1 // SPDX-License-Identifier: GPL-2.0 2 /* OpenVPN data channel offload 3 * 4 * Copyright (C) 2020-2025 OpenVPN, Inc. 5 * 6 * Author: Antonio Quartulli <antonio@openvpn.net> 7 */ 8 9 #include <linux/netdevice.h> 10 #include <linux/types.h> 11 #include <net/genetlink.h> 12 13 #include <uapi/linux/ovpn.h> 14 15 #include "ovpnpriv.h" 16 #include "main.h" 17 #include "netlink.h" 18 #include "netlink-gen.h" 19 #include "bind.h" 20 #include "crypto.h" 21 #include "peer.h" 22 #include "socket.h" 23 24 MODULE_ALIAS_GENL_FAMILY(OVPN_FAMILY_NAME); 25 26 /** 27 * ovpn_get_dev_from_attrs - retrieve the ovpn private data from the netdevice 28 * a netlink message is targeting 29 * @net: network namespace where to look for the interface 30 * @info: generic netlink info from the user request 31 * @tracker: tracker object to be used for the netdev reference acquisition 32 * 33 * Return: the ovpn private data, if found, or an error otherwise 34 */ 35 static struct ovpn_priv * 36 ovpn_get_dev_from_attrs(struct net *net, const struct genl_info *info, 37 netdevice_tracker *tracker) 38 { 39 struct ovpn_priv *ovpn; 40 struct net_device *dev; 41 int ifindex; 42 43 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_IFINDEX)) 44 return ERR_PTR(-EINVAL); 45 46 ifindex = nla_get_u32(info->attrs[OVPN_A_IFINDEX]); 47 48 rcu_read_lock(); 49 dev = dev_get_by_index_rcu(net, ifindex); 50 if (!dev) { 51 rcu_read_unlock(); 52 NL_SET_ERR_MSG_MOD(info->extack, 53 "ifindex does not match any interface"); 54 return ERR_PTR(-ENODEV); 55 } 56 57 if (!ovpn_dev_is_valid(dev)) { 58 rcu_read_unlock(); 59 NL_SET_ERR_MSG_MOD(info->extack, 60 "specified interface is not ovpn"); 61 NL_SET_BAD_ATTR(info->extack, info->attrs[OVPN_A_IFINDEX]); 62 return ERR_PTR(-EINVAL); 63 } 64 65 ovpn = netdev_priv(dev); 66 netdev_hold(dev, tracker, GFP_ATOMIC); 67 rcu_read_unlock(); 68 69 return ovpn; 70 } 71 72 int ovpn_nl_pre_doit(const struct genl_split_ops *ops, struct sk_buff *skb, 73 struct genl_info *info) 74 { 75 netdevice_tracker *tracker = (netdevice_tracker *)&info->user_ptr[1]; 76 struct ovpn_priv *ovpn = ovpn_get_dev_from_attrs(genl_info_net(info), 77 info, tracker); 78 79 if (IS_ERR(ovpn)) 80 return PTR_ERR(ovpn); 81 82 info->user_ptr[0] = ovpn; 83 84 return 0; 85 } 86 87 void ovpn_nl_post_doit(const struct genl_split_ops *ops, struct sk_buff *skb, 88 struct genl_info *info) 89 { 90 netdevice_tracker *tracker = (netdevice_tracker *)&info->user_ptr[1]; 91 struct ovpn_priv *ovpn = info->user_ptr[0]; 92 93 if (ovpn) 94 netdev_put(ovpn->dev, tracker); 95 } 96 97 static bool ovpn_nl_attr_sockaddr_remote(struct nlattr **attrs, 98 struct sockaddr_storage *ss) 99 { 100 struct sockaddr_in6 *sin6; 101 struct sockaddr_in *sin; 102 struct in6_addr *in6; 103 __be16 port = 0; 104 __be32 *in; 105 106 ss->ss_family = AF_UNSPEC; 107 108 if (attrs[OVPN_A_PEER_REMOTE_PORT]) 109 port = nla_get_be16(attrs[OVPN_A_PEER_REMOTE_PORT]); 110 111 if (attrs[OVPN_A_PEER_REMOTE_IPV4]) { 112 ss->ss_family = AF_INET; 113 in = nla_data(attrs[OVPN_A_PEER_REMOTE_IPV4]); 114 } else if (attrs[OVPN_A_PEER_REMOTE_IPV6]) { 115 ss->ss_family = AF_INET6; 116 in6 = nla_data(attrs[OVPN_A_PEER_REMOTE_IPV6]); 117 } else { 118 return false; 119 } 120 121 switch (ss->ss_family) { 122 case AF_INET6: 123 /* If this is a regular IPv6 just break and move on, 124 * otherwise switch to AF_INET and extract the IPv4 accordingly 125 */ 126 if (!ipv6_addr_v4mapped(in6)) { 127 sin6 = (struct sockaddr_in6 *)ss; 128 sin6->sin6_port = port; 129 memcpy(&sin6->sin6_addr, in6, sizeof(*in6)); 130 break; 131 } 132 133 /* v4-mapped-v6 address */ 134 ss->ss_family = AF_INET; 135 in = &in6->s6_addr32[3]; 136 fallthrough; 137 case AF_INET: 138 sin = (struct sockaddr_in *)ss; 139 sin->sin_port = port; 140 sin->sin_addr.s_addr = *in; 141 break; 142 } 143 144 return true; 145 } 146 147 static u8 *ovpn_nl_attr_local_ip(struct nlattr **attrs) 148 { 149 u8 *addr6; 150 151 if (!attrs[OVPN_A_PEER_LOCAL_IPV4] && !attrs[OVPN_A_PEER_LOCAL_IPV6]) 152 return NULL; 153 154 if (attrs[OVPN_A_PEER_LOCAL_IPV4]) 155 return nla_data(attrs[OVPN_A_PEER_LOCAL_IPV4]); 156 157 addr6 = nla_data(attrs[OVPN_A_PEER_LOCAL_IPV6]); 158 /* this is an IPv4-mapped IPv6 address, therefore extract the actual 159 * v4 address from the last 4 bytes 160 */ 161 if (ipv6_addr_v4mapped((struct in6_addr *)addr6)) 162 return addr6 + 12; 163 164 return addr6; 165 } 166 167 static sa_family_t ovpn_nl_family_get(struct nlattr *addr4, 168 struct nlattr *addr6) 169 { 170 if (addr4) 171 return AF_INET; 172 173 if (addr6) { 174 if (ipv6_addr_v4mapped((struct in6_addr *)nla_data(addr6))) 175 return AF_INET; 176 return AF_INET6; 177 } 178 179 return AF_UNSPEC; 180 } 181 182 static int ovpn_nl_peer_precheck(struct ovpn_priv *ovpn, 183 struct genl_info *info, 184 struct nlattr **attrs) 185 { 186 sa_family_t local_fam, remote_fam; 187 188 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_PEER], attrs, 189 OVPN_A_PEER_ID)) 190 return -EINVAL; 191 192 if (attrs[OVPN_A_PEER_REMOTE_IPV4] && attrs[OVPN_A_PEER_REMOTE_IPV6]) { 