NL_SET_ERR_MSG_FMT_MOD(info->extack, 472 "unexpected remote IP address with TCP socket"); 473 sockfd_put(sock); 474 ret = -EINVAL; 475 goto peer_release; 476 } 477 478 ovpn_sock = ovpn_socket_new(sock, peer); 479 /* at this point we unconditionally drop the reference to the socket: 480 * - in case of error, the socket has to be dropped 481 * - if case of success, the socket is configured and let 482 * userspace own the reference, so that the latter can 483 * trigger the final close() 484 */ 485 sockfd_put(sock); 486 if (IS_ERR(ovpn_sock)) { 487 NL_SET_ERR_MSG_FMT_MOD(info->extack, 488 "cannot encapsulate socket: %ld", 489 PTR_ERR(ovpn_sock)); 490 ret = -ENOTSOCK; 491 goto peer_release; 492 } 493 494 rcu_assign_pointer(peer->sock, ovpn_sock); 495 496 ret = ovpn_nl_peer_modify(peer, info, attrs); 497 if (ret < 0) 498 goto sock_release; 499 500 ret = ovpn_peer_add(ovpn, peer); 501 if (ret < 0) { 502 NL_SET_ERR_MSG_FMT_MOD(info->extack, 503 "cannot add new peer (id=%u) to hashtable: %d", 504 peer->id, ret); 505 goto sock_release; 506 } 507 508 return 0; 509 510 sock_release: 511 ovpn_socket_release(peer); 512 peer_release: 513 /* For UDP, the peer is unreachable until added to the hashtables, so 514 * dropping the initial reference is enough. For TCP, the peer may be 515 * concurrently reachable via sk_user_data->peer until 516 * ovpn_socket_release() detaches; rely on the refcount. 517 */ 518 ovpn_peer_put(peer); 519 520 return ret; 521 } 522 523 int ovpn_nl_peer_set_doit(struct sk_buff *skb, struct genl_info *info) 524 { 525 struct ovpn_priv *ovpn = info->user_ptr[0]; 526 struct nlattr *attrs[OVPN_A_PEER_MAX + 1]; 527 struct in6_addr vpn_addr6; 528 struct in_addr vpn_addr4; 529 struct ovpn_socket *sock; 530 struct ovpn_peer *peer; 531 u32 peer_id; 532 int ret; 533 534 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_PEER)) 535 return -EINVAL; 536 537 ret = nla_parse_nested(attrs, OVPN_A_PEER_MAX, info->attrs[OVPN_A_PEER], 538 ovpn_peer_set_input_nl_policy, info->extack); 539 if (ret) 540 return ret; 541 542 ret = ovpn_nl_peer_precheck(ovpn, info, attrs); 543 if (ret < 0) 544 return ret; 545 546 if (attrs[OVPN_A_PEER_SOCKET]) { 547 NL_SET_ERR_MSG_FMT_MOD(info->extack, 548 "socket cannot be modified"); 549 return -EINVAL; 550 } 551 552 peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]); 553 peer = ovpn_peer_get_by_id(ovpn, peer_id); 554 if (!peer) { 555 NL_SET_ERR_MSG_FMT_MOD(info->extack, 556 "cannot find peer with id %u", peer_id); 557 return -ENOENT; 558 } 559 560 /* when using a TCP socket the remote IP is not expected */ 561 rcu_read_lock(); 562 sock = rcu_dereference(peer->sock); 563 if (sock && sock->sk->sk_protocol == IPPROTO_TCP && 564 (attrs[OVPN_A_PEER_REMOTE_IPV4] || 565 attrs[OVPN_A_PEER_REMOTE_IPV6])) { 566 rcu_read_unlock(); 567 NL_SET_ERR_MSG_FMT_MOD(info->extack, 568 "unexpected remote IP address with TCP socket"); 569 ovpn_peer_put(peer); 570 return -EINVAL; 571 } 572 rcu_read_unlock(); 573 574 spin_lock_bh(&ovpn->lock); 575 576 vpn_addr4 = peer->vpn_addrs.ipv4; 577 vpn_addr6 = peer->vpn_addrs.ipv6; 578 579 /* reject peer with conflicting VPN address */ 580 if (attrs[OVPN_A_PEER_VPN_IPV4]) { 581 vpn_addr4.s_addr = nla_get_in_addr(attrs[OVPN_A_PEER_VPN_IPV4]); 582 if (ovpn_peer_vpn_addr_conflict4(ovpn, peer, &vpn_addr4)) 583 goto addr_conflict; 584 } 585 if (attrs[OVPN_A_PEER_VPN_IPV6]) { 586 vpn_addr6 = nla_get_in6_addr(attrs[OVPN_A_PEER_VPN_IPV6]); 587 if (ovpn_peer_vpn_addr_conflict6(ovpn, peer, &vpn_addr6)) 588 goto addr_conflict; 589 } 590 591 /* in MP mode VPN IPs are required for selecting the right peer */ 592 if (ovpn->mode == OVPN_MODE_MP) { 593 ret = ovpn_nl_peer_check_vpn_addrs(&vpn_addr4, &vpn_addr6, 594 info); 595 if (ret < 0) 596 goto unlock; 597 } 598 599 ret = ovpn_nl_peer_modify(peer, info, attrs); 600 if (ret < 0) 601 goto unlock; 602 603 /* ret == 1 means that VPN IPv4/6 has been modified and rehashing 604 * is required 605 */ 606 if (ret > 0) { 607 ovpn_peer_hash_vpn_ip(peer); 608 ret = 0; 609 } 610 /* if the remote endpoint was updated, the by_transp_addr hash bucket 611 * also needs to be refreshed, otherwise incoming packets from the new 612 * remote address would fail the lockless lookup 613 */ 614 if (attrs[OVPN_A_PEER_REMOTE_IPV4] || attrs[OVPN_A_PEER_REMOTE_IPV6]) 615 ovpn_peer_hash_transp_addr(peer); 616 617 unlock: 618 spin_unlock_bh(&ovpn->lock); 619 ovpn_peer_put(peer); 620 621 return ret; 622 addr_conflict: 623 NL_SET_ERR_MSG_FMT_MOD(info->extack, 624 "VPN IP is already assigned to another peer"); 625 ret = -EADDRINUSE; 626 goto unlock; 627 } 628 629 static int ovpn_nl_send_peer(struct sk_buff *skb, const struct genl_info *info, 630 const struct ovpn_peer *peer, u32 portid, u32 seq, 631 int flags) 632 { 633 const struct ovpn_bind *bind; 634 struct ovpn_socket *sock; 635 int ret = -EMSGSIZE; 636 struct nlattr *attr; 637 __be16 local_port; 638 void *hdr; 639 int id; 640 641 hdr = genlmsg_put(skb, portid, seq, &ovpn_nl_family, flags, 642 OVPN_CMD_PEER_GET); 643 if (!hdr) 644 return -ENOBUFS; 645 646 attr = nla_nest_start(skb, OVPN_A_PEER); 647 if (!attr) 648 goto err; 649 650 rcu_read_lock(); 651 sock = rcu_dereference(peer->sock); 652 if (!sock) { 653 ret = -EINVAL; 654 goto err_unlock; 655 } 656 657 if (!net_eq(genl_info_net(info), sock_net(sock->sk))) { 658 id = peernet2id_alloc(genl_info_net(info), 659 sock_net(sock->sk), 660 GFP_ATOMIC); 661 if (nla_put_s32(skb, OVPN_A_PEER_SOCKET_NETNSID, id)) 662 goto err_unlock; 663 } 664 local_port = inet_sk(sock->sk)->inet_sport; 665 rcu_read_unlock(); 666 667 if (nla_put_u32(skb, OVPN_A_PEER_ID, peer->id)) 668 goto err; 669 670 if (nla_put_u32(skb, OVPN_A_PEER_TX_ID, peer->tx_id)) 671 goto err; 672 673 if (peer->vpn_addrs.ipv4.s_addr != htonl(INADDR_ANY)) 674 if (nla_put_in_addr(skb, OVPN_A_PEER_VPN_IPV4, 675 peer->vpn_addrs.ipv4.s_addr)) 676 goto err; 677 678 if (!ipv6_addr_equal(&peer->vpn_addrs.ipv6, &in6addr_any)) 679 if (nla_put_in6_addr(skb, OVPN_A_PEER_VPN_IPV6, 680 &peer->vpn_addrs.ipv6)) 681 goto err; 682 683 if (nla_put_u32(skb, OVPN_A_PEER_KEEPALIVE_INTERVAL, 684 peer->keepalive_interval) || 685 nla_put_u32(skb, OVPN_A_PEER_KEEPALIVE_TIMEOUT, 686 peer->keepalive_timeout)) 687 goto err; 688 689 rcu_read_lock(); 690 bind = rcu_dereference(peer->bind); 691 if (bind) { 692 if (bind->remote.in4.sin_family == AF_INET) { 693 if (nla_put_in_addr(skb, OVPN_A_PEER_REMOTE_IPV4, 694 bind->remote.in4.sin_addr.s_addr) || 695 nla_put_net16(skb, OVPN_A_PEER_REMOTE_PORT, 696 bind->remote.in4.sin_port) || 697 nla_put_in_addr(skb, OVPN_A_PEER_LOCAL_IPV4, 698 bind->local.ipv4.s_addr)) 699 goto err_unlock; 700 } else if (bind->remote.in4.sin_family == AF_INET6) { 701 if (nla_put_in6_addr(skb, OVPN_A_PEER_REMOTE_IPV6, 702 &bind->remote.in6.sin6_addr) || 703 nla_put_u32(skb, OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID, 704 bind->remote.in6.sin6_scope_id) || 705 nla_put_net16(skb, OVPN_A_PEER_REMOTE_PORT, 706 bind->remote.in6.sin6_port) || 707 nla_put_in6_addr(skb, OVPN_A_PEER_LOCAL_IPV6, 708 &bind->local.ipv6)) 709 goto err_unlock; 710 } 711 } 712 rcu_read_unlock(); 713 714 if (nla_put_net16(skb, OVPN_A_PEER_LOCAL_PORT, local_port) || 715 /* VPN RX stats */ 716 nla_put_uint(skb, OVPN_A_PEER_VPN_RX_BYTES, 