From nobody Tue Nov 26 21:35:35 2024 Received: from mail-wr1-f44.google.com (mail-wr1-f44.google.com [209.85.221.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 284EC17333A for ; Wed, 16 Oct 2024 01:03:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729040631; cv=none; b=OG2d38ITsVdKb+r4RWyOANXYyTNNzL/5AIYXCjoqmQA9+h630B3dKaN9Ruv9St17Z2zRsgnajqBSElBzRV12hXJescOf/o9FGGFr3EseoXba4EdV4AU2ycexNFO5inZLMenluVYINIsVu/BYk6jgtyyYB/NAS3k+ZkWj57GBM14= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729040631; c=relaxed/simple; bh=NHB8DY+derJjmpIyfM7tZseTb7zJiJA5OcsJ97CZXUw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=DJwCchF/TGLMaB+TEaq0RW9jrdjHT3lXCCUe2ZoOmMheFLnwFb+4q8rqh4OdVNjOV5P553PEPI/6N1ZEJIqBDJyMLp+9Nbl8t+1h0IqZwOB4HxxIiby/xXmxkC2cQRTPOJJhPjMmf3i+C+y895XfMpKuKr1SVjWcYYTr4ELzETQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=openvpn.net; spf=pass smtp.mailfrom=openvpn.com; dkim=pass (2048-bit key) header.d=openvpn.net header.i=@openvpn.net header.b=GFlu8nDv; arc=none smtp.client-ip=209.85.221.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=openvpn.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=openvpn.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=openvpn.net header.i=@openvpn.net header.b="GFlu8nDv" Received: by mail-wr1-f44.google.com with SMTP id ffacd0b85a97d-37d447de11dso4299398f8f.1 for ; Tue, 15 Oct 2024 18:03:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvpn.net; s=google; t=1729040627; x=1729645427; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=TpOrbfvwpuTF+GzXl29fSyJFnaQGQgrW9YLo7vYL7GQ=; b=GFlu8nDvU8ym4plBpYObwfBr4GM3spg2bES1HO/BwJYswrvBowbKFrxJdDxRQjQ9fp km7DpQ/6cpSHJ0YijlO//V3fbfWPcg5zwykhjEcy1jrNb3vC4BXjRqoAd0EuSxnbljlD 2BHPwaayhxNdRoS08ySl871t9SAYa2BsEPuDti1wwzoHH+XT/xI47qrHI1+tVZms3M+5 Cv35I2X18UnTf2MVXSSavI/K1aLJ0XnP2In6syhUrVMott4lUq875g8N7Bb3B1ml3Iy/ 1Eyah+5J10I0ZeZz1dCZtCabGmXJTg7SJ9pniKNKdy7WsRAl+5NIBWjioJKlynX0ZzMH pBfA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1729040627; x=1729645427; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=TpOrbfvwpuTF+GzXl29fSyJFnaQGQgrW9YLo7vYL7GQ=; b=RzRAwVxQOkRRDLvc23utcP1tB7rOa9Kr+cwh9gVvPQu9DtOASJ1jykPqhihPm40eya cfokyWPQfLLdSYBTepyPYAKj527NpEK+ALU4duzEFUqhQA+0oLz7IG7LQUgIrfaqyrJH T15QsKSnkGearERuYqZ86LU5u9Z/+VEvOcvzP4LAnqvtDa9n4OaT+wcYxCW7O0siW9bb s4c3Mjv8bH4SCvCrcml9qImO7Xqb5kvPIXA1V86K46YJakNA38bO/jgbN+hZz/WhUfCy kzdLvz1HivOZUO+CFXp3oK5CC0FPhKFYKe2LCTKAIUZ07vqKI0S1pZDkhhJdWAi1H/O6 XSsw== X-Forwarded-Encrypted: i=1; AJvYcCUr4lz5MwKodht1igk+MG3KgKwyruPo5i+v0XuJwM0LCDkJpTCGPYYn9J4hGPbsZHHkTZ5rK8gmKzujiQ0=@vger.kernel.org X-Gm-Message-State: AOJu0YyoXQ3ClxuVrGGmQB55i17RQhBU0xTGwVMOXxgB74cyTRotzjm2 FzxhzaVlWLxUMva0q0HBs8IC0yu+9nNHhv4sOHAyfrVbWal9VtxnFMOKQdH1xxo= X-Google-Smtp-Source: AGHT+IEgRR0HXgj6AwjKVKrbrUdJxb6D024PWAiXC5w+HqbSHwJSYdWQwcdtZoxTbXfk5pochHjgrw== X-Received: by 2002:a05:6000:4f0:b0:37d:5103:e41d with SMTP id ffacd0b85a97d-37d5529f022mr12221314f8f.39.1729040627413; Tue, 15 Oct 2024 18:03:47 -0700 (PDT) Received: from serenity.mandelbit.com ([2001:67c:2fbc:1:4c1a:a7c8:72f5:4282]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-37d7fa8778csm2886765f8f.25.2024.10.15.18.03.