From nobody Mon Nov 25 21:58:27 2024 Received: from mail-wm1-f42.google.com (mail-wm1-f42.google.com [209.85.128.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 50DC01D45EF for ; Fri, 25 Oct 2024 09:14:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729847705; cv=none; b=HRvWKBdNl/1WmPPo+rcqt02mN3ioRUo0x8v9hNIXYiCjiA7noETosIjmPRe1dTH3NHzovGB66rqkIgR4nfAtkwJYaytlkMs3/vW/OpG1SwQh4jrx+ZPLJYKXUf1dSENlO51e3fcudtBRls1eA3nrlCOIftiz0MTra9lWzwwfZNY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729847705; c=relaxed/simple; bh=lQ3KRA5XCOCLRY9/76fSXiH1nhdEWJW/M4wUNYNPU28=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=rr+R+JsN/uh57hZoXWccV9r1LFTVp07tPfEVe7JxtyXiKbntp50hVjo5kI/4nRUC6ZWy+7FMzAWK1z6PCjEpPNceQtmeVT9NMpCIGQ47FdymORaP6KC+VvE4HXzQE0uL4IxSC++HDbry3hhjoTYhj4NAoIOujn1tzpnvXkxGHmI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=openvpn.net; spf=pass smtp.mailfrom=openvpn.com; dkim=pass (2048-bit key) header.d=openvpn.net header.i=@openvpn.net header.b=AjIk2+Vw; arc=none smtp.client-ip=209.85.128.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=openvpn.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=openvpn.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=openvpn.net header.i=@openvpn.net header.b="AjIk2+Vw" Received: by mail-wm1-f42.google.com with SMTP id 5b1f17b1804b1-43161e7bb25so17924525e9.2 for ; Fri, 25 Oct 2024 02:14:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvpn.net; s=google; t=1729847697; x=1730452497; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=s9+qg+eRzKevGAaZf6nhAwyaicrQfOV/SvBJNQBTVmA=; b=AjIk2+VwqAtZs7YrL/CduB5fKV8QZkQpMzLPTE/qlzeU+tXiUjcdiB3tXQlvvevlEU o2DpKqVjndlTeudjNoCR3/WYKIgqFFEnFEkeEiYDbHAxy64Pyb6MaRQ1YGc5uZzCZdvB CHEY/HOQgZMF7c70ouZHexEr29HGogEZ4dTf7OozFMB3XJW9bCu+mJ0X8Xn/icCBskHh lBwW9EhuxWlDWmzoue+0iEDK/KvW2+ldjjpocb6MgK7ZadD4AyESDq2y4lrYI8cBAjJ8 xkrHSSkUbDWmKCpIz/9GUMKVyru6F0xgS4NUNkyravtYyrLDGrHstuP2Ejr6ysGfCJfP /F+A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1729847697; x=1730452497; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=s9+qg+eRzKevGAaZf6nhAwyaicrQfOV/SvBJNQBTVmA=; b=sOqctJg3TtIOPTY18jkgmPL2a1D9AwcTN+MoYvD9bTZKH/E7LW53JP6IVcP12mwZiT 8nYkaVlp8xxOzDl1mIscPQG2UjkTdfW7XQJt5zfH0KpLQ/n/nR+OTvIH0b4624C1NM+9 YJ3riwUuExxQK0OnZlorDvmZ97XM5UktW/sonaDt1jhncPHJoAso1c0FSrP7zzok8QIE whfcTrFozHm6f6ACO6DkJy94cxTS6k/RLXSSTk4kc7LmE7EjDK5L82a9Vjl/xbjNaxhp jZ0CLQNiefVBTiRcAw5R0mm437AB1ZEMh5wLLLseChI2j5JfxU02b26xEtb7RileyRzt Gr+Q== X-Forwarded-Encrypted: i=1; AJvYcCW0NFfvMNNW2ZfDTEjUA70910sHMViHM173r2VPwx1nT6ATNQcTJlx3IdpqOwpXsfgC3rT2+++ttNXkljg=@vger.kernel.org X-Gm-Message-State: AOJu0Yw48i6U7ej03XJwbd1xlUSIUh13gu5PggBw6CrKl+k0fU/gFdBY 3jlVWVbt5CRiXs9qAlecQjcyGZnQqMLyGQ+WOy7vDcDtzwht5uCGbl1tUm5XGGc= X-Google-Smtp-Source: AGHT+IGkCI2xpFDZ4gPkwuDdu7ZytzwYgjFXAq2ZkGzbDm4sW62F0aYJed1R1xNh20LW2kdc2kpQbw== X-Received: by 2002:a05:600c:3b9c:b0:431:60ac:9aef with SMTP id 5b1f17b1804b1-431841a3e07mr82382075e9.29.1729847697490; Fri, 25 Oct 2024 02:14:57 -0700 (PDT) Received: from serenity.mandelbit.com ([2001:67c:2fbc:1:676b:7d84:55a4:bea5]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4318b55f484sm41981485e9.13.2024.10.25.02.14.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 25 Oct 2024 02:14:56 -0700 (PDT) From: Antonio Quartulli Date: Fri, 25 Oct 2024 11:14:02 +0200 Subject: [PATCH net-next v10 03/23] ovpn: add basic netlink support Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20241025-b4-ovpn-v10-3-b87530777be7@openvpn.net> References: <20241025-b4-ovpn-v10-0-b87530777be7@openvpn.net> In-Reply-To: <20241025-b4-ovpn-v10-0-b87530777be7@openvpn.net> To: Eric Dumazet , Jakub Kicinski , Paolo Abeni , Donald Hunter , Antonio Quartulli , Shuah Khan , donald.hunter@gmail.com, sd@queasysnail.net, ryazanov.s.a@gmail.com, Andrew Lunn Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=31124; i=antonio@openvpn.net; h=from:subject:message-id; bh=lQ3KRA5XCOCLRY9/76fSXiH1nhdEWJW/M4wUNYNPU28=; b=owEBbQGS/pANAwAIAQtw5TqgONWHAcsmYgBnG2GYw+6gdUwdyvniCN3BSXMy7BENYHVbsGGAY 