193 NL_SET_ERR_MSG_MOD(info->extack, 194 "cannot specify both remote IPv4 or IPv6 address"); 195 return -EINVAL; 196 } 197 198 if (!attrs[OVPN_A_PEER_REMOTE_IPV4] && 199 !attrs[OVPN_A_PEER_REMOTE_IPV6] && attrs[OVPN_A_PEER_REMOTE_PORT]) { 200 NL_SET_ERR_MSG_MOD(info->extack, 201 "cannot specify remote port without IP address"); 202 return -EINVAL; 203 } 204 205 if ((attrs[OVPN_A_PEER_REMOTE_IPV4] || 206 attrs[OVPN_A_PEER_REMOTE_IPV6]) && 207 !attrs[OVPN_A_PEER_REMOTE_PORT]) { 208 NL_SET_ERR_MSG_MOD(info->extack, 209 "cannot specify remote IP address without port"); 210 return -EINVAL; 211 } 212 213 if (!attrs[OVPN_A_PEER_REMOTE_IPV4] && 214 attrs[OVPN_A_PEER_LOCAL_IPV4]) { 215 NL_SET_ERR_MSG_MOD(info->extack, 216 "cannot specify local IPv4 address without remote"); 217 return -EINVAL; 218 } 219 220 if (!attrs[OVPN_A_PEER_REMOTE_IPV6] && 221 attrs[OVPN_A_PEER_LOCAL_IPV6]) { 222 NL_SET_ERR_MSG_MOD(info->extack, 223 "cannot specify local IPV6 address without remote"); 224 return -EINVAL; 225 } 226 227 /* check that local and remote address families are the same even 228 * after parsing v4mapped IPv6 addresses. 229 * (if addresses are not provided, family will be AF_UNSPEC and 230 * the check is skipped) 231 */ 232 local_fam = ovpn_nl_family_get(attrs[OVPN_A_PEER_LOCAL_IPV4], 233 attrs[OVPN_A_PEER_LOCAL_IPV6]); 234 remote_fam = ovpn_nl_family_get(attrs[OVPN_A_PEER_REMOTE_IPV4], 235 attrs[OVPN_A_PEER_REMOTE_IPV6]); 236 if (local_fam != AF_UNSPEC && remote_fam != AF_UNSPEC && 237 local_fam != remote_fam) { 238 NL_SET_ERR_MSG_MOD(info->extack, 239 "mismatching local and remote address families"); 240 return -EINVAL; 241 } 242 243 if (remote_fam != AF_INET6 && attrs[OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID]) { 244 NL_SET_ERR_MSG_MOD(info->extack, 245 "cannot specify scope id without remote IPv6 address"); 246 return -EINVAL; 247 } 248 249 /* VPN IPs are needed only in MP mode for selecting the right peer */ 250 if (ovpn->mode == OVPN_MODE_P2P && (attrs[OVPN_A_PEER_VPN_IPV4] || 251 attrs[OVPN_A_PEER_VPN_IPV6])) { 252 NL_SET_ERR_MSG_FMT_MOD(info->extack, 253 "unexpected VPN IP in P2P mode"); 254 return -EINVAL; 255 } 256 257 if ((attrs[OVPN_A_PEER_KEEPALIVE_INTERVAL] && 258 !attrs[OVPN_A_PEER_KEEPALIVE_TIMEOUT]) || 259 (!attrs[OVPN_A_PEER_KEEPALIVE_INTERVAL] && 260 attrs[OVPN_A_PEER_KEEPALIVE_TIMEOUT])) { 261 NL_SET_ERR_MSG_FMT_MOD(info->extack, 262 "keepalive interval and timeout are required together"); 263 return -EINVAL; 264 } 265 266 return 0; 267 } 268 269 /** 270 * ovpn_nl_peer_modify - modify the peer attributes according to the incoming msg 271 * @peer: the peer to modify 272 * @info: generic netlink info from the user request 273 * @attrs: the attributes from the user request 274 * 275 * Return: a negative error code in case of failure, 0 on success or 1 on 276 * success and the VPN IPs have been modified (requires rehashing in MP 277 * mode) 278 */ 279 static int ovpn_nl_peer_modify(struct ovpn_peer *peer, struct genl_info *info, 280 struct nlattr **attrs) 281 { 282 struct sockaddr_storage ss = {}; 283 void *local_ip = NULL; 284 u32 interv, timeout; 285 bool rehash = false; 286 int ret; 287 288 spin_lock_bh(&peer->lock); 289 290 if (ovpn_nl_attr_sockaddr_remote(attrs, &ss)) { 291 /* we carry the local IP in a generic container. 292 * ovpn_peer_reset_sockaddr() will properly interpret it 293 * based on ss.ss_family 294 */ 295 local_ip = ovpn_nl_attr_local_ip(attrs); 296 297 /* set peer sockaddr */ 298 ret = ovpn_peer_reset_sockaddr(peer, &ss, local_ip); 299 if (ret < 0) { 300 NL_SET_ERR_MSG_FMT_MOD(info->extack, 301 "cannot set peer sockaddr: %d", 302 ret); 303 goto err_unlock; 304 } 305 dst_cache_reset(&peer->dst_cache); 306 } 307 308 /* In a multipeer-to-multipeer setup we may have asymmetric peer IDs, 309 * that is peer->id might be different from peer->tx_id. 310 */ 311 if (attrs[OVPN_A_PEER_TX_ID]) 312 peer->tx_id = nla_get_u32(attrs[OVPN_A_PEER_TX_ID]); 313 314 if (attrs[OVPN_A_PEER_VPN_IPV4]) { 315 rehash = true; 316 peer->vpn_addrs.ipv4.s_addr = 317 nla_get_in_addr(attrs[OVPN_A_PEER_VPN_IPV4]); 318 } 319 320 if (attrs[OVPN_A_PEER_VPN_IPV6]) { 321 rehash = true; 322 peer->vpn_addrs.ipv6 = 323 nla_get_in6_addr(attrs[OVPN_A_PEER_VPN_IPV6]); 324 } 325 326 /* when setting the keepalive, both parameters have to be configured */ 327 if (attrs[OVPN_A_PEER_KEEPALIVE_INTERVAL] && 328 attrs[OVPN_A_PEER_KEEPALIVE_TIMEOUT]) { 329 interv = nla_get_u32(attrs[OVPN_A_PEER_KEEPALIVE_INTERVAL]); 330 timeout = nla_get_u32(attrs[OVPN_A_PEER_KEEPALIVE_TIMEOUT]); 331 ovpn_peer_keepalive_set(peer, interv, timeout); 332 } 333 334 netdev_dbg(peer->ovpn->dev, 335 "modify peer id=%u tx_id=%u endpoint=%pIScp VPN-IPv4=%pI4 VPN-IPv6=%pI6c\n", 336 peer->id, peer->tx_id, &ss, 337 &peer->vpn_addrs.ipv4.s_addr, &peer->vpn_addrs.ipv6); 338 339 spin_unlock_bh(&peer->lock); 340 341 return rehash ? 