717 atomic64_read(&peer->vpn_stats.rx.bytes)) || 718 nla_put_uint(skb, OVPN_A_PEER_VPN_RX_PACKETS, 719 atomic64_read(&peer->vpn_stats.rx.packets)) || 720 /* VPN TX stats */ 721 nla_put_uint(skb, OVPN_A_PEER_VPN_TX_BYTES, 722 atomic64_read(&peer->vpn_stats.tx.bytes)) || 723 nla_put_uint(skb, OVPN_A_PEER_VPN_TX_PACKETS, 724 atomic64_read(&peer->vpn_stats.tx.packets)) || 725 /* link RX stats */ 726 nla_put_uint(skb, OVPN_A_PEER_LINK_RX_BYTES, 727 atomic64_read(&peer->link_stats.rx.bytes)) || 728 nla_put_uint(skb, OVPN_A_PEER_LINK_RX_PACKETS, 729 atomic64_read(&peer->link_stats.rx.packets)) || 730 /* link TX stats */ 731 nla_put_uint(skb, OVPN_A_PEER_LINK_TX_BYTES, 732 atomic64_read(&peer->link_stats.tx.bytes)) || 733 nla_put_uint(skb, OVPN_A_PEER_LINK_TX_PACKETS, 734 atomic64_read(&peer->link_stats.tx.packets))) 735 goto err; 736 737 nla_nest_end(skb, attr); 738 genlmsg_end(skb, hdr); 739 740 return 0; 741 err_unlock: 742 rcu_read_unlock(); 743 err: 744 genlmsg_cancel(skb, hdr); 745 return ret; 746 } 747 748 int ovpn_nl_peer_get_doit(struct sk_buff *skb, struct genl_info *info) 749 { 750 struct nlattr *attrs[OVPN_A_PEER_MAX + 1]; 751 struct ovpn_priv *ovpn = info->user_ptr[0]; 752 struct ovpn_peer *peer; 753 struct sk_buff *msg; 754 u32 peer_id; 755 int ret, i; 756 757 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_PEER)) 758 return -EINVAL; 759 760 ret = nla_parse_nested(attrs, OVPN_A_PEER_MAX, info->attrs[OVPN_A_PEER], 761 ovpn_peer_nl_policy, info->extack); 762 if (ret) 763 return ret; 764 765 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_PEER], attrs, 766 OVPN_A_PEER_ID)) 767 return -EINVAL; 768 769 /* OVPN_CMD_PEER_GET expects only the PEER_ID, therefore 770 * ensure that the user hasn't specified any other attribute. 771 * 772 * Unfortunately this check cannot be performed via netlink 773 * spec/policy and must be open-coded. 774 */ 775 for (i = 0; i < OVPN_A_PEER_MAX + 1; i++) { 776 if (i == OVPN_A_PEER_ID) 777 continue; 778 779 if (attrs[i]) { 780 NL_SET_ERR_MSG_FMT_MOD(info->extack, 781 "unexpected attribute %u", i); 782 return -EINVAL; 783 } 784 } 785 786 peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]); 787 peer = ovpn_peer_get_by_id(ovpn, peer_id); 788 if (!peer) { 789 NL_SET_ERR_MSG_FMT_MOD(info->extack, 790 "cannot find peer with id %u", peer_id); 791 return -ENOENT; 792 } 793 794 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 795 if (!msg) { 796 ret = -ENOMEM; 797 goto err; 798 } 799 800 ret = ovpn_nl_send_peer(msg, info, peer, info->snd_portid, 801 info->snd_seq, 0); 802 if (ret < 0) { 803 nlmsg_free(msg); 804 goto err; 805 } 806 807 ret = genlmsg_reply(msg, info); 808 err: 809 ovpn_peer_put(peer); 810 return ret; 811 } 812 813 int ovpn_nl_peer_get_dumpit(struct sk_buff *skb, struct netlink_callback *cb) 814 { 815 const struct genl_info *info = genl_info_dump(cb); 816 int bkt, last_idx = cb->args[1], dumped = 0; 817 netdevice_tracker tracker; 818 struct ovpn_priv *ovpn; 819 struct ovpn_peer *peer; 820 821 ovpn = ovpn_get_dev_from_attrs(sock_net(cb->skb->sk), info, &tracker); 822 if (IS_ERR(ovpn)) 823 return PTR_ERR(ovpn); 824 825 if (ovpn->mode == OVPN_MODE_P2P) { 826 /* if we already dumped a peer it means we are done */ 827 if (last_idx) 828 goto out; 829 830 rcu_read_lock(); 831 peer = rcu_dereference(ovpn->peer); 832 if (peer) { 833 if (ovpn_nl_send_peer(skb, info, peer, 834 NETLINK_CB(cb->skb).portid, 835 cb->nlh->nlmsg_seq, 836 NLM_F_MULTI) == 0) 837 dumped++; 838 } 839 rcu_read_unlock(); 840 } else { 841 rcu_read_lock(); 842 hash_for_each_rcu(ovpn->peers->by_id, bkt, peer, 843 