2bS3n2D5FWJATMEAAEIAB0WIQSZq9xs+NQS5N5fwPwLcOU6oDjVhwUCZxthmAAKCRALcOU6oDjV hyLWB/9TT6CumPxVVhco17od83aYXByjLjxHWgRBA2qSp8NbGMZcdB0BZgZ9DrZJDD7WU+Aoj+1 +Mp8CE8+VGUlOq3Z2N2XUN4YSR/KQbSsmBC9pg5HqvbZJQTfv7iXk0UZOzsB5JRfScRxH90/wY8 giU9qjRYlTxqFpbO8+qxUEsLuqAItBq4vo7mAVSoiWOQEdjDLphrj+wxuGV9t3EAkU/8zCHV0b/ l1ttu9YFVA9+8+DVHTNQa5pLcVKptcNdHEZawUrnyBRKDXMAuGwxkFVROlCYD8+ghXnHlUJ7bGq f6QtV572UvvW6i0+56dhMgMeVtOoDxTj0GmTy+/SZS6ZpT2u X-Developer-Key: i=antonio@openvpn.net; a=openpgp; fpr=CABDA1282017C267219885C748F0CCB68F59D14C This commit introduces basic netlink support with family registration/unregistration functionalities and stub pre/post-doit. More importantly it introduces the YAML uAPI description along with its auto-generated files: - include/uapi/linux/ovpn.h - drivers/net/ovpn/netlink-gen.c - drivers/net/ovpn/netlink-gen.h Cc: donald.hunter@gmail.com Signed-off-by: Antonio Quartulli --- Documentation/netlink/specs/ovpn.yaml | 362 ++++++++++++++++++++++++++++++= ++++ MAINTAINERS | 2 + drivers/net/ovpn/Makefile | 2 + drivers/net/ovpn/main.c | 15 +- drivers/net/ovpn/netlink-gen.c | 212 ++++++++++++++++++++ drivers/net/ovpn/netlink-gen.h | 41 ++++ drivers/net/ovpn/netlink.c | 157 +++++++++++++++ drivers/net/ovpn/netlink.h | 15 ++ drivers/net/ovpn/ovpnstruct.h | 25 +++ include/uapi/linux/ovpn.h | 109 ++++++++++ 10 files changed, 939 insertions(+), 1 deletion(-) diff --git a/Documentation/netlink/specs/ovpn.yaml b/Documentation/netlink/= specs/ovpn.yaml new file mode 100644 index 0000000000000000000000000000000000000000..79339c25d607f1b5d15a0a973f6= fc23637e158a2 --- /dev/null +++ b/Documentation/netlink/specs/ovpn.yaml @@ -0,0 +1,362 @@ +# SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Cla= use) +# +# Author: Antonio Quartulli +# +# Copyright (c) 2024, OpenVPN Inc. +# + +name: ovpn + +protocol: genetlink + +doc: Netlink protocol to control OpenVPN network devices + +definitions: + - + type: const + name: nonce-tail-size + value: 8 + - + type: enum + name: cipher-alg + entries: [ none, aes-gcm, chacha20-poly1305 ] + - + type: enum + name: del-peer-reason + entries: [ teardown, userspace, expired, transport-error, transport-di= sconnect ] + - + type: enum + name: key-slot + entries: [ primary, secondary ] + +attribute-sets: + - + name: peer + attributes: + - + name: id + type: u32 + doc: | + The unique ID of the peer. To be used to identify peers during + operations + checks: + max: 0xFFFFFF + - + name: remote-ipv4 + type: u32 + doc: The remote IPv4 address of the peer + byte-order: big-endian + display-hint: ipv4 + - + name: remote-ipv6 + type: binary + doc: The remote IPv6 address of the peer + display-hint: ipv6 + checks: + exact-len: 16 + - + name: remote-ipv6-scope-id + type: u32 + doc: The scope id of the remote IPv6 address of the peer (RFC2553) + - + name: remote-port + type: u16 + doc: The remote port of the peer + byte-order: big-endian + checks: + min: 1 + - + name: socket + type: u32 + doc: The socket to be used to communicate with the peer + - + name: vpn-ipv4 + type: u32 + doc: The IPv4 address assigned to the peer by the server + byte-order: big-endian + display-hint: ipv4 + - + name: vpn-ipv6 + type: binary + doc: The IPv6 address assigned to the peer by the server + display-hint: ipv6 + checks: + exact-len: 16 + - + name: local-ipv4 + type: u32 + doc: The local IPv4 to be used to send packets to the peer (UDP on= ly) + byte-order: big-endian + display-hint: ipv4 + - + name: local-ipv6 + type: binary + doc: The local IPv6 to be used to send packets to the peer (UDP on= ly) + display-hint: ipv6 + checks: + exact-len: 16 + - + name: local-port + type: u16 + doc: The local port to be used to send packets to the peer (UDP on= ly) + byte-order: big-endian + checks: + min: 1 + - + name: keepalive-interval + type: u32 + doc: | + The number of seconds after which a keep alive message is sent t= o the + peer + - + name: keepalive-timeout + type: u32 + doc: | + The number of seconds from the last activity after which