1 : 0; 342 err_unlock: 343 spin_unlock_bh(&peer->lock); 344 return ret; 345 } 346 347 int ovpn_nl_peer_new_doit(struct sk_buff *skb, struct genl_info *info) 348 { 349 struct nlattr *attrs[OVPN_A_PEER_MAX + 1]; 350 struct ovpn_priv *ovpn = info->user_ptr[0]; 351 struct ovpn_socket *ovpn_sock; 352 struct socket *sock = NULL; 353 struct ovpn_peer *peer; 354 u32 sockfd, peer_id; 355 int ret; 356 357 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_PEER)) 358 return -EINVAL; 359 360 ret = nla_parse_nested(attrs, OVPN_A_PEER_MAX, info->attrs[OVPN_A_PEER], 361 ovpn_peer_new_input_nl_policy, info->extack); 362 if (ret) 363 return ret; 364 365 ret = ovpn_nl_peer_precheck(ovpn, info, attrs); 366 if (ret < 0) 367 return ret; 368 369 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_PEER], attrs, 370 OVPN_A_PEER_SOCKET)) 371 return -EINVAL; 372 373 /* in MP mode VPN IPs are required for selecting the right peer */ 374 if (ovpn->mode == OVPN_MODE_MP && !attrs[OVPN_A_PEER_VPN_IPV4] && 375 !attrs[OVPN_A_PEER_VPN_IPV6]) { 376 NL_SET_ERR_MSG_FMT_MOD(info->extack, 377 "VPN IP must be provided in MP mode"); 378 return -EINVAL; 379 } 380 381 peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]); 382 383 peer = ovpn_peer_new(ovpn, peer_id); 384 if (IS_ERR(peer)) { 385 NL_SET_ERR_MSG_FMT_MOD(info->extack, 386 "cannot create new peer object for peer %u: %ld", 387 peer_id, PTR_ERR(peer)); 388 return PTR_ERR(peer); 389 } 390 391 /* lookup the fd in the kernel table and extract the socket object */ 392 sockfd = nla_get_u32(attrs[OVPN_A_PEER_SOCKET]); 393 /* sockfd_lookup() increases sock's refcounter */ 394 sock = sockfd_lookup(sockfd, &ret); 395 if (!sock) { 396 NL_SET_ERR_MSG_FMT_MOD(info->extack, 397 "cannot lookup peer socket (fd=%u): %d", 398 sockfd, ret); 399 ret = -ENOTSOCK; 400 goto peer_release; 401 } 402 403 /* Only when using UDP as transport protocol the remote endpoint 404 * can be configured so that ovpn knows where to send packets to. 405 */ 406 if (sock->sk->sk_protocol == IPPROTO_UDP && 407 !attrs[OVPN_A_PEER_REMOTE_IPV4] && 408 !attrs[OVPN_A_PEER_REMOTE_IPV6]) { 409 NL_SET_ERR_MSG_FMT_MOD(info->extack, 410 "missing remote IP address for UDP socket"); 411 sockfd_put(sock); 412 ret = -EINVAL; 413 goto peer_release; 414 } 415 416 /* In case of TCP, the socket is connected to the peer and ovpn 417 * will just send bytes over it, without the need to specify a 418 * destination. 419 */ 420 if (sock->sk->sk_protocol == IPPROTO_TCP && 421 (attrs[OVPN_A_PEER_REMOTE_IPV4] || 422 attrs[OVPN_A_PEER_REMOTE_IPV6])) { 423 NL_SET_ERR_MSG_FMT_MOD(info->extack, 424 "unexpected remote IP address with TCP socket"); 425 sockfd_put(sock); 426 ret = -EINVAL; 427 goto peer_release; 428 } 429 430 ovpn_sock = ovpn_socket_new(sock, peer); 431 /* at this point we unconditionally drop the reference to the socket: 432 * - in case of error, the socket has to be dropped 433 * - if case of success, the socket is configured and let 434 * userspace own the reference, so that the latter can 435 * trigger the final close() 436 */ 437 sockfd_put(sock); 438 if (IS_ERR(ovpn_sock)) { 439 NL_SET_ERR_MSG_FMT_MOD(info->extack, 440 "cannot encapsulate socket: %ld", 441 PTR_ERR(ovpn_sock)); 442 ret = -ENOTSOCK; 443 goto peer_release; 444 } 445 446 rcu_assign_pointer(peer->sock, ovpn_sock); 447 448 ret = ovpn_nl_peer_modify(peer, info, attrs); 449 if (ret < 0) 450 goto sock_release; 451 452 ret = ovpn_peer_add(ovpn, peer); 453 if (ret < 0) { 454 NL_SET_ERR_MSG_FMT_MOD(info->extack, 455 "cannot add new peer (id=%u) to hashtable: %d", 456 peer->id, ret); 457 goto sock_release; 458 } 459 460 return 0; 461 462 sock_release: 463 ovpn_socket_release(peer); 464 peer_release: 465 /* For UDP, the peer is unreachable until added to the hashtables, so 466 * dropping the initial reference is enough. For TCP, the peer may be 467 * concurrently reachable via sk_user_data->peer until 468 * ovpn_socket_release() detaches; rely on the refcount. 469 */ 470 ovpn_peer_put(peer); 471 472 return ret; 473 } 474 475 int ovpn_nl_peer_set_doit(struct sk_buff *skb, struct genl_info *info) 476 { 477 struct nlattr *attrs[OVPN_A_PEER_MAX + 1]; 478 struct ovpn_priv *ovpn = info->user_ptr[0]; 479 struct ovpn_socket *sock; 480 struct ovpn_peer *peer; 481 u32 peer_id; 482 int ret; 483 484 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_PEER)) 485 return -EINVAL; 486 487 ret = nla_parse_nested(attrs, OVPN_A_PEER_MAX, info->attrs[OVPN_A_PEER], 488 ovpn_peer_set_input_nl_policy, info->extack); 489 if (ret) 490 return ret; 491 492 ret = ovpn_nl_peer_precheck(ovpn, info, attrs); 493 if (ret < 0) 494 return ret; 495 496 if (attrs[OVPN_A_PEER_SOCKET]) { 497 NL_SET_ERR_MSG_FMT_MOD(info->extack, 498 "socket cannot be modified"); 499 return -EINVAL; 500 } 501 502 peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]); 503 peer = ovpn_peer_get_by_id(ovpn, peer_id); 504 if (!peer) { 505 NL_SET_ERR_MSG_FMT_MOD(info->extack, 506 "cannot find peer with id %u", peer_id); 507 return -ENOENT; 508 } 509 510 /* when using a TCP socket the remote IP is not expected */ 511 rcu_read_lock(); 512 sock = rcu_dereference(peer->sock); 513 if (sock && sock->sk->sk_protocol == IPPROTO_TCP && 514 (attrs[OVPN_A_PEER_REMOTE_IPV4] || 515 attrs[OVPN_A_PEER_REMOTE_IPV6])) { 516 rcu_read_unlock(); 517 NL_SET_ERR_MSG_FMT_MOD(info->extack, 518 "unexpected remote IP address with TCP socket"); 519 ovpn_peer_put(peer); 520 return -EINVAL; 521 } 522 rcu_read_unlock(); 523 524 spin_lock_bh(&ovpn->lock); 525 ret = ovpn_nl_peer_modify(peer, info, attrs); 526 if (ret < 0) { 527 spin_unlock_bh(&ovpn->lock); 528 ovpn_peer_put(peer); 529 return ret; 530 } 531 532 /* ret == 1 means that VPN IPv4/6 has been modified and rehashing 533 * is required 534 */ 535 if (ret > 0) 536 ovpn_peer_hash_vpn_ip(peer); 537 /* if the remote endpoint was updated, the by_transp_addr hash bucket 538 * also needs to be refreshed, otherwise incoming packets from the new 539 * remote address would fail the lockless lookup 540 */ 541 if (attrs[OVPN_A_PEER_REMOTE_IPV4] || attrs[OVPN_A_PEER_REMOTE_IPV6]) 542 ovpn_peer_hash_transp_addr(peer); 543 spin_unlock_bh(&ovpn->lock); 544 ovpn_peer_put(peer); 545 546 return 0; 547 } 548 549 static int ovpn_nl_send_peer(struct sk_buff *skb, const struct genl_info *info, 550 const struct ovpn_peer *peer, u32 portid, u32 seq, 551 int flags) 552 { 553 const struct ovpn_bind *bind; 554 struct ovpn_socket *sock; 555 int ret = -EMSGSIZE; 556 struct nlattr *attr; 557 __be16 local_port; 558 void *hdr; 559 int id; 560 561 hdr = genlmsg_put(skb, portid, seq, &ovpn_nl_family, flags, 562 OVPN_CMD_PEER_GET); 563 if (!hdr) 564 return -ENOBUFS; 565 566 attr = nla_nest_start(skb, OVPN_A_PEER); 567 if (!attr) 568 goto err; 569 570 rcu_read_lock(); 571 sock = rcu_dereference(peer->sock); 572 if (!sock) { 573 ret = -EINVAL; 574 goto err_unlock; 575 } 576 577 if (!net_eq(genl_info_net(info), sock_net(sock->sk))) { 578 id = peernet2id_alloc(genl_info_net(info), 579 sock_net(sock->sk), 580 GFP_ATOMIC); 581 if (nla_put_s32(skb, OVPN_A_PEER_SOCKET_NETNSID, id)) 582 goto err_unlock; 583 } 584 local_port = inet_sk(sock->sk)->inet_sport; 585 rcu_read_unlock(); 586 587 if (nla_put_u32(skb, OVPN_A_PEER_ID, peer->id)) 588 goto err; 589 590 if (nla_put_u32(skb, OVPN_A_PEER_TX_ID, peer->tx_id)) 591 goto err; 592 593 if (peer->vpn_addrs.ipv4.s_addr != htonl(INADDR_ANY)) 594 if (nla_put_in_addr(skb, OVPN_A_PEER_VPN_IPV4, 595 peer->vpn_addrs.ipv4.s_addr)) 596 goto err; 597 598 if (!ipv6_addr_equal(&peer->vpn_addrs.ipv6, &in6addr_any)) 599 if (nla_put_in6_addr(skb, OVPN_A_PEER_VPN_IPV6, 600 &peer->vpn_addrs.ipv6)) 601 goto err; 602 603 if (nla_put_u32(skb, OVPN_A_PEER_KEEPALIVE_INTERVAL, 604 peer->keepalive_interval) || 605 nla_put_u32(skb, OVPN_A_PEER_KEEPALIVE_TIMEOUT, 606 peer->keepalive_timeout)) 607 goto err; 608 609 rcu_read_lock(); 610 bind = rcu_dereference(peer->bind); 611 if (bind) { 612 if (bind->remote.in4.sin_family == AF_INET) { 613 if (nla_put_in_addr(skb, OVPN_A_PEER_REMOTE_IPV4, 614 bind->remote.in4.sin_addr.s_addr) || 615 nla_put_net16(skb, OVPN_A_PEER_REMOTE_PORT, 616 bind->remote.in4.sin_port) || 617 nla_put_in_addr(skb, OVPN_A_PEER_LOCAL_IPV4, 618 bind->local.ipv4.s_addr)) 619 goto err_unlock; 620 } else if (bind->remote.in4.sin_family == AF_INET6) { 621 if (nla_put_in6_addr(skb, OVPN_A_PEER_REMOTE_IPV6, 622 &bind->remote.in6.sin6_addr) || 623 nla_put_u32(skb, OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID, 624 bind->remote.in6.sin6_scope_id) || 625 nla_put_net16(skb, OVPN_A_PEER_REMOTE_PORT, 626 bind->remote.in6.sin6_port) || 627 nla_put_in6_addr(skb, OVPN_A_PEER_LOCAL_IPV6, 628 &bind->local.ipv6)) 629 goto err_unlock; 630 } 631 } 632 rcu_read_unlock(); 633 634 if (nla_put_net16(skb, OVPN_A_PEER_LOCAL_PORT, local_port) || 635 /* VPN RX stats */ 636 nla_put_uint(skb, OVPN_A_PEER_VPN_RX_BYTES, 637 atomic64_read(&peer->vpn_stats.rx.bytes)) || 638 nla_put_uint(skb, OVPN_A_PEER_VPN_RX_PACKETS, 639 atomic64_read(&peer->vpn_stats.rx.packets)) || 640 /* VPN TX stats */ 641 nla_put_uint(skb, OVPN_A_PEER_VPN_TX_BYTES, 642 atomic64_read(&peer->vpn_stats.tx.bytes)) || 643 nla_put_uint(skb, OVPN_A_PEER_VPN_TX_PACKETS, 644 atomic64_read(&peer->vpn_stats.tx.packets)) || 645 /* link RX stats */ 646 nla_put_uint(skb, OVPN_A_PEER_LINK_RX_BYTES, 647 atomic64_read(&peer->link_stats.rx.bytes)) || 648 nla_put_uint(skb, OVPN_A_PEER_LINK_RX_PACKETS, 649 atomic64_read(&peer->link_stats.rx.packets)) || 650 /* link TX stats */ 651 nla_put_uint(skb, OVPN_A_PEER_LINK_TX_BYTES, 652 atomic64_read(&peer->link_stats.tx.bytes)) || 653 nla_put_uint(skb, OVPN_A_PEER_LINK_TX_PACKETS, 654 atomic64_read(&peer->link_stats.tx.packets))) 655 goto err; 656 657 nla_nest_end(skb, attr); 658 genlmsg_end(skb, hdr); 659 660 return 0; 661 err_unlock: 662 rcu_read_unlock(); 663 err: 664 genlmsg_cancel(skb, hdr); 665 return ret; 666 } 667 668 int ovpn_nl_peer_get_doit(struct sk_buff *skb, struct genl_info *info) 669 { 670 struct nlattr *attrs[OVPN_A_PEER_MAX + 1]; 671 struct ovpn_priv *ovpn = info->user_ptr[0]; 672 struct ovpn_peer *peer; 673 struct sk_buff *msg; 674 u32 peer_id; 675 int ret, i; 676 677 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_PEER)) 678 return -EINVAL; 679 680 ret = nla_parse_nested(attrs, OVPN_A_PEER_MAX, info->attrs[OVPN_A_PEER], 681 ovpn_peer_nl_policy, info->extack); 682 if (ret) 683 return ret; 684 685 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_PEER], attrs, 686 OVPN_A_PEER_ID)) 687 return -EINVAL; 688 689 /* OVPN_CMD_PEER_GET expects only the PEER_ID, therefore 690 * ensure that the user hasn't specified any other attribute. 