hash_entry_id) { 844 /* skip already dumped peers that were dumped by 845 * previous invocations 846 */ 847 if (last_idx > 0) { 848 last_idx--; 849 continue; 850 } 851 852 if (ovpn_nl_send_peer(skb, info, peer, 853 NETLINK_CB(cb->skb).portid, 854 cb->nlh->nlmsg_seq, 855 NLM_F_MULTI) < 0) 856 break; 857 858 /* count peers being dumped during this invocation */ 859 dumped++; 860 } 861 rcu_read_unlock(); 862 } 863 864 out: 865 netdev_put(ovpn->dev, &tracker); 866 867 /* sum up peers dumped in this message, so that at the next invocation 868 * we can continue from where we left 869 */ 870 cb->args[1] += dumped; 871 return skb->len; 872 } 873 874 int ovpn_nl_peer_del_doit(struct sk_buff *skb, struct genl_info *info) 875 { 876 struct nlattr *attrs[OVPN_A_PEER_MAX + 1]; 877 struct ovpn_priv *ovpn = info->user_ptr[0]; 878 struct ovpn_peer *peer; 879 u32 peer_id; 880 int ret; 881 882 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_PEER)) 883 return -EINVAL; 884 885 ret = nla_parse_nested(attrs, OVPN_A_PEER_MAX, info->attrs[OVPN_A_PEER], 886 ovpn_peer_del_input_nl_policy, info->extack); 887 if (ret) 888 return ret; 889 890 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_PEER], attrs, 891 OVPN_A_PEER_ID)) 892 return -EINVAL; 893 894 peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]); 895 peer = ovpn_peer_get_by_id(ovpn, peer_id); 896 if (!peer) { 897 NL_SET_ERR_MSG_FMT_MOD(info->extack, 898 "cannot find peer with id %u", peer_id); 899 return -ENOENT; 900 } 901 902 netdev_dbg(ovpn->dev, "del peer %u\n", peer->id); 903 ret = ovpn_peer_del(peer, OVPN_DEL_PEER_REASON_USERSPACE); 904 ovpn_peer_put(peer); 905 906 return ret; 907 } 908 909 static int ovpn_nl_get_key_dir(struct genl_info *info, struct nlattr *key, 910 enum ovpn_cipher_alg cipher, 911 struct ovpn_key_direction *dir) 912 { 913 struct nlattr *attrs[OVPN_A_KEYDIR_MAX + 1]; 914 int ret; 915 916 ret = nla_parse_nested(attrs, OVPN_A_KEYDIR_MAX, key, 917 ovpn_keydir_nl_policy, info->extack); 918 if (ret) 919 return ret; 920 921 switch (cipher) { 922 case OVPN_CIPHER_ALG_AES_GCM: 923 case OVPN_CIPHER_ALG_CHACHA20_POLY1305: 924 if (NL_REQ_ATTR_CHECK(info->extack, key, attrs, 925 OVPN_A_KEYDIR_CIPHER_KEY) || 926 NL_REQ_ATTR_CHECK(info->extack, key, attrs, 927 OVPN_A_KEYDIR_NONCE_TAIL)) 928 return -EINVAL; 929 930 dir->cipher_key = nla_data(attrs[OVPN_A_KEYDIR_CIPHER_KEY]); 931 dir->cipher_key_size = nla_len(attrs[OVPN_A_KEYDIR_CIPHER_KEY]); 932 933 /* These algorithms require a 96bit nonce, 934 * Construct it by combining 4-bytes packet id and 935 * 8-bytes nonce-tail from userspace 936 */ 937 dir->nonce_tail = nla_data(attrs[OVPN_A_KEYDIR_NONCE_TAIL]); 938 dir->nonce_tail_size = nla_len(attrs[OVPN_A_KEYDIR_NONCE_TAIL]); 939 break; 940 default: 941 NL_SET_ERR_MSG_MOD(info->extack, "unsupported cipher"); 942 return -EINVAL; 943 } 944 945 return 0; 946 } 947 948 /** 949 * ovpn_nl_key_new_doit - configure a new key for the specified peer 950 * @skb: incoming netlink message 951 * @info: genetlink metadata 952 * 953 * This function allows the user to install a new key in the peer crypto 954 * state. 955 * Each peer has two 'slots', namely 'primary' and 'secondary', where 956 * keys can be installed. The key in the 'primary' slot is used for 957 * encryption, while both keys can be used for decryption by matching the 958 * key ID carried in the incoming packet. 