From nobody Fri Dec 19 17:18:14 2025 Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EE5AC175D53 for ; Tue, 11 Feb 2025 00:41:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.54 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739234470; cv=none; b=G1msAfekjZgSLjL58IOiNF1CfNeRpWWnZ6Z7C12keofWwYLmIalD7HofwU8sCqIT6hA1yvKKVcCAjDKEHBWLmT2tVsHhI8jZdpf7W++nzAXR8Bux8mTmlVJIdhtwL+fahZ2FXCzU1lMLF0klp+SEQgSeW8nfGDOPtws4NgKCHhg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739234470; c=relaxed/simple; bh=ulHj8BFOHmgG83TdENoSAEhyFSrK1lbRU4rs56592F4=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=SX007YJfO3Vbippqp5CmPIP3lzpmEYomJ+znexTk5g2qLqpKSvF39YBucJi/2J0hT4z2c1CQyefcQuKL3z3ufO3sIM6UUcuBLrXRgtuFjx3j0n3qCeAgcI85AkCTwhsDk7CGfad2FTVCSB6Y/+W8eNdhgvIkDi6VgqUphpiMiJY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=openvpn.net; spf=pass smtp.mailfrom=openvpn.com; dkim=pass (2048-bit key) header.d=openvpn.net header.i=@openvpn.net header.b=TKOcfiQg; arc=none smtp.client-ip=209.85.128.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=openvpn.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=openvpn.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=openvpn.net header.i=@openvpn.net header.b="TKOcfiQg" Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-438a39e659cso34197385e9.2 for ; Mon, 10 Feb 2025 16:41:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvpn.net; s=google; t=1739234465; x=1739839265; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=pf5RIoBaNa2OS9sHoSpvPJwRV6Vk6MO3yovfkaDu1to=; b=TKOcfiQgJ7w6WXpeXRXIcv9AJwK6WQ2/bup3UldLOJbTVPnEXwu8+dEPj6azhVlAxf cvCoHC7pJoqCd4+lRCCNfaSf1frZxvGSdWOxIEJ8hGR4QyLmszJiOFnqojPjR0jcAcDg hps2PUwakpsPCnNJyRT9RJoVvOGghiND2NgGSV25MA5GZ82blSk5RHe1CPcmwZ/+r3xE uDQ4txbsIlBZBwPLJzudtjfiE0okxZU3d/zNKGo+j79pEF+207Tu4vBAINLd86n27t2c gm46jbDf5rKfbiKsslJnMSoqFLTz4q2gy8CU47ufHaNOqBGixCDV0ekIu/hxFMWlQyw2 we/A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1739234465; x=1739839265; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=pf5RIoBaNa2OS9sHoSpvPJwRV6Vk6MO3yovfkaDu1to=; b=iCZYbFy0/09ASmnF0uxAHSQu5heWaSHo3pBZmsXGZ2pHxfR0pwZpf/Bz0U7XWqvcEj WkCKo9W51eGfKgoUKsHRBKkJkilLfBcg7XIT//Q3HDtQZCrXkbqgPhS8xYnf+97B7osa skmCJGDc9E5BAHgJhuLmnzO0WdjIgtr70B1cnn5RYYl6RXWjzRaSEXNlZ2naLYEx066T Av6l86Lbns11sqSxD0JpEqz6SyC0cCenI26YNTLLiv5CjFxtWGedoVuhI3jH+WOixmvk WyaTtp/y5oLIdumJLOKoNJptKymZhMYPl3F8Y9ViefUAiPIESlK4tRkwW9Y1FqDCZUOG qa5g== X-Forwarded-Encrypted: i=1; AJvYcCW/VE7DG+D0fYyV7cjv7DTp8JZ9fHFihZxXVJzCHTECbMZzMUyjNrvm2Ua4Mn5oHT2KKl+kowf/Gi6tqhM=@vger.kernel.org X-Gm-Message-State: AOJu0YwOWnbUCcIbYp9CP0wAY6tMOHvE21RRAIlCQujOadfghjN5ZUTd QxvAFKF6jw6TSq0+rJ395n+8sTJkCwZGBOGpzr9xHBy4+PfwP6UPEndqjU+msNU= X-Gm-Gg: ASbGnctkNTiN+MpRLrnAVMOV1rcuLSVgwhSTcT2vkH1sW5FjqG3DrkpUaJyj1/ufRXO ZZ9ciPzi7y2/jfmoCba26HmXb2vDmVIo2+ANYRiHvyk5eL9VDmjXazvsLtZdvaTtfjRuFSfv3k+ R8rNBkVV+wLJPvj5SU+msFLfxuvgNa9WYhXp13NWObkFBxzDwZAi3/JrB4w0UefZ7I5l6xvXT6r CcdwfbI4PAa1huAImJXvaxManD3TPz7268mz5xkuIwzZ5KiQX2pCpye5zBONajAF7e0CDkuBjjJ iLUAQQUMxDWcMIhwEI1Hk4mTuss= X-Google-Smtp-Source: AGHT+IHRmkNJNhEakbadLF2m3fYljp/QV6GOh+l4qjs3mLSCYuV/EBofkyGlMReCYEJyDMXz1Pqpqg== X-Received: by 2002:a5d:5849:0:b0:38d:e572:4db4 with SMTP id ffacd0b85a97d-38de5724f7emr444554f8f.43.1739234465242; Mon, 10 Feb 2025 16:41:05 -0800 (PST) Received: from serenity.mandelbit.com ([2001:67c:2fbc:1:1255:949f:f81c:4f95]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4394dc1bed2sm3388435e9.0.2025.02.10.16.41.