691 * 692 * Unfortunately this check cannot be performed via netlink 693 * spec/policy and must be open-coded. 694 */ 695 for (i = 0; i < OVPN_A_PEER_MAX + 1; i++) { 696 if (i == OVPN_A_PEER_ID) 697 continue; 698 699 if (attrs[i]) { 700 NL_SET_ERR_MSG_FMT_MOD(info->extack, 701 "unexpected attribute %u", i); 702 return -EINVAL; 703 } 704 } 705 706 peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]); 707 peer = ovpn_peer_get_by_id(ovpn, peer_id); 708 if (!peer) { 709 NL_SET_ERR_MSG_FMT_MOD(info->extack, 710 "cannot find peer with id %u", peer_id); 711 return -ENOENT; 712 } 713 714 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 715 if (!msg) { 716 ret = -ENOMEM; 717 goto err; 718 } 719 720 ret = ovpn_nl_send_peer(msg, info, peer, info->snd_portid, 721 info->snd_seq, 0); 722 if (ret < 0) { 723 nlmsg_free(msg); 724 goto err; 725 } 726 727 ret = genlmsg_reply(msg, info); 728 err: 729 ovpn_peer_put(peer); 730 return ret; 731 } 732 733 int ovpn_nl_peer_get_dumpit(struct sk_buff *skb, struct netlink_callback *cb) 734 { 735 const struct genl_info *info = genl_info_dump(cb); 736 int bkt, last_idx = cb->args[1], dumped = 0; 737 netdevice_tracker tracker; 738 struct ovpn_priv *ovpn; 739 struct ovpn_peer *peer; 740 741 ovpn = ovpn_get_dev_from_attrs(sock_net(cb->skb->sk), info, &tracker); 742 if (IS_ERR(ovpn)) 743 return PTR_ERR(ovpn); 744 745 if (ovpn->mode == OVPN_MODE_P2P) { 746 /* if we already dumped a peer it means we are done */ 747 if (last_idx) 748 goto out; 749 750 rcu_read_lock(); 751 peer = rcu_dereference(ovpn->peer); 752 if (peer) { 753 if (ovpn_nl_send_peer(skb, info, peer, 754 NETLINK_CB(cb->skb).portid, 755 cb->nlh->nlmsg_seq, 756 NLM_F_MULTI) == 0) 757 dumped++; 758 } 759 rcu_read_unlock(); 760 } else { 761 rcu_read_lock(); 762 hash_for_each_rcu(ovpn->peers->by_id, bkt, peer, 763 hash_entry_id) { 764 /* skip already dumped peers that were dumped by 765 * previous invocations 766 */ 767 if (last_idx > 0) { 768 last_idx--; 769 continue; 770 } 771 772 if (ovpn_nl_send_peer(skb, info, peer, 773 NETLINK_CB(cb->skb).portid, 774 cb->nlh->nlmsg_seq, 775 NLM_F_MULTI) < 0) 776 break; 777 778 /* count peers being dumped during this invocation */ 779 dumped++; 780 } 781 rcu_read_unlock(); 782 } 783 784 out: 785 netdev_put(ovpn->dev, &tracker); 786 787 /* sum up peers dumped in this message, so that at the next invocation 788 * we can continue from where we left 789 */ 790 cb->args[1] += dumped; 791 return skb->len; 792 } 793 794 int ovpn_nl_peer_del_doit(struct sk_buff *skb, struct genl_info *info) 795 { 796 struct nlattr *attrs[OVPN_A_PEER_MAX + 1]; 797 struct ovpn_priv *ovpn = info->user_ptr[0]; 798 struct ovpn_peer *peer; 799 u32 peer_id; 800 int ret; 801 802 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_PEER)) 803 return -EINVAL; 804 805 ret = nla_parse_nested(attrs, OVPN_A_PEER_MAX, info->attrs[OVPN_A_PEER], 806 ovpn_peer_del_input_nl_policy, info->extack); 807 if (ret) 808 return ret; 809 810 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_PEER], attrs, 811 OVPN_A_PEER_ID)) 812 return -EINVAL; 813 814 peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]); 815 peer = ovpn_peer_get_by_id(ovpn, peer_id); 816 if (!peer) { 817 NL_SET_ERR_MSG_FMT_MOD(info->extack, 818 "cannot find peer with id %u", peer_id); 819 return -ENOENT; 820 } 821 822 netdev_dbg(ovpn->dev, "del peer %u\n", peer->id); 823 ret = ovpn_peer_del(peer, OVPN_DEL_PEER_REASON_USERSPACE); 824 ovpn_peer_put(peer); 825 826 return ret; 827 } 828 829 static int ovpn_nl_get_key_dir(struct genl_info *info, struct nlattr *key, 830 enum ovpn_cipher_alg cipher, 831 struct ovpn_key_direction *dir) 832 { 833 struct nlattr *attrs[OVPN_A_KEYDIR_MAX + 1]; 834 int ret; 835 836 ret = nla_parse_nested(attrs, OVPN_A_KEYDIR_MAX, key, 837 ovpn_keydir_nl_policy, info->extack); 838 if (ret) 839 return ret; 840 841 switch (cipher) { 842 case OVPN_CIPHER_ALG_AES_GCM: 843 case OVPN_CIPHER_ALG_CHACHA20_POLY1305: 844 if (NL_REQ_ATTR_CHECK(info->extack, key, attrs, 845 OVPN_A_KEYDIR_CIPHER_KEY) || 846 NL_REQ_ATTR_CHECK(info->extack, key, attrs, 847 OVPN_A_KEYDIR_NONCE_TAIL)) 848 return -EINVAL; 849 850 dir->cipher_key = nla_data(attrs[OVPN_A_KEYDIR_CIPHER_KEY]); 851 dir->cipher_key_size = nla_len(attrs[OVPN_A_KEYDIR_CIPHER_KEY]); 852 853 /* These algorithms require a 96bit nonce, 854 * Construct it by combining 4-bytes packet id and 855 * 8-bytes nonce-tail from userspace 856 */ 857 dir->nonce_tail = nla_data(attrs[OVPN_A_KEYDIR_NONCE_TAIL]); 858 dir->nonce_tail_size = nla_len(attrs[OVPN_A_KEYDIR_NONCE_TAIL]); 859 break; 860 default: 861 NL_SET_ERR_MSG_MOD(info->extack, "unsupported cipher"); 862 return -EINVAL; 863 } 864 865 return 0; 866 } 867 868 /** 869 * ovpn_nl_key_new_doit - configure a new key for the specified peer 870 * @skb: incoming netlink message 871 * @info: genetlink metadata 872 * 873 * This function allows the user to install a new key in the peer crypto 874 * state. 