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 15 Oct 2024 18:03:46 -0700 (PDT) From: Antonio Quartulli Date: Wed, 16 Oct 2024 03:03:04 +0200 Subject: [PATCH net-next v9 04/23] ovpn: add basic interface creation/destruction/management routines Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20241016-b4-ovpn-v9-4-aabe9d225ad5@openvpn.net> References: <20241016-b4-ovpn-v9-0-aabe9d225ad5@openvpn.net> In-Reply-To: <20241016-b4-ovpn-v9-0-aabe9d225ad5@openvpn.net> To: Eric Dumazet , Jakub Kicinski , Paolo Abeni , Donald Hunter , Antonio Quartulli , Shuah Khan , donald.hunter@gmail.com, sd@queasysnail.net, ryazanov.s.a@gmail.com, Andrew Lunn Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, openvpn-devel@lists.sourceforge.net, linux-kselftest@vger.kernel.org X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=8751; i=antonio@openvpn.net; h=from:subject:message-id; bh=NHB8DY+derJjmpIyfM7tZseTb7zJiJA5OcsJ97CZXUw=; b=owEBbQGS/pANAwAIAQtw5TqgONWHAcsmYgBnDxDuFjOrx4IReeKRet9RXdFXSQGkqN4aZo+2j qqOgfFZAHmJATMEAAEIAB0WIQSZq9xs+NQS5N5fwPwLcOU6oDjVhwUCZw8Q7gAKCRALcOU6oDjV h4odCACUq48RqG6cy5lVgzibosvcPAyXUBieDxMW+qI2uxJAn2m5t5jufQ+vk/Exx2DPo2k7pqD +AH+3ggnNjc70beVOXufRTvWTw11kL+yZjy1iFtcWdoLVsaRVHENxSMXmUUV/82yEjN3w5jA3U7 chKk4Vmd2p9CqcqATjeV6tQWQSQ/vadF0p2XkJuzjaWOXNNmbdNzIuji6NCWSwEmKXVIx/EDstQ yDR/o3O+qSHEeIhIuzpVD6pYDKtk9ksVsj6Uzosb8ImzdVGS5sH8/ABFwVCxh0cZISyxWz0Csjc 5UjWX11VBNSh5521K2BORkUhIt1u0LcmlgX7jDzvlIYheFlW X-Developer-Key: i=antonio@openvpn.net; a=openpgp; fpr=CABDA1282017C267219885C748F0CCB68F59D14C Add basic infrastructure for handling ovpn interfaces. Signed-off-by: Antonio Quartulli --- drivers/net/ovpn/main.c | 115 ++++++++++++++++++++++++++++++++++++++= ++-- drivers/net/ovpn/main.h | 7 +++ drivers/net/ovpn/ovpnstruct.h | 8 +++ drivers/net/ovpn/packet.h | 40 +++++++++++++++ include/uapi/linux/if_link.h | 15 ++++++ 5 files changed, 180 insertions(+), 5 deletions(-) diff --git a/drivers/net/ovpn/main.c b/drivers/net/ovpn/main.c index d5bdb0055f4dd3a6e32dc6e792bed1e7fd59e101..eead7677b8239eb3c48bb26ca95= 492d88512b8d4 100644 --- a/drivers/net/ovpn/main.c +++ b/drivers/net/ovpn/main.c @@ -10,18 +10,52 @@ #include #include #include +#include +#include #include -#include +#include =20 #include "ovpnstruct.h" #include "main.h" #include "netlink.h" #include "io.h" +#include "packet.h" =20 /* Driver info */ #define DRV_DESCRIPTION "OpenVPN data channel offload (ovpn)" #define DRV_COPYRIGHT "(C) 2020-2024 OpenVPN, Inc." =20 +static void ovpn_struct_free(struct net_device *net) +{ +} + +static int ovpn_net_open(struct net_device *dev) +{ + netif_tx_start_all_queues(dev); + return 0; +} + +static int ovpn_net_stop(struct net_device *dev) +{ + netif_tx_stop_all_queues(dev); + return 0; +} + +static const struct net_device_ops ovpn_netdev_ops =3D { + .ndo_open =3D ovpn_net_open, + .ndo_stop =3D ovpn_net_stop, + .ndo_start_xmit =3D ovpn_net_xmit, +}; + +static const struct device_type ovpn_type =3D { + .name =3D OVPN_FAMILY_NAME, +}; + +static const struct nla_policy ovpn_policy[IFLA_OVPN_MAX + 1] =3D { + [IFLA_OVPN_MODE] =3D NLA_POLICY_RANGE(NLA_U8, OVPN_MODE_P2P, + OVPN_MODE_MP), +}; + /** * ovpn_dev_is_valid - check if the netdevice