the pee= r is + assumed dead + - + name: del-reason + type: u32 + doc: The reason why a peer was deleted + enum: del-peer-reason + - + name: vpn-rx-bytes + type: uint + doc: Number of bytes received over the tunnel + - + name: vpn-tx-bytes + type: uint + doc: Number of bytes transmitted over the tunnel + - + name: vpn-rx-packets + type: uint + doc: Number of packets received over the tunnel + - + name: vpn-tx-packets + type: uint + doc: Number of packets transmitted over the tunnel + - + name: link-rx-bytes + type: uint + doc: Number of bytes received at the transport level + - + name: link-tx-bytes + type: uint + doc: Number of bytes transmitted at the transport level + - + name: link-rx-packets + type: u32 + doc: Number of packets received at the transport level + - + name: link-tx-packets + type: u32 + doc: Number of packets transmitted at the transport level + - + name: keyconf + attributes: + - + name: peer-id + type: u32 + doc: | + The unique ID of the peer. To be used to identify peers during + key operations + checks: + max: 0xFFFFFF + - + name: slot + type: u32 + doc: The slot where the key should be stored + enum: key-slot + - + name: key-id + doc: | + The unique ID of the key. Used to fetch the correct key upon + decryption + type: u32 + checks: + max: 7 + - + name: cipher-alg + type: u32 + doc: The cipher to be used when communicating with the peer + enum: cipher-alg + - + name: encrypt-dir + type: nest + doc: Key material for encrypt direction + nested-attributes: keydir + - + name: decrypt-dir + type: nest + doc: Key material for decrypt direction + nested-attributes: keydir + - + name: keydir + attributes: + - + name: cipher-key + type: binary + doc: The actual key to be used by the cipher + checks: + max-len: 256 + - + name: nonce-tail + type: binary + doc: | + Random nonce to be concatenated to the packet ID, in order to + obtain the actual cipher IV + checks: + exact-len: nonce-tail-size + - + name: ovpn + attributes: + - + name: ifindex + type: u32 + doc: Index of the ovpn interface to operate on + - + name: ifname + type: string + doc: Name of the ovpn interface + - + name: peer + type: nest + doc: | + The peer object containing the attributed of interest for the sp= ecific + operation + nested-attributes: peer + - + name: keyconf + type: nest + doc: Peer specific cipher configuration + nested-attributes: keyconf + +operations: + list: + - + name: peer-new + attribute-set: ovpn + flags: [ admin-perm ] + doc: Add a remote peer + do: + pre: ovpn-nl-pre-doit + post: ovpn-nl-post-doit + request: + attributes: + - ifindex + - peer + - + name: peer-set + attribute-set: ovpn + flags: [ admin-perm ] + doc: modify a remote peer + do: + pre: ovpn-nl-pre-doit + post: ovpn-nl-post-doit + request: + attributes: + - ifindex + - peer + - + name: peer-get + attribute-set: ovpn + flags: [ admin-perm ] + doc: Retrieve data about existing remote peers (or a specific one) + do: + pre: ovpn-nl-pre-doit + post: ovpn-nl-post-doit + request: + attributes: + - ifindex + - peer + reply: + attributes: + - peer + dump: + request: + attributes: + - ifindex + reply: + attributes: + - peer + - + name: peer-del + attribute-set: ovpn + flags: [ admin-perm ] + doc: Delete existing remote peer + do: + pre: ovpn-nl-pre-doit + post: ovpn-nl-post-doit + request: + attributes: + - ifindex + - peer + - + name: peer-del-ntf + doc: Notification about a peer being deleted + notify: peer-get + mcgrp: peers + + - + name: key-new + attribute-set: ovpn + flags: [ admin-perm ] + doc: Add a cipher key for a specific peer + do: + pre: ovpn-nl-pre-doit + post: ovpn-nl-post-doit + request: + attributes: + - ifindex + - keyconf + - + name: key-get + attribute-set: ovpn + flags: [ admin-perm ] + doc: Retrieve non-sensitive data about peer key and cipher + do: + pre: ovpn-nl-pre-doit + post: ovpn-nl-post-doit + request: + attributes: + - ifindex + - keyconf + reply: + attributes: + - keyconf + - + name: key-swap + attribute-set: ovpn + flags: [ admin-perm ] + doc: Swap