959 * 960 * The user is responsible for rotating keys when necessary. The user 961 * may fetch peer traffic statistics via netlink in order to better 962 * identify the right time to rotate keys. 963 * The renegotiation follows these steps: 964 * 1. a new key is computed by the user and is installed in the 'secondary' 965 * slot 966 * 2. at user discretion (usually after a predetermined time) 'primary' and 967 * 'secondary' contents are swapped and the new key starts being used for 968 * encryption, while the old key is kept around for decryption of late 969 * packets. 970 * 971 * Return: 0 on success or a negative error code otherwise. 972 */ 973 int ovpn_nl_key_new_doit(struct sk_buff *skb, struct genl_info *info) 974 { 975 struct nlattr *attrs[OVPN_A_KEYCONF_MAX + 1]; 976 struct ovpn_priv *ovpn = info->user_ptr[0]; 977 struct ovpn_peer_key_reset pkr; 978 struct ovpn_peer *peer; 979 u32 peer_id; 980 int ret; 981 982 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF)) 983 return -EINVAL; 984 985 ret = nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX, 986 info->attrs[OVPN_A_KEYCONF], 987 ovpn_keyconf_nl_policy, info->extack); 988 if (ret) 989 return ret; 990 991 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, 992 OVPN_A_KEYCONF_PEER_ID)) 993 return -EINVAL; 994 995 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, 996 OVPN_A_KEYCONF_SLOT) || 997 NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, 998 OVPN_A_KEYCONF_KEY_ID) || 999 NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, 1000 OVPN_A_KEYCONF_CIPHER_ALG) || 1001 NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, 1002 OVPN_A_KEYCONF_ENCRYPT_DIR) || 1003 NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, 1004 OVPN_A_KEYCONF_DECRYPT_DIR)) 1005 return -EINVAL; 1006 1007 pkr.slot = nla_get_u32(attrs[OVPN_A_KEYCONF_SLOT]); 1008 pkr.key.key_id = nla_get_u32(attrs[OVPN_A_KEYCONF_KEY_ID]); 1009 pkr.key.cipher_alg = nla_get_u32(attrs[OVPN_A_KEYCONF_CIPHER_ALG]); 1010 1011 ret = ovpn_nl_get_key_dir(info, attrs[OVPN_A_KEYCONF_ENCRYPT_DIR], 1012 pkr.key.cipher_alg, &pkr.key.encrypt); 1013 if (ret < 0) 1014 return ret; 1015 1016 ret = ovpn_nl_get_key_dir(info, attrs[OVPN_A_KEYCONF_DECRYPT_DIR], 1017 pkr.key.cipher_alg, &pkr.key.decrypt); 1018 if (ret < 0) 1019 return ret; 1020 1021 peer_id = nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]); 1022 peer = ovpn_peer_get_by_id(ovpn, peer_id); 1023 if (!peer) { 1024 NL_SET_ERR_MSG_FMT_MOD(info->extack, 1025 "no peer with id %u to set key for", 1026 peer_id); 1027 return -ENOENT; 1028 } 1029 1030 ret = ovpn_crypto_state_reset(&peer->crypto, &pkr); 1031 if (ret < 0) { 1032 NL_SET_ERR_MSG_FMT_MOD(info->extack, 1033 "cannot install new key for peer %u", 1034 peer_id); 1035 goto out; 1036 } 1037 1038 netdev_dbg(ovpn->dev, "new key installed (id=%u) for peer %u\n", 1039 pkr.key.key_id, peer_id); 1040 out: 1041 ovpn_peer_put(peer); 1042 return ret; 1043 } 1044 1045 static int ovpn_nl_send_key(struct sk_buff *skb, const struct genl_info *info, 1046 u32 peer_id, enum ovpn_key_slot slot, 1047 const struct ovpn_key_config *keyconf) 1048 { 1049 struct nlattr *attr; 1050 void *hdr; 1051 1052 hdr = genlmsg_put(skb, info->snd_portid, info->snd_seq, &ovpn_nl_family, 1053 0, OVPN_CMD_KEY_GET); 1054 if (!hdr) 1055 return -ENOBUFS; 1056 1057 attr = nla_nest_start(skb, OVPN_A_KEYCONF); 1058 if (!attr) 1059 goto err; 1060 1061 if (nla_put_u32(skb, OVPN_A_KEYCONF_PEER_ID, peer_id)) 1062 goto err; 1063 1064 if (nla_put_u32(skb, OVPN_A_KEYCONF_SLOT, slot) || 1065 nla_put_u32(skb, OVPN_A_KEYCONF_KEY_ID, keyconf->key_id) || 1066 nla_put_u32(skb, OVPN_A_KEYCONF_CIPHER_ALG, keyconf->cipher_alg)) 1067 goto err; 1068 1069 nla_nest_end(skb, attr); 1070 genlmsg_end(skb, hdr); 1071 1072 return 0; 1073 err: 1074 genlmsg_cancel(skb, hdr); 1075 return -EMSGSIZE; 1076 } 1077 