is of type 'ovpn' * @dev: the interface to check @@ -33,16 +67,76 @@ bool ovpn_dev_is_valid(const struct net_device *dev) return dev->netdev_ops->ndo_start_xmit =3D=3D ovpn_net_xmit; } =20 +static void ovpn_setup(struct net_device *dev) +{ + /* compute the overhead considering AEAD encryption */ + const int overhead =3D sizeof(u32) + NONCE_WIRE_SIZE + 16 + + sizeof(struct udphdr) + + max(sizeof(struct ipv6hdr), sizeof(struct iphdr)); + + netdev_features_t feat =3D NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_RXCSUM | + NETIF_F_GSO | NETIF_F_GSO_SOFTWARE | + NETIF_F_HIGHDMA; + + dev->needs_free_netdev =3D true; + + dev->pcpu_stat_type =3D NETDEV_PCPU_STAT_TSTATS; + + dev->netdev_ops =3D &ovpn_netdev_ops; + + dev->priv_destructor =3D ovpn_struct_free; + + dev->hard_header_len =3D 0; + dev->addr_len =3D 0; + dev->mtu =3D ETH_DATA_LEN - overhead; + dev->min_mtu =3D IPV4_MIN_MTU; + dev->max_mtu =3D IP_MAX_MTU - overhead; + + dev->type =3D ARPHRD_NONE; + dev->flags =3D IFF_POINTOPOINT | IFF_NOARP; + dev->priv_flags |=3D IFF_NO_QUEUE; + + dev->lltx =3D true; + dev->features |=3D feat; + dev->hw_features |=3D feat; + dev->hw_enc_features |=3D feat; + + dev->needed_headroom =3D OVPN_HEAD_ROOM; + dev->needed_tailroom =3D OVPN_MAX_PADDING; + + SET_NETDEV_DEVTYPE(dev, &ovpn_type); +} + static int ovpn_newlink(struct net *src_net, struct net_device *dev, struct nlattr *tb[], struct nlattr *data[], struct netlink_ext_ack *extack) { - return -EOPNOTSUPP; + struct ovpn_struct *ovpn =3D netdev_priv(dev); + enum ovpn_mode mode =3D OVPN_MODE_P2P; + + if (data && data[IFLA_OVPN_MODE]) { + mode =3D nla_get_u8(data[IFLA_OVPN_MODE]); + netdev_dbg(dev, "setting device mode: %u\n", mode); + } + + ovpn->dev =3D dev; + ovpn->mode =3D mode; + + /* turn carrier explicitly off after registration, this way state is + * clearly defined + */ + netif_carrier_off(dev); + + return register_netdevice(dev); } =20 static struct rtnl_link_ops ovpn_link_ops =3D { .kind =3D OVPN_FAMILY_NAME, .netns_refund =3D false, + .priv_size =3D sizeof(struct ovpn_struct), + .setup =3D ovpn_setup, + .policy =3D ovpn_policy, + .maxtype =3D IFLA_OVPN_MAX, .newlink =3D ovpn_newlink, .dellink =3D unregister_netdevice_queue, }; @@ -51,26 +145,37 @@ static int ovpn_netdev_notifier_call(struct notifier_b= lock *nb, unsigned long state, void *ptr) { struct net_device *dev =3D netdev_notifier_info_to_dev(ptr); + struct ovpn_struct *ovpn; =20 if (!ovpn_dev_is_valid(dev)) return NOTIFY_DONE; =20 + ovpn =3D netdev_priv(dev); + switch (state) { case NETDEV_REGISTER: - /* add device to internal list for later destruction upon - * unregistration - */ + ovpn->registered =3D true; break; case NETDEV_UNREGISTER: + /* twiddle thumbs on netns device moves */ + if (dev->reg_state !