primary and secondary session keys for a specific peer + do: + pre: ovpn-nl-pre-doit + post: ovpn-nl-post-doit + request: + attributes: + - ifindex + - keyconf + - + name: key-swap-ntf + notify: key-get + doc: | + Notification about key having exhausted its IV space and requiring + renegotiation + mcgrp: peers + - + name: key-del + attribute-set: ovpn + flags: [ admin-perm ] + doc: Delete cipher key for a specific peer + do: + pre: ovpn-nl-pre-doit + post: ovpn-nl-post-doit + request: + attributes: + - ifindex + - keyconf + +mcast-groups: + list: + - + name: peers diff --git a/MAINTAINERS b/MAINTAINERS index 09e193bbc218d74846cbae26f80ada3e04c3692a..cf3d55c3e98aaea8f8817faed99= dd7499cd59a71 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -17292,7 +17292,9 @@ L: openvpn-devel@lists.sourceforge.net (moderated f= or non-subscribers) L: netdev@vger.kernel.org S: Supported T: git https://github.com/OpenVPN/linux-kernel-ovpn.git +F: Documentation/netlink/specs/ovpn.yaml F: drivers/net/ovpn/ +F: include/uapi/linux/ovpn.h =20 OPENVSWITCH M: Pravin B Shelar diff --git a/drivers/net/ovpn/Makefile b/drivers/net/ovpn/Makefile index 53fb197027d787d6683e9056d3d341abf6ed38e4..201dc001419f1d99ae95c0ee0f9= 6e68f8a4eac16 100644 --- a/drivers/net/ovpn/Makefile +++ b/drivers/net/ovpn/Makefile @@ -9,3 +9,5 @@ obj-$(CONFIG_OVPN) :=3D ovpn.o ovpn-y +=3D main.o ovpn-y +=3D io.o +ovpn-y +=3D netlink.o +ovpn-y +=3D netlink-gen.o diff --git a/drivers/net/ovpn/main.c b/drivers/net/ovpn/main.c index 369a5a2b2fc1a497c8444e59f9b058eb40e49524..d5bdb0055f4dd3a6e32dc6e792b= ed1e7fd59e101 100644 --- a/drivers/net/ovpn/main.c +++ b/drivers/net/ovpn/main.c @@ -7,11 +7,15 @@ * James Yonan */ =20 +#include #include #include #include +#include =20 +#include "ovpnstruct.h" #include "main.h" +#include "netlink.h" #include "io.h" =20 /* Driver info */ @@ -37,7 +41,7 @@ static int ovpn_newlink(struct net *src_net, struct net_d= evice *dev, } =20 static struct rtnl_link_ops ovpn_link_ops =3D { - .kind =3D "ovpn", + .kind =3D OVPN_FAMILY_NAME, .netns_refund =3D false, .newlink =3D ovpn_newlink, .dellink =3D unregister_netdevice_queue, @@ -93,8 +97,16 @@ static int __init ovpn_init(void) goto unreg_netdev; } =20 + err =3D ovpn_nl_register(); + if (err) { + pr_err("ovpn: can't register netlink family: %d\n", err); + goto unreg_rtnl; + } + return 0; =20 +unreg_rtnl: + rtnl_link_unregister(&ovpn_link_ops); unreg_netdev: unregister_netdevice_notifier(&ovpn_netdev_notifier); return err; @@ -102,6 +114,7 @@ static int __init ovpn_init(void) =20 static __exit void ovpn_cleanup(void) { + ovpn_nl_unregister(); rtnl_link_unregister(&ovpn_link_ops); unregister_netdevice_notifier(&ovpn_netdev_notifier); =20 diff --git a/drivers/net/ovpn/netlink-gen.c b/drivers/net/ovpn/netlink-gen.c new file mode 100644 index 0000000000000000000000000000000000000000..6a43eab9a136cf0d739b9674080= d1254a43cf5d0 --- /dev/null +++ b/drivers/net/ovpn/netlink-gen.c @@ -0,0 +1,212 @@ +// SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Cl= ause) +/* Do not edit directly, auto-generated from: */ +/* Documentation/netlink/specs/ovpn.yaml */ +/* YNL-GEN kernel source */ + +#include +#include + +#include "netlink-gen.h" + +#include + +/* Integer value ranges */ +static const struct netlink_range_validation ovpn_a_peer_id_range =3D { + .max =3D 16777215ULL, +}; + +static const struct netlink_range_validation ovpn_a_keyconf_peer_id_range = =3D { + .max =3D 16777215ULL, +}; + +/* Common nested types */ +const struct nla_policy ovpn_keyconf_nl_policy[OVPN_A_KEYCONF_DECRYPT_DIR = + 1] =3D { + [OVPN_A_KEYCONF_PEER_ID] =3D NLA_POLICY_FULL_RANGE(NLA_U32, &ovpn_a_keyco= nf_peer_id_range), + [OVPN_A_KEYCONF_SLOT] =3D NLA_POLICY_MAX(NLA_U32, 1), + [OVPN_A_KEYCONF_KEY_ID] =3D NLA_POLICY_MAX(NLA_U32, 7), + [OVPN_A_KEYCONF_CIPHER_ALG] =3D NLA_POLICY_MAX(NLA_U32, 2), + [OVPN_A_KEYCONF_ENCRYPT_DIR] =3D NLA_POLICY_NESTED(ovpn_keydir_nl_policy), + [OVPN_A_KEYCONF_DECRYPT_DIR] =3D NLA_POLICY_NESTED(ovpn_keydir_nl_policy), +}; + +const