1078 int ovpn_nl_key_get_doit(struct sk_buff *skb, struct genl_info *info) 1079 { 1080 struct nlattr *attrs[OVPN_A_KEYCONF_MAX + 1]; 1081 struct ovpn_priv *ovpn = info->user_ptr[0]; 1082 struct ovpn_key_config keyconf = { 0 }; 1083 enum ovpn_key_slot slot; 1084 struct ovpn_peer *peer; 1085 struct sk_buff *msg; 1086 u32 peer_id; 1087 int ret, i; 1088 1089 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF)) 1090 return -EINVAL; 1091 1092 ret = nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX, 1093 info->attrs[OVPN_A_KEYCONF], 1094 ovpn_keyconf_get_nl_policy, info->extack); 1095 if (ret) 1096 return ret; 1097 1098 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, 1099 OVPN_A_KEYCONF_PEER_ID)) 1100 return -EINVAL; 1101 1102 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, 1103 OVPN_A_KEYCONF_SLOT)) 1104 return -EINVAL; 1105 1106 /* OVPN_CMD_KEY_GET expects only the PEER_ID and the SLOT, therefore 1107 * ensure that the user hasn't specified any other attribute. 1108 * 1109 * Unfortunately this check cannot be performed via netlink 1110 * spec/policy and must be open-coded. 1111 */ 1112 for (i = 0; i < OVPN_A_KEYCONF_MAX + 1; i++) { 1113 if (i == OVPN_A_KEYCONF_PEER_ID || 1114 i == OVPN_A_KEYCONF_SLOT) 1115 continue; 1116 1117 if (attrs[i]) { 1118 NL_SET_ERR_MSG_FMT_MOD(info->extack, 1119 "unexpected attribute %u", i); 1120 return -EINVAL; 1121 } 1122 } 1123 1124 peer_id = nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]); 1125 peer = ovpn_peer_get_by_id(ovpn, peer_id); 1126 if (!peer) { 1127 NL_SET_ERR_MSG_FMT_MOD(info->extack, 1128 "cannot find peer with id %u", peer_id); 1129 return -ENOENT; 1130 } 1131 1132 slot = nla_get_u32(attrs[OVPN_A_KEYCONF_SLOT]); 1133 1134 ret = ovpn_crypto_config_get(&peer->crypto, slot, &keyconf); 1135 if (ret < 0) { 1136 NL_SET_ERR_MSG_FMT_MOD(info->extack, 1137 "cannot extract key from slot %u for peer %u", 1138 slot, peer_id); 1139 goto err; 1140 } 1141 1142 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 1143 if (!msg) { 1144 ret = -ENOMEM; 1145 goto err; 1146 } 1147 1148 ret = ovpn_nl_send_key(msg, info, peer->id, slot, &keyconf); 1149 if (ret < 0) { 1150 nlmsg_free(msg); 1151 goto err; 1152 } 1153 1154 ret = genlmsg_reply(msg, info); 1155 err: 1156 ovpn_peer_put(peer); 1157 return ret; 1158 } 1159 1160 int ovpn_nl_key_swap_doit(struct sk_buff *skb, struct genl_info *info) 1161 { 1162 struct nlattr *attrs[OVPN_A_KEYCONF_MAX + 1]; 1163 struct ovpn_priv *ovpn = info->user_ptr[0]; 1164 struct ovpn_peer *peer; 1165 u32 peer_id; 1166 int ret; 1167 1168 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF)) 1169 return -EINVAL; 1170 1171 ret = nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX, 1172 info->attrs[OVPN_A_KEYCONF], 1173 ovpn_keyconf_swap_input_nl_policy, info->extack); 1174 if (ret) 1175 return ret; 1176 1177 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, 1178 OVPN_A_KEYCONF_PEER_ID)) 1179 return -EINVAL; 1180 1181 peer_id = nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]); 1182 peer = ovpn_peer_get_by_id(ovpn, peer_id); 1183 if (!peer) { 1184 NL_SET_ERR_MSG_FMT_MOD(info->extack, 1185 "no peer with id %u to swap keys for", 1186 peer_id); 1187 return -ENOENT; 1188 } 1189 1190 ovpn_crypto_key_slots_swap(&peer->crypto); 1191 ovpn_peer_put(peer); 1192 1193 return 0; 1194 } 1195 1196 int ovpn_nl_key_del_doit(struct sk_buff *skb, struct genl_info *info) 1197 { 1198 struct nlattr *attrs[OVPN_A_KEYCONF_MAX + 1]; 1199 struct ovpn_priv *ovpn = info->user_ptr[0]; 1200 enum ovpn_key_slot slot; 1201 struct ovpn_peer *peer; 1202 u32 peer_id; 1203 int ret; 1204 1205 