=3D NETREG_UNREGISTERING) + break; + /* can be delivered multiple times, so check registered flag, * then destroy the interface */ + if (!ovpn->registered) + return NOTIFY_DONE; + + netif_carrier_off(dev); + ovpn->registered =3D false; break; case NETDEV_POST_INIT: case NETDEV_GOING_DOWN: case NETDEV_DOWN: case NETDEV_UP: case NETDEV_PRE_UP: + break; default: return NOTIFY_DONE; } diff --git a/drivers/net/ovpn/main.h b/drivers/net/ovpn/main.h index a3215316c49bfcdf2496590bac878f145b8b27fd..0740a05070a817e0daea7b63a1f= 4fcebd274eb37 100644 --- a/drivers/net/ovpn/main.h +++ b/drivers/net/ovpn/main.h @@ -12,4 +12,11 @@ =20 bool ovpn_dev_is_valid(const struct net_device *dev); =20 +#define SKB_HEADER_LEN \ + (max(sizeof(struct iphdr), sizeof(struct ipv6hdr)) + \ + sizeof(struct udphdr) + NET_SKB_PAD) + +#define OVPN_HEAD_ROOM ALIGN(16 + SKB_HEADER_LEN, 4) +#define OVPN_MAX_PADDING 16 + #endif /* _NET_OVPN_MAIN_H_ */ diff --git a/drivers/net/ovpn/ovpnstruct.h b/drivers/net/ovpn/ovpnstruct.h index e3e4df6418b081436378fc51d98db5bd7b5d1fbe..211df871538d34fdff90d182f21= a0b0fb11b28ad 100644 --- a/drivers/net/ovpn/ovpnstruct.h +++ b/drivers/net/ovpn/ovpnstruct.h @@ -11,15 +11,23 @@ #define _NET_OVPN_OVPNSTRUCT_H_ =20 #include +#include +#include =20 /** * struct ovpn_struct - per ovpn interface state * @dev: the actual netdev representing the tunnel * @dev_tracker: reference tracker for associated dev + * @registered: whether dev is still registered with netdev or not + * @mode: device operation mode (i.e. p2p, mp, ..) + * @dev_list: entry for the module wide device list */ struct ovpn_struct { struct net_device *dev; netdevice_tracker dev_tracker; + bool registered; + enum ovpn_mode mode; + struct list_head dev_list; }; =20 #endif /* _NET_OVPN_OVPNSTRUCT_H_ */ diff --git a/drivers/net/ovpn/packet.h b/drivers/net/ovpn/packet.h new file mode 100644 index 0000000000000000000000000000000000000000..7ed146f5932a25f448af6da5873= 8a7eae81007fe --- /dev/null +++ b/drivers/net/ovpn/packet.h @@ -0,0 +1,40 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* OpenVPN data channel offload + * + * Copyright (C) 2020-2024 OpenVPN, Inc. + * + * Author: Antonio Quartulli + * James Yonan + */ + +#ifndef _NET_OVPN_PACKET_H_ +#define _NET_OVPN_PACKET_H_ + +/* When the OpenVPN protocol is ran in AEAD mode, use + * the OpenVPN packet ID as the AEAD nonce: + * + * 00000005 521c3b01 4308c041 + * [seq # ] [ nonce_tail ] + * [ 12-byte full IV ] -> NONCE_SIZE + * [4-bytes -> NONCE_WIRE_SIZE + * on wire] + */ + +/* OpenVPN nonce size */ +#define NONCE_SIZE 12 + +/* OpenVPN nonce size reduced by 8-byte nonce tail -- this is the + * size of the AEAD Associated Data (AD) sent over the wire + * and is normally the head of the IV + */ +#define NONCE_WIRE_SIZE (NONCE_SIZE - sizeof(struct ovpn_nonce_tail)) + +/* Last 8 bytes of AEAD nonce + * Provided by userspace and usually derived from + * key material generated during TLS handshake + */ +struct ovpn_nonce_tail { + u8 u8[OVPN_NONCE_TAIL_SIZE]; +}; + +#endif /* _NET_OVPN_PACKET_H_ */ diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h index 8516c1ccd57a7c7634a538fe3ac16c858f647420..84d294aab20b79b8e9cb9b736a0= 74105c99338f3 100644 --- a/include/uapi/linux/if_link.h +++ b/include/uapi/linux/if_link.h @@ -1975,4 +1975,19 @@ enum { =20 #define IFLA_DSA_MAX (__IFLA_DSA_MAX - 1) =20 +/* OVPN section */ + +enum ovpn_mode { + OVPN_MODE_P2P, + OVPN_MODE_MP, +}; + +enum { + IFLA_OVPN_UNSPEC, + IFLA_OVPN_MODE, + __IFLA_OVPN_MAX, +}; + +#define IFLA_OVPN_MAX (__IFLA_OVPN_MAX - 1) + #endif /* _UAPI_LINUX_IF_LINK_H */ --=20 2.45.2