struct nla_policy ovpn_keydir_nl_policy[OVPN_A_KEYDIR_NONCE_TAIL + 1= ] =3D { + [OVPN_A_KEYDIR_CIPHER_KEY] =3D NLA_POLICY_MAX_LEN(256), + [OVPN_A_KEYDIR_NONCE_TAIL] =3D NLA_POLICY_EXACT_LEN(OVPN_NONCE_TAIL_SIZE), +}; + +const struct nla_policy ovpn_peer_nl_policy[OVPN_A_PEER_LINK_TX_PACKETS + = 1] =3D { + [OVPN_A_PEER_ID] =3D NLA_POLICY_FULL_RANGE(NLA_U32, &ovpn_a_peer_id_range= ), + [OVPN_A_PEER_REMOTE_IPV4] =3D { .type =3D NLA_U32, }, + [OVPN_A_PEER_REMOTE_IPV6] =3D NLA_POLICY_EXACT_LEN(16), + [OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID] =3D { .type =3D NLA_U32, }, + [OVPN_A_PEER_REMOTE_PORT] =3D NLA_POLICY_MIN(NLA_U16, 1), + [OVPN_A_PEER_SOCKET] =3D { .type =3D NLA_U32, }, + [OVPN_A_PEER_VPN_IPV4] =3D { .type =3D NLA_U32, }, + [OVPN_A_PEER_VPN_IPV6] =3D NLA_POLICY_EXACT_LEN(16), + [OVPN_A_PEER_LOCAL_IPV4] =3D { .type =3D NLA_U32, }, + [OVPN_A_PEER_LOCAL_IPV6] =3D NLA_POLICY_EXACT_LEN(16), + [OVPN_A_PEER_LOCAL_PORT] =3D NLA_POLICY_MIN(NLA_U16, 1), + [OVPN_A_PEER_KEEPALIVE_INTERVAL] =3D { .type =3D NLA_U32, }, + [OVPN_A_PEER_KEEPALIVE_TIMEOUT] =3D { .type =3D NLA_U32, }, + [OVPN_A_PEER_DEL_REASON] =3D NLA_POLICY_MAX(NLA_U32, 4), + [OVPN_A_PEER_VPN_RX_BYTES] =3D { .type =3D NLA_UINT, }, + [OVPN_A_PEER_VPN_TX_BYTES] =3D { .type =3D NLA_UINT, }, + [OVPN_A_PEER_VPN_RX_PACKETS] =3D { .type =3D NLA_UINT, }, + [OVPN_A_PEER_VPN_TX_PACKETS] =3D { .type =3D NLA_UINT, }, + [OVPN_A_PEER_LINK_RX_BYTES] =3D { .type =3D NLA_UINT, }, + [OVPN_A_PEER_LINK_TX_BYTES] =3D { .type =3D NLA_UINT, }, + [OVPN_A_PEER_LINK_RX_PACKETS] =3D { .type =3D NLA_U32, }, + [OVPN_A_PEER_LINK_TX_PACKETS] =3D { .type =3D NLA_U32, }, +}; + +/* OVPN_CMD_PEER_NEW - do */ +static const struct nla_policy ovpn_peer_new_nl_policy[OVPN_A_PEER + 1] = =3D { + [OVPN_A_IFINDEX] =3D { .type =3D NLA_U32, }, + [OVPN_A_PEER] =3D NLA_POLICY_NESTED(ovpn_peer_nl_policy), +}; + +/* OVPN_CMD_PEER_SET - do */ +static const struct nla_policy ovpn_peer_set_nl_policy[OVPN_A_PEER + 1] = =3D { + [OVPN_A_IFINDEX] =3D { .type =3D NLA_U32, }, + [OVPN_A_PEER] =3D NLA_POLICY_NESTED(ovpn_peer_nl_policy), +}; + +/* OVPN_CMD_PEER_GET - do */ +static const struct nla_policy ovpn_peer_get_do_nl_policy[OVPN_A_PEER + 1]= =3D { + [OVPN_A_IFINDEX] =3D { .type =3D NLA_U32, }, + [OVPN_A_PEER] =3D NLA_POLICY_NESTED(ovpn_peer_nl_policy), +}; + +/* OVPN_CMD_PEER_GET - dump */ +static const struct nla_policy ovpn_peer_get_dump_nl_policy[OVPN_A_IFINDEX= + 1] =3D { + [OVPN_A_IFINDEX] =3D { .type =3D NLA_U32, }, +}; + +/* OVPN_CMD_PEER_DEL - do */ +static const struct nla_policy ovpn_peer_del_nl_policy[OVPN_A_PEER + 1] = =3D { + [OVPN_A_IFINDEX] =3D { .type =3D NLA_U32, }, + [OVPN_A_PEER] =3D NLA_POLICY_NESTED(ovpn_peer_nl_policy), +}; + +/* OVPN_CMD_KEY_NEW - do */ +static const struct nla_policy ovpn_key_new_nl_policy[OVPN_A_KEYCONF + 1] = =3D { + [OVPN_A_IFINDEX] =3D { .type =3D NLA_U32, }, + [OVPN_A_KEYCONF] =3D NLA_POLICY_NESTED(ovpn_keyconf_nl_policy), +}; + +/* OVPN_CMD_KEY_GET - do */ +static const struct nla_policy ovpn_key_get_nl_policy[OVPN_A_KEYCONF + 1] = =3D { + [OVPN_A_IFINDEX] =3D { .type =3D NLA_U32, }, + [OVPN_A_KEYCONF] =3D NLA_POLICY_NESTED(ovpn_keyconf_nl_policy), +}; + +/* OVPN_CMD_KEY_SWAP - do */ +static const struct nla_policy ovpn_key_swap_nl_policy[OVPN_A_KEYCONF + 1]= =3D { + [OVPN_A_IFINDEX] =3D { .type =3D NLA_U32, }, + [OVPN_A_KEYCONF] =3D NLA_POLICY_NESTED(ovpn_keyconf_nl_policy), +}; + +/* OVPN_CMD_KEY_DEL - do */ +static const struct nla_policy ovpn_key_del_nl_policy[OVPN_A_KEYCONF + 1] = =3D { + [OVPN_A_IFINDEX] =3D { .type =3D NLA_U32, }, + [OVPN_A_KEYCONF] =3D NLA_POLICY_NESTED(ovpn_keyconf_nl_policy), +}; + +/* Ops table for ovpn */ +static const struct genl_split_ops ovpn_nl_ops[] =3D { + { + .cmd =3D OVPN_CMD_PEER_NEW, + .pre_doit =3D ovpn_nl_pre_doit, + .doit =3D ovpn_nl_peer_new_doit, + .post_doit =3D ovpn_nl_post_doit, + .policy =3D ovpn_peer_new_nl_policy, + .maxattr =3D OVPN_A_PEER, + .flags =3D GENL_ADMIN_PERM | GENL_CMD_CAP_DO, + }, + { + .cmd =3D OVPN_CMD_PEER_SET, + .pre_doit =3D ovpn_nl_pre_doit, + .doit =3D ovpn_nl_peer_set_doit, + .post_doit =3D ovpn_nl_post_doit, + .policy =3D ovpn_peer_set_nl_policy, + .maxattr =3D OVPN_A_PEER, + .flags =3D GENL_ADMIN_PERM | GENL_CMD_CAP_DO, + }, + { + .cmd =3D OVPN_CMD_PEER_GET, + .pre_doit =3D ovpn_nl_pre_doit, + .doit =3D ovpn_nl_peer_get_doit, + .post_doit =3D ovpn_nl_post_doit, + .policy =3D ovpn_peer_get_do_nl_policy, + .maxattr =3D OVPN_A_PEER, + .flags =3D GENL_ADMIN_PERM | GENL_CMD_CAP_DO, + }, + { + .cmd =3D OVPN_CMD_PEER_GET, + .dumpit =3D ovpn_nl_peer_get_dumpit, + .policy =3D ovpn_peer_get_dump_nl_policy, + .maxattr =3D OVPN_A_IFINDEX, + .flags =3D GENL_ADMIN_PERM | GENL_CMD_CAP_DUMP, + }, + { + .cmd =3D OVPN_CMD_PEER_DEL, + .pre_doit =3D ovpn_nl_pre_doit, + .doit =3D ovpn_nl_peer_del_doit, + .post_doit =3D ovpn_nl_post_doit, + .policy =3D ovpn_peer_del_nl_policy, + .maxattr =3D OVPN_A_PEER, + .flags =3D GENL_ADMIN_PERM | GENL_CMD_CAP_DO, + }, + { + .cmd =3D OVPN_CMD_KEY_NEW, + .pre_doit =3D ovpn_nl_pre_doit, + .doit =3D ovpn_nl_key_new_doit, + .post_doit =3D ovpn_nl_post_doit, + .policy =3D ovpn_key_new_nl_policy, + .maxattr =3D OVPN_A_KEYCONF, + .flags =3D GENL_ADMIN_PERM | GENL_CMD_CAP_DO, + }, + { + .cmd =3D OVPN_CMD_KEY_GET, + .pre_doit =3D ovpn_nl_pre_doit, + .doit =3D ovpn_nl_key_get_doit, + .post_doit =3D ovpn_nl_post_doit, + .policy =3D ovpn_key_get_nl_policy, + .maxattr =3D OVPN_A_KEYCONF, + .flags =3D GENL_ADMIN_PERM | GENL_CMD_CAP_DO, + }, + { + .cmd =3D OVPN_CMD_KEY_SWAP, + .pre_doit =3D ovpn_nl_pre_doit, + .doit =3D ovpn_nl_key_swap_doit, + .post_doit =3D ovpn_nl_post_doit, + .policy =3D ovpn_key_swap_nl_policy, + .maxattr =3D OVPN_A_KEYCONF, + .flags =3D GENL_ADMIN_PERM | GENL_CMD_CAP_DO, + }, + { + .cmd =3D OVPN_CMD_KEY_DEL, + .pre_doit =3D ovpn_nl_pre_doit, + .doit =3D ovpn_nl_key_del_doit, + .post_doit =3D ovpn_nl_post_doit, + .policy =3D ovpn_key_del_nl_policy, + .maxattr =3D OVPN_A_KEYCONF, + .flags =3D GENL_ADMIN_PERM | GENL_CMD_CAP_DO, + }, +}; + +static const struct genl_multicast_group ovpn_nl_mcgrps[] =3D { + [OVPN_NLGRP_PEERS] =3D { "peers", }, +}; + +struct genl_family ovpn_nl_family __ro_after_init =3D { + .name =3D OVPN_FAMILY_NAME, + .version =3D OVPN_FAMILY_VERSION, + .netnsok =3D true, + .parallel_ops =3D true, + .module =3D THIS_MODULE, + .split_ops =3D ovpn_nl_ops, + .n_split_ops =3D ARRAY_SIZE(ovpn_nl_ops), + .mcgrps =3D ovpn_nl_mcgrps, + .n_mcgrps =3D ARRAY_SIZE(ovpn_nl_mcgrps), +}; diff --git a/drivers/net/ovpn/netlink-gen.h b/drivers/net/ovpn/netlink-gen.h new file mode 100644 index 0000000000000000000000000000000000000000..66a4e4a0a055b4477b67801ded8= 25e9ec068b0e6 --- /dev/null +++ b/drivers/net/ovpn/netlink-gen.h @@ -0,0 +1,41 @@ +/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Cl= ause) */ +/* Do not edit directly, auto-generated from: */ +/* Documentation/netlink/specs/ovpn.yaml */ +/* YNL-GEN kernel header */ + +#ifndef _LINUX_OVPN_GEN_H +#define _LINUX_OVPN_GEN_H + +#include +#include + +#include + +/* Common nested types */ +extern const struct nla_policy ovpn_keyconf_nl_policy[OVPN_A_KEYCONF_DECRY= PT_DIR + 1]; +extern const struct nla_policy ovpn_keydir_nl_policy[OVPN_A_KEYDIR_NONCE_T= AIL + 1]; +extern const struct nla_policy ovpn_peer_nl_policy[OVPN_A_PEER_LINK_TX_PAC= KETS + 1]; + +int ovpn_nl_pre_doit(const struct genl_split_ops *ops, struct sk_buff *skb, + struct genl_info *info); +void +ovpn_nl_post_doit(const struct genl_split_ops *ops, struct sk_buff *skb, + struct genl_info *info); + +int ovpn_nl_peer_new_doit(struct sk_buff *skb, struct genl_info *info); +int ovpn_nl_peer_set_doit(struct sk_buff *skb, struct genl_info *info); +int ovpn_nl_peer_get_doit(struct sk_buff *skb, struct genl_info *info); +int ovpn_nl_peer_get_dumpit(struct sk_buff *skb, struct netlink_callback *= cb); +int ovpn_nl_peer_del_doit(struct sk_buff *skb, struct genl_info *info); +int ovpn_nl_key_new_doit(struct sk_buff *skb, struct genl_info *info); +int ovpn_nl_key_get_doit(struct sk_buff *skb, struct genl_info *info); +int ovpn_nl_key_swap_doit(struct sk_buff *skb, struct genl_info *info); +int ovpn_nl_key_del_doit(struct sk_buff *skb, struct genl_info *info); + +enum { + OVPN_NLGRP_PEERS, +}; + +extern struct genl_family ovpn_nl_family; + +#endif /* _LINUX_OVPN_GEN_H */ diff --git a/drivers/net/ovpn/netlink.c b/drivers/net/ovpn/netlink.c new file mode 100644 index 0000000000000000000000000000000000000000..2cc34eb1d1d870c6705714cb971= c3c5dfb04afda --- /dev/null +++ b/drivers/net/ovpn/netlink.c @@ -0,0 +1,157 @@ +// SPDX-License-Identifier: GPL-2.0 +/* OpenVPN data channel offload + * + * Copyright (C) 2020-2024 OpenVPN, Inc. + * + * Author: Antonio Quartulli + */ + +#include +#include + +#include + +#include "ovpnstruct.h" +#include "main.h" +#include "io.h" +#include "netlink.h" +#include "netlink-gen.h" + +MODULE_ALIAS_GENL_FAMILY(OVPN_FAMILY_NAME); + +/** + * ovpn_get_dev_from_attrs - retrieve the ovpn private data from the netde= vice + * a netlink message is targeting + * @net: network namespace where to look for the interface + * @info: generic netlink info from the user request + * + * Return: the ovpn private data, if found, or an error otherwise + */ +static struct ovpn_struct * +ovpn_get_dev_from_attrs(struct net *net, const struct genl_info *info) +{ + struct ovpn_struct *ovpn; + struct net_device *dev; + int ifindex; + + if (GENL_REQ_ATTR_CHECK(info, OVPN_A_IFINDEX)) + return ERR_PTR(-EINVAL); + + ifindex =3D nla_get_u32(info->attrs[OVPN_A_IFINDEX]); + + rcu_read_lock(); + dev =3D dev_get_by_index_rcu(net, ifindex); + if (!dev) { + rcu_read_unlock(); + NL_SET_ERR_MSG_MOD(info->extack, + "ifindex does not match any interface"); + return ERR_PTR(-ENODEV); + } + + if (!ovpn_dev_is_valid(dev)) { + rcu_read_unlock(); + NL_SET_ERR_MSG_MOD(info->extack, + "specified interface is not ovpn"); + NL_SET_BAD_ATTR(info->extack, info->attrs[OVPN_A_IFINDEX]); + return ERR_PTR(-EINVAL); + } + + ovpn =3D netdev_priv(dev); + netdev_hold(dev, &ovpn->dev_tracker, GFP_KERNEL); + rcu_read_unlock(); + + return ovpn; +} + +int ovpn_nl_pre_doit(const struct genl_split_ops *ops, struct sk_buff *skb, + struct genl_info *info) +{ + struct ovpn_struct *ovpn =3D ovpn_get_dev_from_attrs(genl_info_net(info), + info); + + if (IS_ERR(ovpn)) + return PTR_ERR(ovpn); + + info->user_ptr[0] =3D ovpn; + + return 0; +} + +void ovpn_nl_post_doit(const struct genl_split_ops *ops, struct sk_buff *s= kb, + struct genl_info *info) +{ + struct ovpn_struct *ovpn =3D info->user_ptr[0]; + + if (ovpn) + netdev_put(ovpn->dev, &ovpn->dev_tracker); +} + +int ovpn_nl_peer_new_doit(struct sk_buff *skb, struct genl_info *info) +{ + return -EOPNOTSUPP; +} + +int ovpn_nl_peer_set_doit(struct sk_buff *skb, struct genl_info *info) +{ + return -EOPNOTSUPP; +} + +int ovpn_nl_peer_get_doit(struct sk_buff *skb, struct genl_info *info) +{ + return -EOPNOTSUPP; +} + +int ovpn_nl_peer_get_dumpit(struct sk_buff *skb, struct netlink_callback *= cb) +{ + return -EOPNOTSUPP; +} + +int ovpn_nl_peer_del_doit(struct sk_buff *skb, struct genl_info *info) +{ + return -EOPNOTSUPP; +} + +int ovpn_nl_key_new_doit(struct sk_buff *skb, struct genl_info *info) +{ + return -EOPNOTSUPP; +} + +int ovpn_nl_key_get_doit(struct sk_buff *skb, struct genl_info *info) +{ + return -EOPNOTSUPP; +} + +int ovpn_nl_key_swap_doit(struct sk_buff *skb, struct genl_info *info) +{ + return -EOPNOTSUPP; +} + +int ovpn_nl_key_del_doit(struct sk_buff *skb, struct genl_info *info) +{ + return -EOPNOTSUPP; +} + +/** + * ovpn_nl_register - perform any needed registration in the NL subsustem + * + * Return: 0 on success, a negative error code otherwise + */ +int __init ovpn_nl_register(void) +{ + int ret =3D genl_register_family(&ovpn_nl_family); + + if (ret) { + pr_err("ovpn: genl_register_family failed: %d\n", ret); + return ret; + } + + return 0; +} + +/** + * ovpn_nl_unregister - undo any module wide netlink registration + */ +void ovpn_nl_unregister(void) +{ + genl_unregister_family(&ovpn_nl_family); +} diff --git a/drivers/net/ovpn/netlink.h