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF)) 1206 return -EINVAL; 1207 1208 ret = nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX, 1209 info->attrs[OVPN_A_KEYCONF], 1210 ovpn_keyconf_del_input_nl_policy, info->extack); 1211 if (ret) 1212 return ret; 1213 1214 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, 1215 OVPN_A_KEYCONF_PEER_ID)) 1216 return -EINVAL; 1217 1218 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, 1219 OVPN_A_KEYCONF_SLOT)) 1220 return -EINVAL; 1221 1222 peer_id = nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]); 1223 slot = nla_get_u32(attrs[OVPN_A_KEYCONF_SLOT]); 1224 1225 peer = ovpn_peer_get_by_id(ovpn, peer_id); 1226 if (!peer) { 1227 NL_SET_ERR_MSG_FMT_MOD(info->extack, 1228 "no peer with id %u to delete key for", 1229 peer_id); 1230 return -ENOENT; 1231 } 1232 1233 ovpn_crypto_key_slot_delete(&peer->crypto, slot); 1234 ovpn_peer_put(peer); 1235 1236 return 0; 1237 } 1238 1239 /** 1240 * ovpn_nl_peer_del_notify - notify userspace about peer being deleted 1241 * @peer: the peer being deleted 1242 * 1243 * Return: 0 on success or a negative error code otherwise 1244 */ 1245 int ovpn_nl_peer_del_notify(struct ovpn_peer *peer) 1246 { 1247 struct ovpn_socket *sock; 1248 struct sk_buff *msg; 1249 struct nlattr *attr; 1250 int ret = -EMSGSIZE; 1251 void *hdr; 1252 1253 netdev_info(peer->ovpn->dev, "deleting peer with id %u, reason %d\n", 1254 peer->id, peer->delete_reason); 1255 1256 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 1257 if (!msg) 1258 return -ENOMEM; 1259 1260 hdr = genlmsg_put(msg, 0, 0, &ovpn_nl_family, 0, OVPN_CMD_PEER_DEL_NTF); 1261 if (!hdr) { 1262 ret = -ENOBUFS; 1263 goto err_free_msg; 1264 } 1265 1266 if (nla_put_u32(msg, OVPN_A_IFINDEX, peer->ovpn->dev->ifindex)) 1267 goto err_cancel_msg; 1268 1269 attr = nla_nest_start(msg, OVPN_A_PEER); 1270 if (!attr) 1271 goto err_cancel_msg; 1272 1273 if (nla_put_u32(msg, OVPN_A_PEER_DEL_REASON, peer->delete_reason)) 1274 goto err_cancel_msg; 1275 1276 if (nla_put_u32(msg, OVPN_A_PEER_ID, peer->id)) 1277 goto err_cancel_msg; 1278 1279 nla_nest_end(msg, attr); 1280 1281 genlmsg_end(msg, hdr); 1282 1283 rcu_read_lock(); 1284 sock = rcu_dereference(peer->sock); 1285 if (!sock) { 1286 ret = -EINVAL; 1287 goto err_unlock; 1288 } 1289 genlmsg_multicast_netns(&ovpn_nl_family, sock_net(sock->sk), msg, 0, 1290 OVPN_NLGRP_PEERS, GFP_ATOMIC); 1291 rcu_read_unlock(); 1292 1293 return 0; 1294 1295 err_unlock: 1296 rcu_read_unlock(); 1297 err_cancel_msg: 1298 genlmsg_cancel(msg, hdr); 1299 err_free_msg: 1300 nlmsg_free(msg); 1301 return ret; 1302 } 1303 1304 /** 1305 * ovpn_nl_peer_float_notify - notify userspace about peer floating 1306 * @peer: the floated peer 1307 * @ss: sockaddr representing the new remote endpoint 1308 * 1309 * Return: 0 on success or a negative error code otherwise 1310 */ 1311 int ovpn_nl_peer_float_notify(struct ovpn_peer *peer, 1312 const struct sockaddr_storage *ss) 1313 { 1314 struct ovpn_socket *sock; 1315 struct sockaddr_in6 *sa6; 1316 struct sockaddr_in *sa; 1317 struct sk_buff *msg; 1318 struct nlattr *attr; 1319 int ret = -EMSGSIZE; 1320 void *hdr; 1321 1322 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 1323 if (!msg) 1324 return -ENOMEM; 1325 1326 hdr = genlmsg_put(msg, 0, 0, &ovpn_nl_family, 0, 1327 OVPN_CMD_PEER_FLOAT_NTF); 1328 if (!hdr) { 1329 ret = -ENOBUFS; 1330 goto err_free_msg; 1331 } 1332 1333 if (nla_put_u32(msg, OVPN_A_IFINDEX, peer->ovpn->dev->ifindex)) 1334 goto err_cancel_msg; 1335 1336 attr = nla_nest_start(msg, OVPN_A_PEER); 1337 if (!attr) 1338 goto err_cancel_msg; 1339 1340 