875 * Each peer has two 'slots', namely 'primary' and 'secondary', where 876 * keys can be installed. The key in the 'primary' slot is used for 877 * encryption, while both keys can be used for decryption by matching the 878 * key ID carried in the incoming packet. 879 * 880 * The user is responsible for rotating keys when necessary. The user 881 * may fetch peer traffic statistics via netlink in order to better 882 * identify the right time to rotate keys. 883 * The renegotiation follows these steps: 884 * 1. a new key is computed by the user and is installed in the 'secondary' 885 * slot 886 * 2. at user discretion (usually after a predetermined time) 'primary' and 887 * 'secondary' contents are swapped and the new key starts being used for 888 * encryption, while the old key is kept around for decryption of late 889 * packets. 890 * 891 * Return: 0 on success or a negative error code otherwise. 892 */ 893 int ovpn_nl_key_new_doit(struct sk_buff *skb, struct genl_info *info) 894 { 895 struct nlattr *attrs[OVPN_A_KEYCONF_MAX + 1]; 896 struct ovpn_priv *ovpn = info->user_ptr[0]; 897 struct ovpn_peer_key_reset pkr; 898 struct ovpn_peer *peer; 899 u32 peer_id; 900 int ret; 901 902 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF)) 903 return -EINVAL; 904 905 ret = nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX, 906 info->attrs[OVPN_A_KEYCONF], 907 ovpn_keyconf_nl_policy, info->extack); 908 if (ret) 909 return ret; 910 911 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, 912 OVPN_A_KEYCONF_PEER_ID)) 913 return -EINVAL; 914 915 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, 916 OVPN_A_KEYCONF_SLOT) || 917 NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, 918 OVPN_A_KEYCONF_KEY_ID) || 919 NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, 920 OVPN_A_KEYCONF_CIPHER_ALG) || 921 NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, 922 OVPN_A_KEYCONF_ENCRYPT_DIR) || 923 NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, 924 OVPN_A_KEYCONF_DECRYPT_DIR)) 925 return -EINVAL; 926 927 pkr.slot = nla_get_u32(attrs[OVPN_A_KEYCONF_SLOT]); 928 pkr.key.key_id = nla_get_u32(attrs[OVPN_A_KEYCONF_KEY_ID]); 929 pkr.key.cipher_alg = nla_get_u32(attrs[OVPN_A_KEYCONF_CIPHER_ALG]); 930 931 ret = ovpn_nl_get_key_dir(info, attrs[OVPN_A_KEYCONF_ENCRYPT_DIR], 932 pkr.key.cipher_alg, &pkr.key.encrypt); 933 if (ret < 0) 934 return ret; 935 936 ret = ovpn_nl_get_key_dir(info, attrs[OVPN_A_KEYCONF_DECRYPT_DIR], 937 pkr.key.cipher_alg, &pkr.key.decrypt); 938 if (ret < 0) 939 return ret; 940 941 peer_id = nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]); 942 peer = ovpn_peer_get_by_id(ovpn, peer_id); 943 if (!peer) { 944 NL_SET_ERR_MSG_FMT_MOD(info->extack, 945 "no peer with id %u to set key for", 946 peer_id); 947 return -ENOENT; 948 } 949 950 ret = ovpn_crypto_state_reset(&peer->crypto, &pkr); 951 if (ret < 0) { 952 NL_SET_ERR_MSG_FMT_MOD(info->extack, 953 "cannot install new key for peer %u", 954 peer_id); 955 goto out; 956 } 957 958 netdev_dbg(ovpn->dev, "new key installed (id=%u) for peer %u\n", 959 pkr.key.key_id, peer_id); 960 out: 961 ovpn_peer_put(peer); 962 return ret; 963 } 964 965 static int ovpn_nl_send_key(struct sk_buff *skb, const struct genl_info *info, 966 u32 peer_id, enum ovpn_key_slot slot, 967 const struct ovpn_key_config *keyconf) 968 { 969 struct nlattr *attr; 970 void *hdr; 971 972 hdr = genlmsg_put(skb, info->snd_portid, info->snd_seq, &ovpn_nl_family, 973 0, OVPN_CMD_KEY_GET); 974 if (!hdr) 975 return -ENOBUFS; 976 977 attr = nla_nest_start(skb, OVPN_A_KEYCONF); 978 if (!attr) 979 goto err; 980 981 if (nla_put_u32(skb, OVPN_A_KEYCONF_PEER_ID, peer_id)) 982 goto err; 983 984 if (nla_put_u32(skb, OVPN_A_KEYCONF_SLOT, slot) || 985 nla_put_u32(skb, OVPN_A_KEYCONF_KEY_ID, keyconf->key_id) || 986 nla_put_u32(skb, OVPN_A_KEYCONF_CIPHER_ALG, keyconf->cipher_alg)) 987 goto err; 988 989 nla_nest_end(skb, attr); 990 genlmsg_end(skb, hdr); 991 992 return 0; 993 err: 994 genlmsg_cancel(skb, hdr); 995 return -EMSGSIZE; 996 } 997 998 int ovpn_nl_key_get_doit(struct sk_buff *skb, struct genl_info *info) 999 { 1000 struct nlattr *attrs[OVPN_A_KEYCONF_MAX + 1]; 1001 struct ovpn_priv *ovpn = info->user_ptr[0]; 1002 struct ovpn_key_config keyconf = { 0 }; 1003 enum ovpn_key_slot slot; 1004 struct ovpn_peer *peer; 1005 struct sk_buff *msg; 1006 u32 peer_id; 1007 int ret, i; 1008 1009 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF)) 1010 return -EINVAL; 1011 1012 ret = nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX, 1013 info->attrs[OVPN_A_KEYCONF], 1014 ovpn_keyconf_get_nl_policy, info->extack); 1015 if (ret) 1016 return ret; 1017 1018 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, 1019 OVPN_A_KEYCONF_PEER_ID)) 1020 return -EINVAL; 1021 1022 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, 1023 OVPN_A_KEYCONF_SLOT)) 1024 return -EINVAL; 1025 1026 /* OVPN_CMD_KEY_GET expects only the PEER_ID and the SLOT, therefore 1027 * ensure that the user hasn't specified any other attribute. 