b/drivers/net/ovpn/netlink.h new file mode 100644 index 0000000000000000000000000000000000000000..9e87cf11d1e9813b7a75ddf3705= ab7d5fabe899f --- /dev/null +++ b/drivers/net/ovpn/netlink.h @@ -0,0 +1,15 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* OpenVPN data channel offload + * + * Copyright (C) 2020-2024 OpenVPN, Inc. + * + * Author: Antonio Quartulli + */ + +#ifndef _NET_OVPN_NETLINK_H_ +#define _NET_OVPN_NETLINK_H_ + +int ovpn_nl_register(void); +void ovpn_nl_unregister(void); + +#endif /* _NET_OVPN_NETLINK_H_ */ diff --git a/drivers/net/ovpn/ovpnstruct.h b/drivers/net/ovpn/ovpnstruct.h new file mode 100644 index 0000000000000000000000000000000000000000..e3e4df6418b081436378fc51d98= db5bd7b5d1fbe --- /dev/null +++ b/drivers/net/ovpn/ovpnstruct.h @@ -0,0 +1,25 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* OpenVPN data channel offload + * + * Copyright (C) 2019-2024 OpenVPN, Inc. + * + * Author: James Yonan + * Antonio Quartulli + */ + +#ifndef _NET_OVPN_OVPNSTRUCT_H_ +#define _NET_OVPN_OVPNSTRUCT_H_ + +#include + +/** + * struct ovpn_struct - per ovpn interface state + * @dev: the actual netdev representing the tunnel + * @dev_tracker: reference tracker for associated dev + */ +struct ovpn_struct { + struct net_device *dev; + netdevice_tracker dev_tracker; +}; + +#endif /* _NET_OVPN_OVPNSTRUCT_H_ */ diff --git a/include/uapi/linux/ovpn.h b/include/uapi/linux/ovpn.h new file mode 100644 index 0000000000000000000000000000000000000000..7bac0803cd9fd0dde13f4db74ac= ce8d9df5316d8 --- /dev/null +++ b/include/uapi/linux/ovpn.h @@ -0,0 +1,109 @@ +/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Cl= ause) */ +/* Do not edit directly, auto-generated from: */ +/* Documentation/netlink/specs/ovpn.yaml */ +/* YNL-GEN uapi header */ + +#ifndef _UAPI_LINUX_OVPN_H +#define _UAPI_LINUX_OVPN_H + +#define OVPN_FAMILY_NAME "ovpn" +#define OVPN_FAMILY_VERSION 1 + +#define OVPN_NONCE_TAIL_SIZE 8 + +enum ovpn_cipher_alg { + OVPN_CIPHER_ALG_NONE, + OVPN_CIPHER_ALG_AES_GCM, + OVPN_CIPHER_ALG_CHACHA20_POLY1305, +}; + +enum ovpn_del_peer_reason { + OVPN_DEL_PEER_REASON_TEARDOWN, + OVPN_DEL_PEER_REASON_USERSPACE, + OVPN_DEL_PEER_REASON_EXPIRED, + OVPN_DEL_PEER_REASON_TRANSPORT_ERROR, + OVPN_DEL_PEER_REASON_TRANSPORT_DISCONNECT, +}; + +enum ovpn_key_slot { + OVPN_KEY_SLOT_PRIMARY, + OVPN_KEY_SLOT_SECONDARY, +}; + +enum { + OVPN_A_PEER_ID =3D 1, + OVPN_A_PEER_REMOTE_IPV4, + OVPN_A_PEER_REMOTE_IPV6, + OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID, + OVPN_A_PEER_REMOTE_PORT, + OVPN_A_PEER_SOCKET, + OVPN_A_PEER_VPN_IPV4, + OVPN_A_PEER_VPN_IPV6, + OVPN_A_PEER_LOCAL_IPV4, + OVPN_A_PEER_LOCAL_IPV6, + OVPN_A_PEER_LOCAL_PORT, + OVPN_A_PEER_KEEPALIVE_INTERVAL, + OVPN_A_PEER_KEEPALIVE_TIMEOUT, + OVPN_A_PEER_DEL_REASON, + OVPN_A_PEER_VPN_RX_BYTES, + OVPN_A_PEER_VPN_TX_BYTES, + OVPN_A_PEER_VPN_RX_PACKETS, + OVPN_A_PEER_VPN_TX_PACKETS, + OVPN_A_PEER_LINK_RX_BYTES, + OVPN_A_PEER_LINK_TX_BYTES, + OVPN_A_PEER_LINK_RX_PACKETS, + OVPN_A_PEER_LINK_TX_PACKETS, + + __OVPN_A_PEER_MAX, + OVPN_A_PEER_MAX =3D (__OVPN_A_PEER_MAX - 1) +}; + +enum { + OVPN_A_KEYCONF_PEER_ID =3D 1, + OVPN_A_KEYCONF_SLOT, + OVPN_A_KEYCONF_KEY_ID, + OVPN_A_KEYCONF_CIPHER_ALG, + OVPN_A_KEYCONF_ENCRYPT_DIR, + OVPN_A_KEYCONF_DECRYPT_DIR, + + __OVPN_A_KEYCONF_MAX, + OVPN_A_KEYCONF_MAX =3D (__OVPN_A_KEYCONF_MAX - 1) +}; + +enum { + OVPN_A_KEYDIR_CIPHER_KEY =3D 1, + OVPN_A_KEYDIR_NONCE_TAIL, + + __OVPN_A_KEYDIR_MAX, + OVPN_A_KEYDIR_MAX =3D (__OVPN_A_KEYDIR_MAX - 1) +}; + +enum { + OVPN_A_IFINDEX =3D 1, + OVPN_A_IFNAME, + OVPN_A_PEER, + OVPN_A_KEYCONF, + + __OVPN_A_MAX, + OVPN_A_MAX =3D (__OVPN_A_MAX - 1) +}; + +enum { + OVPN_CMD_PEER_NEW =3D 1, + OVPN_CMD_PEER_SET, + OVPN_CMD_PEER_GET, + OVPN_CMD_PEER_DEL, + OVPN_CMD_PEER_DEL_NTF, + OVPN_CMD_KEY_NEW, + OVPN_CMD_KEY_GET, + OVPN_CMD_KEY_SWAP, + OVPN_CMD_KEY_SWAP_NTF, + OVPN_CMD_KEY_DEL, + + __OVPN_CMD_MAX, + OVPN_CMD_MAX =3D (__OVPN_CMD_MAX - 1) +}; + +#define OVPN_MCGRP_PEERS "peers" + +#endif /* _UAPI_LINUX_OVPN_H */ --=20 2.45.2