if (nla_put_u32(msg, OVPN_A_PEER_ID, peer->id)) 1341 goto err_cancel_msg; 1342 1343 if (ss->ss_family == AF_INET) { 1344 sa = (struct sockaddr_in *)ss; 1345 if (nla_put_in_addr(msg, OVPN_A_PEER_REMOTE_IPV4, 1346 sa->sin_addr.s_addr) || 1347 nla_put_net16(msg, OVPN_A_PEER_REMOTE_PORT, sa->sin_port)) 1348 goto err_cancel_msg; 1349 } else if (ss->ss_family == AF_INET6) { 1350 sa6 = (struct sockaddr_in6 *)ss; 1351 if (nla_put_in6_addr(msg, OVPN_A_PEER_REMOTE_IPV6, 1352 &sa6->sin6_addr) || 1353 nla_put_u32(msg, OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID, 1354 sa6->sin6_scope_id) || 1355 nla_put_net16(msg, OVPN_A_PEER_REMOTE_PORT, sa6->sin6_port)) 1356 goto err_cancel_msg; 1357 } else { 1358 ret = -EAFNOSUPPORT; 1359 goto err_cancel_msg; 1360 } 1361 1362 nla_nest_end(msg, attr); 1363 genlmsg_end(msg, hdr); 1364 1365 rcu_read_lock(); 1366 sock = rcu_dereference(peer->sock); 1367 if (!sock) { 1368 ret = -EINVAL; 1369 goto err_unlock; 1370 } 1371 genlmsg_multicast_netns(&ovpn_nl_family, sock_net(sock->sk), msg, 1372 0, OVPN_NLGRP_PEERS, GFP_ATOMIC); 1373 rcu_read_unlock(); 1374 1375 return 0; 1376 1377 err_unlock: 1378 rcu_read_unlock(); 1379 err_cancel_msg: 1380 genlmsg_cancel(msg, hdr); 1381 err_free_msg: 1382 nlmsg_free(msg); 1383 return ret; 1384 } 1385 1386 /** 1387 * ovpn_nl_key_swap_notify - notify userspace peer's key must be renewed 1388 * @peer: the peer whose key needs to be renewed 1389 * @key_id: the ID of the key that needs to be renewed 1390 * 1391 * Return: 0 on success or a negative error code otherwise 1392 */ 1393 int ovpn_nl_key_swap_notify(struct ovpn_peer *peer, u8 key_id) 1394 { 1395 struct ovpn_socket *sock; 1396 struct nlattr *k_attr; 1397 struct sk_buff *msg; 1398 int ret = -EMSGSIZE; 1399 void *hdr; 1400 1401 netdev_info(peer->ovpn->dev, "peer with id %u must rekey - primary key unusable.\n", 1402 peer->id); 1403 1404 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 1405 if (!msg) 1406 return -ENOMEM; 1407 1408 hdr = genlmsg_put(msg, 0, 0, &ovpn_nl_family, 0, OVPN_CMD_KEY_SWAP_NTF); 1409 if (!hdr) { 1410 ret = -ENOBUFS; 1411 goto err_free_msg; 1412 } 1413 1414 if (nla_put_u32(msg, OVPN_A_IFINDEX, peer->ovpn->dev->ifindex)) 1415 goto err_cancel_msg; 1416 1417 k_attr = nla_nest_start(msg, OVPN_A_KEYCONF); 1418 if (!k_attr) 1419 goto err_cancel_msg; 1420 1421 if (nla_put_u32(msg, OVPN_A_KEYCONF_PEER_ID, peer->id)) 1422 goto err_cancel_msg; 1423 1424 if (nla_put_u16(msg, OVPN_A_KEYCONF_KEY_ID, key_id)) 1425 goto err_cancel_msg; 1426 1427 nla_nest_end(msg, k_attr); 1428 genlmsg_end(msg, hdr); 1429 1430 rcu_read_lock(); 1431 sock = rcu_dereference(peer->sock); 1432 if (!sock) { 1433 ret = -EINVAL; 1434 goto err_unlock; 1435 } 1436 genlmsg_multicast_netns(&ovpn_nl_family, sock_net(sock->sk), msg, 0, 1437 OVPN_NLGRP_PEERS, GFP_ATOMIC); 1438 rcu_read_unlock(); 1439 1440 return 0; 1441 err_unlock: 1442 rcu_read_unlock(); 1443 err_cancel_msg: 1444 genlmsg_cancel(msg, hdr); 1445 err_free_msg: 1446 nlmsg_free(msg); 1447 return ret; 1448 } 1449 1450 /** 1451 * ovpn_nl_register - perform any needed registration in the NL subsustem 1452 * 1453 * Return: 0 on success, a negative error code otherwise 1454 */ 1455 int __init ovpn_nl_register(void) 1456 { 1457 int ret = genl_register_family(&ovpn_nl_family); 1458 1459 if (ret) { 1460 pr_err("ovpn: genl_register_family failed: %d\n", ret); 1461 return ret; 1462 } 1463 1464 return 0; 1465 } 1466 1467 /** 1468 * ovpn_nl_unregister - undo any module wide netlink registration 1469 */ 1470 void ovpn_nl_unregister(void) 1471 { 1472 genl_unregister_family(&ovpn_nl_family); 1473 } 1474