1028 * 1029 * Unfortunately this check cannot be performed via netlink 1030 * spec/policy and must be open-coded. 1031 */ 1032 for (i = 0; i < OVPN_A_KEYCONF_MAX + 1; i++) { 1033 if (i == OVPN_A_KEYCONF_PEER_ID || 1034 i == OVPN_A_KEYCONF_SLOT) 1035 continue; 1036 1037 if (attrs[i]) { 1038 NL_SET_ERR_MSG_FMT_MOD(info->extack, 1039 "unexpected attribute %u", i); 1040 return -EINVAL; 1041 } 1042 } 1043 1044 peer_id = nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]); 1045 peer = ovpn_peer_get_by_id(ovpn, peer_id); 1046 if (!peer) { 1047 NL_SET_ERR_MSG_FMT_MOD(info->extack, 1048 "cannot find peer with id %u", peer_id); 1049 return -ENOENT; 1050 } 1051 1052 slot = nla_get_u32(attrs[OVPN_A_KEYCONF_SLOT]); 1053 1054 ret = ovpn_crypto_config_get(&peer->crypto, slot, &keyconf); 1055 if (ret < 0) { 1056 NL_SET_ERR_MSG_FMT_MOD(info->extack, 1057 "cannot extract key from slot %u for peer %u", 1058 slot, peer_id); 1059 goto err; 1060 } 1061 1062 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 1063 if (!msg) { 1064 ret = -ENOMEM; 1065 goto err; 1066 } 1067 1068 ret = ovpn_nl_send_key(msg, info, peer->id, slot, &keyconf); 1069 if (ret < 0) { 1070 nlmsg_free(msg); 1071 goto err; 1072 } 1073 1074 ret = genlmsg_reply(msg, info); 1075 err: 1076 ovpn_peer_put(peer); 1077 return ret; 1078 } 1079 1080 int ovpn_nl_key_swap_doit(struct sk_buff *skb, struct genl_info *info) 1081 { 1082 struct nlattr *attrs[OVPN_A_KEYCONF_MAX + 1]; 1083 struct ovpn_priv *ovpn = info->user_ptr[0]; 1084 struct ovpn_peer *peer; 1085 u32 peer_id; 1086 int ret; 1087 1088 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF)) 1089 return -EINVAL; 1090 1091 ret = nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX, 1092 info->attrs[OVPN_A_KEYCONF], 1093 ovpn_keyconf_swap_input_nl_policy, info->extack); 1094 if (ret) 1095 return ret; 1096 1097 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, 1098 OVPN_A_KEYCONF_PEER_ID)) 1099 return -EINVAL; 1100 1101 peer_id = nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]); 1102 peer = ovpn_peer_get_by_id(ovpn, peer_id); 1103 if (!peer) { 1104 NL_SET_ERR_MSG_FMT_MOD(info->extack, 1105 "no peer with id %u to swap keys for", 1106 peer_id); 1107 return -ENOENT; 1108 } 1109 1110 ovpn_crypto_key_slots_swap(&peer->crypto); 1111 ovpn_peer_put(peer); 1112 1113 return 0; 1114 } 1115 1116 int ovpn_nl_key_del_doit(struct sk_buff *skb, struct genl_info *info) 1117 { 1118 struct nlattr *attrs[OVPN_A_KEYCONF_MAX + 1]; 1119 struct ovpn_priv *ovpn = info->user_ptr[0]; 1120 enum ovpn_key_slot slot; 1121 struct ovpn_peer *peer; 1122 u32 peer_id; 1123 int ret; 1124 1125 if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF)) 1126 return -EINVAL; 1127 1128 ret = nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX, 1129 info->attrs[OVPN_A_KEYCONF], 1130 ovpn_keyconf_del_input_nl_policy, info->extack); 1131 if (ret) 1132 return ret; 1133 1134 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, 1135 OVPN_A_KEYCONF_PEER_ID)) 1136 return -EINVAL; 1137 1138 if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, 1139 OVPN_A_KEYCONF_SLOT)) 1140 return -EINVAL; 1141 1142 peer_id = nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]); 1143 slot = nla_get_u32(attrs[OVPN_A_KEYCONF_SLOT]); 1144 1145 peer = ovpn_peer_get_by_id(ovpn, peer_id); 1146 if (!peer) { 1147 NL_SET_ERR_MSG_FMT_MOD(info->extack, 1148 "no peer with id %u to delete key for", 1149 peer_id); 1150 return -ENOENT; 1151 } 1152 1153 ovpn_crypto_key_slot_delete(&peer->crypto, slot); 1154 ovpn_peer_put(peer); 1155 1156 return 0; 1157 } 1158 1159 /** 1160 * ovpn_nl_peer_del_notify - notify userspace about peer being deleted 1161 * @peer: the peer being deleted 1162 * 1163 * Return: 0 on success or a negative error code otherwise 1164 */ 1165 int ovpn_nl_peer_del_notify(struct ovpn_peer *peer) 1166 { 1167 struct ovpn_socket *sock; 1168 struct sk_buff *msg; 1169 struct nlattr *attr; 1170 int ret = -EMSGSIZE; 1171 void *hdr; 1172 1173 netdev_info(peer->ovpn->dev, "deleting peer with id %u, reason %d\n", 1174 peer->id, peer->delete_reason); 1175 1176 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 1177 if (!msg) 1178 return -ENOMEM; 1179 1180 hdr = genlmsg_put(msg, 0, 0, &ovpn_nl_family, 0, OVPN_CMD_PEER_DEL_NTF); 1181 if (!hdr) { 1182 ret = -ENOBUFS; 1183 goto err_free_msg; 1184 } 1185 1186 if (nla_put_u32(msg, OVPN_A_IFINDEX, peer->ovpn->dev->ifindex)) 1187 goto err_cancel_msg; 1188 1189 attr = nla_nest_start(msg, OVPN_A_PEER); 1190 if (!attr) 1191 goto err_cancel_msg; 1192 1193 if (nla_put_u32(msg, OVPN_A_PEER_DEL_REASON, peer->delete_reason)) 1194 goto err_cancel_msg; 1195 1196 if (nla_put_u32(msg, OVPN_A_PEER_ID, peer->id)) 1197 goto err_cancel_msg; 1198 1199 nla_nest_end(msg, attr); 1200 1201 genlmsg_end(msg, hdr); 1202 1203 rcu_read_lock(); 1204 sock = rcu_dereference(peer->sock); 1205 if (!sock) { 1206 ret = -EINVAL; 1207 goto err_unlock; 1208 } 1209 genlmsg_multicast_netns(&ovpn_nl_family, sock_net(sock->sk), msg, 0, 1210 OVPN_NLGRP_PEERS, GFP_ATOMIC); 1211 rcu_read_unlock(); 1212 1213 return 0; 1214 1215 err_unlock: 1216 rcu_read_unlock(); 1217 err_cancel_msg: 1218 genlmsg_cancel(msg, hdr); 1219 err_free_msg: 1220 nlmsg_free(msg); 1221 return ret; 1222 } 1223 1224 /** 1225 * ovpn_nl_peer_float_notify - notify userspace about peer floating 1226 * @peer: the floated peer 1227 * @ss: sockaddr representing the new remote endpoint 1228 * 1229 * Return: 0 on success or a negative error code otherwise 1230 */ 1231 int ovpn_nl_peer_float_notify(struct ovpn_peer *peer, 1232 const struct sockaddr_storage *ss) 1233 { 1234 struct ovpn_socket *sock; 1235 struct sockaddr_in6 *sa6; 1236 struct sockaddr_in *sa; 1237 struct sk_buff *msg; 1238 struct nlattr *attr; 1239 int ret = -EMSGSIZE; 1240 void *hdr; 1241 1242 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 1243 if (!msg) 1244 return -ENOMEM; 1245 1246 hdr = genlmsg_put(msg, 0, 0, &ovpn_nl_family, 0, 1247 OVPN_CMD_PEER_FLOAT_NTF); 1248 if (!hdr) { 1249 ret = -ENOBUFS; 1250 goto err_free_msg; 1251 } 1252 1253 if (nla_put_u32(msg, OVPN_A_IFINDEX, peer->ovpn->dev->ifindex)) 1254 goto err_cancel_msg; 1255 1256 attr = nla_nest_start(msg, OVPN_A_PEER); 1257 if (!attr) 1258 goto err_cancel_msg; 1259 1260 if (nla_put_u32(msg, OVPN_A_PEER_ID, peer->id)) 1261 goto err_cancel_msg; 1262 1263 if (ss->ss_family == AF_INET) { 1264 sa = (struct sockaddr_in *)ss; 1265 if (nla_put_in_addr(msg, OVPN_A_PEER_REMOTE_IPV4, 1266 sa->sin_addr.s_addr) || 1267 nla_put_net16(msg, OVPN_A_PEER_REMOTE_PORT, sa->sin_port)) 1268 goto err_cancel_msg; 1269 } else if (ss->ss_family == AF_INET6) { 1270 sa6 = (struct sockaddr_in6 *)ss; 1271 if (nla_put_in6_addr(msg, OVPN_A_PEER_REMOTE_IPV6, 1272 &sa6->sin6_addr) || 1273 nla_put_u32(msg, OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID, 1274 sa6->sin6_scope_id) || 1275 nla_put_net16(msg, OVPN_A_PEER_REMOTE_PORT, sa6->sin6_port)) 1276 goto err_cancel_msg; 1277 } else { 1278 ret = -EAFNOSUPPORT; 1279 goto err_cancel_msg; 1280 } 1281 1282 nla_nest_end(msg, attr); 1283 genlmsg_end(msg, hdr); 1284 1285 rcu_read_lock(); 1286 sock = rcu_dereference(peer->sock); 1287 if (!sock) { 1288 ret = -EINVAL; 1289 goto err_unlock; 1290 } 1291 genlmsg_multicast_netns(&ovpn_nl_family, sock_net(sock->sk), msg, 1292 0, OVPN_NLGRP_PEERS, GFP_ATOMIC); 1293 rcu_read_unlock(); 1294 1295 return 0; 1296 1297 err_unlock: 1298 rcu_read_unlock(); 1299 err_cancel_msg: 1300 genlmsg_cancel(msg, hdr); 1301 err_free_msg: 1302 nlmsg_free(msg); 1303 return ret; 1304 } 1305 1306 /** 1307 * ovpn_nl_key_swap_notify - notify userspace peer's key must be renewed 1308 * @peer: the peer whose key needs to be renewed 1309 * @key_id: the ID of the key that needs to be renewed 1310 * 1311 * Return: 0 on success or a negative error code otherwise 1312 */ 1313 int ovpn_nl_key_swap_notify(struct ovpn_peer *peer, u8 key_id) 1314 { 1315 struct ovpn_socket *sock; 1316 struct nlattr *k_attr; 1317 struct sk_buff *msg; 1318 int ret = -EMSGSIZE; 1319 void *hdr; 1320 1321 netdev_info(peer->ovpn->dev, "peer with id %u must rekey - primary key unusable.\n", 1322 peer->id); 1323 1324 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 1325 if (!msg) 1326 return -ENOMEM; 1327 1328 hdr = genlmsg_put(msg, 0, 0, &ovpn_nl_family, 0, OVPN_CMD_KEY_SWAP_NTF); 1329 if (!hdr) { 1330 ret = -ENOBUFS; 1331 goto err_free_msg; 1332 } 1333 1334 if (nla_put_u32(msg, OVPN_A_IFINDEX, peer->ovpn->dev->ifindex)) 1335 goto err_cancel_msg; 1336 1337 k_attr = nla_nest_start(msg, OVPN_A_KEYCONF); 1338 if (!k_attr) 1339 goto err_cancel_msg; 1340 1341 if (nla_put_u32(msg, OVPN_A_KEYCONF_PEER_ID, peer->id)) 1342 goto err_cancel_msg; 1343 1344 if (nla_put_u16(msg, OVPN_A_KEYCONF_KEY_ID, key_id)) 1345 goto err_cancel_msg; 1346 1347 nla_nest_end(msg, k_attr); 1348 genlmsg_end(msg, hdr); 1349 1350 rcu_read_lock(); 1351 sock = rcu_dereference(peer->sock); 1352 if (!sock) { 1353 ret = -EINVAL; 1354 goto err_unlock; 1355 } 1356 genlmsg_multicast_netns(&ovpn_nl_family, sock_net(sock->sk), msg, 0, 1357 OVPN_NLGRP_PEERS, GFP_ATOMIC); 1358 rcu_read_unlock(); 1359 1360 return 0; 1361 err_unlock: 1362 rcu_read_unlock(); 1363 err_cancel_msg: 1364 genlmsg_cancel(msg, hdr); 1365 err_free_msg: 1366 nlmsg_free(msg); 1367 return ret; 1368 } 1369 1370 /** 1371 * ovpn_nl_register - perform any needed registration in the NL subsustem 1372 * 1373 * Return: 0 on success, a negative error code otherwise 1374 */ 1375 int __init ovpn_nl_register(void) 1376 { 1377 int ret = genl_register_family(&ovpn_nl_family); 1378 1379 if (ret) { 1380 pr_err("ovpn: genl_register_family failed: %d\n", ret); 1381 return ret; 1382 } 1383 1384 return 0; 1385 } 1386 1387 /** 1388 * ovpn_nl_unregister - undo any module wide netlink registration 1389 */ 1390 void ovpn_nl_unregister(void) 1391 { 1392 genl_unregister_family(&ovpn_nl_family); 1393 } 1394