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 10 Feb 2025 16:41:04 -0800 (PST) From: Antonio Quartulli Date: Tue, 11 Feb 2025 01:40:00 +0100 Subject: [PATCH net-next v19 07/26] ovpn: implement basic TX path (UDP) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20250211-b4-ovpn-v19-7-86d5daf2a47a@openvpn.net> References: <20250211-b4-ovpn-v19-0-86d5daf2a47a@openvpn.net> In-Reply-To: <20250211-b4-ovpn-v19-0-86d5daf2a47a@openvpn.net> To: netdev@vger.kernel.org, Eric Dumazet , Jakub Kicinski , Paolo Abeni , Donald Hunter , Antonio Quartulli , Shuah Khan , sd@queasysnail.net, ryazanov.s.a@gmail.com, Andrew Lunn Cc: Simon Horman , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, Xiao Liang X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=16557; i=antonio@openvpn.net; h=from:subject:message-id; bh=ulHj8BFOHmgG83TdENoSAEhyFSrK1lbRU4rs56592F4=; b=owEBbQGS/pANAwAIAQtw5TqgONWHAcsmYgBnqpyMAg9abUF5xvJjFHFtf7hyGqNgS+JnAJwNu /6naSIGMPCJATMEAAEIAB0WIQSZq9xs+NQS5N5fwPwLcOU6oDjVhwUCZ6qcjAAKCRALcOU6oDjV hzfxB/9FT/6RZoMKRcsGnHbmDX0yK5/7aCmOEb6y/NIEB+OXNjXwIzIaVTnUahiGn6TPzrL7fRg mz5j6xjcN6KT9qfZbJ0n5iCgizI3CTdgoUzgjv9grj/69KTKzZ0ZlbKLlKZBLEdzQjPS+/fsLxT C2gKvvcY7Aya3YZN/ePY/bLzOGcLdqoZFT0wSC23fWO/3B3hXXkaupEAtw01/MWgOt43Zp74DUC YLPLu0WpTrkYzfazdikqyYF3mhsXQrrYgFFqhA7UB3TBcey+s7CymHaRBCkA0iPW7Sx3wgbqtqr VITHdf3zRjglCHK+iowNkV9bS5Anio9RO7k4qSj9G8nUeArP X-Developer-Key: i=antonio@openvpn.net; a=openpgp; fpr=CABDA1282017C267219885C748F0CCB68F59D14C Packets sent over the ovpn interface are processed and transmitted to the connected peer, if any. Implementation is UDP only. TCP will be added by a later patch. Note: no crypto/encapsulation exists yet. Packets are just captured and sent. Signed-off-by: Antonio Quartulli --- drivers/net/Kconfig | 1 + drivers/net/ovpn/io.c | 137 +++++++++++++++++++++++++++- drivers/net/ovpn/peer.c | 33 +++++++ drivers/net/ovpn/peer.h | 2 + drivers/net/ovpn/skb.h | 55 ++++++++++++ drivers/net/ovpn/udp.c | 234 ++++++++++++++++++++++++++++++++++++++++++++= ++++ drivers/net/ovpn/udp.h | 6 ++ 7 files changed, 467 insertions(+), 1 deletion(-) diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig index dfd1ad96230317c4118b63c9c98d0a631f6cbb21..b18ff941944e2e92aa769d1ebbc= 3d1782611fc06 100644 --- a/drivers/net/Kconfig +++ b/drivers/net/Kconfig @@ -120,6 +120,7 @@ config OVPN depends on NET && INET depends on IPV6 || !IPV6 select DST_CACHE + select NET_UDP_TUNNEL help This module enhances the performance of the OpenVPN userspace software by offloading the data channel processing to kernelspace. diff --git a/drivers/net/ovpn/io.c b/drivers/net/ovpn/io.c index ad3813419c33cbdfe7e8ad6f5c8b444a3540a69f..792521c89be6b365d0073772512= ea61bce6c228f 100644 --- a/drivers/net/ovpn/io.c +++ b/drivers/net/ovpn/io.c @@ -9,14 +9,149 @@ =20 #include #include +#include =20 #include "io.h" +#include "ovpnpriv.h" +#include "peer.h" +#include "udp.h" +#include "skb.h" +#include "socket.h" + +static void ovpn_encrypt_post(struct sk_buff *skb, int ret) +{ + struct ovpn_peer *peer =3D ovpn_skb_cb(skb)->peer; + struct ovpn_socket *sock; + + if (unlikely(ret < 0)) + goto err; + + skb_mark_not_on_list(skb); + + rcu_read_lock(); + sock =3D rcu_dereference(peer->sock); + if (unlikely(!sock)) + goto err_unlock; + + switch (sock->sock->sk->sk_protocol) { + case IPPROTO_UDP: + ovpn_udp_send_skb(peer, sock->sock, skb); + break; + default: + /* no transport configured yet */ + goto err_unlock; + } + /* skb passed down the stack - don't free it */ + skb =3D NULL; +err_unlock: + rcu_read_unlock(); +err: + if (unlikely(skb)) + dev_core_stats_tx_dropped_inc(peer->ovpn->dev); + ovpn_peer_put(peer); + kfree_skb(skb); +} + +static bool ovpn_encrypt_one(struct ovpn_peer *peer, struct sk_buff *skb) +{ + ovpn_skb_cb(skb)->peer =3D peer; + + /* take a reference to the peer because the crypto code may run async. + * ovpn_encrypt_post() will release it upon completion + */ + if (unlikely(!ovpn_peer_hold(peer))) { + DEBUG_NET_WARN_ON_ONCE(1); + return false; + } + + ovpn_encrypt_post(skb, 0); + return true; +} + +/* send skb to connected peer, if any */ +static void ovpn_send(struct ovpn_priv *ovpn, struct sk_buff *skb, + struct ovpn_peer *peer) +{ + struct sk_buff *curr, *next; + + /* this might be a GSO-segmented skb list: process each skb + * independently + */ + skb_list_walk_safe(skb, curr, next) { + if (unlikely(!ovpn_encrypt_one(peer, curr))) { + dev_core_stats_tx_dropped_inc(ovpn->dev); + kfree_skb(curr); + } + } + + ovpn_peer_put(peer); +} =20 /* Send user data to the network */ netdev_tx_t ovpn_net_xmit(struct sk_buff *skb, struct net_device *dev) { + struct ovpn_priv *ovpn =3D netdev_priv(dev); + struct sk_buff *segments, *curr, *next; + struct sk_buff_head skb_list; + struct ovpn_peer *peer; + __be16 proto; + int ret; + + /* reset netfilter state */ + nf_reset_ct(skb); + + /* verify IP header size in network packet */ + proto =3D ovpn_ip_check_protocol(skb); + if (unlikely(!proto || skb->protocol !=3D proto)) + goto drop; + + if (skb_is_gso(skb)) { + segments =3D skb_gso_segment(skb, 0); + if (IS_ERR(segments)) { + ret =3D PTR_ERR(segments); + net_err_ratelimited("%s: cannot segment payload packet: %d\n", + netdev_name(dev), ret); + goto drop; + } + + consume_skb(skb); + skb =3D segments; + } + + /* from this moment on, "skb" might be a list */ + + __skb_queue_head_init(&skb_list); + skb_list_walk_safe(skb, curr, next) { + skb_mark_not_on_list(curr); + + curr =3D skb_share_check(curr, GFP_ATOMIC); + if (unlikely(!curr)) { + net_err_ratelimited("%s: skb_share_check failed for payload packet\n", + netdev_name(dev)); + dev_core_stats_tx_dropped_inc(ovpn->dev); + continue; + } + + __skb_queue_tail(&skb_list, curr); + } + skb_list.prev->next =3D NULL; + + /* retrieve peer serving the destination IP of this packet */ + peer =3D ovpn_peer_get_by_dst(ovpn, skb); + if (unlikely(!peer)) { + net_dbg_ratelimited("%s: no peer to send data to\n", + netdev_name(ovpn->dev)); + goto drop; + } + + ovpn_send(ovpn, skb_list.next, peer); + + return NETDEV_TX_OK; + +drop: + dev_core_stats_tx_dropped_inc(ovpn->dev); skb_tx_error(skb); - kfree_skb(skb); + kfree_skb_list(skb); return NET_XMIT_DROP; } diff --git a/drivers/net/ovpn/peer.c b/drivers/net/ovpn/peer.c index f7324727ea40a5724c5b66eb873882a168de9c0a..606958515a7b9c0a82524c4bc3d= 3213d7ca4ed3f 100644 --- a/drivers/net/ovpn/peer.c +++ b/drivers/net/ovpn/peer.c @@ -16,6 +16,7 @@ #include "main.h" #include "netlink.h" #include "peer.h" +#include "socket.h" =20 /** * ovpn_peer_new - allocate and initialize a new peer object @@ -288,6 +289,38 @@ static void ovpn_peer_remove(struct ovpn_peer *peer, schedule_work(&peer->remove_work); } =20 +/** + * ovpn_peer_get_by_dst - Lookup peer to send skb to + * @ovpn: the private data representing the current VPN session + * @skb: the skb to extract the destination address from + * + * This function takes a tunnel packet and looks up the peer to send it to + * after encapsulation. The skb is expected to be the in-tunnel packet, wi= thout + * any OpenVPN related header. + * + * Assume that the IP header is accessible in the skb data. + * + * Return: the peer if found or NULL otherwise. + */ +struct ovpn_peer *ovpn_peer_get_by_dst(struct ovpn_priv *ovpn, + struct sk_buff *skb) +{ + struct ovpn_peer *peer =3D NULL; + + /* in P2P mode, no matter the destination, packets are always sent to + * the single peer listening on the other side + */ + if (ovpn->mode =3D=3D OVPN_MODE_P2P) { + rcu_read_lock(); + peer =3D rcu_dereference(ovpn->peer); + if (unlikely(peer && !ovpn_peer_hold(peer))) + peer =3D NULL; + rcu_read_unlock(); + } + + return peer; +} + /** * ovpn_peer_add_p2p - add peer to related tables in a P2P instance * @ovpn: the instance to add the peer to diff --git a/drivers/net/ovpn/peer.h b/drivers/net/ovpn/peer.h index 0f33bbe148cba13f9dc186e4470a15657c83c0d2..b678f06200a1ffe675e1c17ce2a= 9335c51ed8a27 100644 --- a/drivers/net/ovpn/peer.h +++ b/drivers/net/ovpn/peer.h @@ -80,5 +80,7 @@ void ovpn_peer_release_p2p(struct ovpn_priv *ovpn, struct ovpn_peer *ovpn_peer_get_by_transp_addr(struct ovpn_priv *ovpn, struct sk_buff *skb); struct ovpn_peer *ovpn_peer_get_by_id(struct ovpn_priv *ovpn, u32 peer_id); +struct ovpn_peer *ovpn_peer_get_by_dst(struct ovpn_priv *ovpn, + struct sk_buff *skb); =20 #endif /* _NET_OVPN_OVPNPEER_H_ */ diff --git a/drivers/net/ovpn/skb.h b/drivers/net/ovpn/skb.h new file mode 100644 index 0000000000000000000000000000000000000000..af7b1f5b0ee6033ce980978667c= 3ee99a90e1d1b --- /dev/null +++ b/drivers/net/ovpn/skb.h @@ -0,0 +1,55 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* OpenVPN data channel offload + * + * Copyright (C) 2020-2024 OpenVPN, Inc. + * + * Author: Antonio Quartulli + * James Yonan + */ + +#ifndef _NET_OVPN_SKB_H_ +#define _NET_OVPN_SKB_H_ + +#include +#include +#include +#include +#include +#include +#include + +struct ovpn_cb { + struct ovpn_peer *peer; +}; + +static inline struct ovpn_cb *ovpn_skb_cb(struct sk_buff *skb) +{ + BUILD_BUG_ON(sizeof(struct ovpn_cb) > sizeof(skb->cb)); + return (struct ovpn_cb *)skb->cb; +} + +/* Return IP protocol version from skb header. + * Return 0 if protocol is not IPv4/IPv6 or cannot be read. + */ +static inline __be16 ovpn_ip_check_protocol(struct sk_buff *skb) +{ + __be16 proto =3D 0; + + /* skb could be non-linear, + * make sure IP header is in non-fragmented part + */ + if (!pskb_network_may_pull(skb, sizeof(struct iphdr))) + return 0; + + if (ip_hdr(skb)->version =3D=3D 4) { + proto =3D htons(ETH_P_IP); + } else if (ip_hdr(skb)->version =3D=3D 6) { + if (!pskb_network_may_pull(skb, sizeof(struct ipv6hdr))) + return 0; + proto =3D htons(ETH_P_IPV6); + } + + return proto; +} + +#endif /* _NET_OVPN_SKB_H_ */ diff --git a/drivers/net/ovpn/udp.c b/drivers/net/ovpn/udp.c index e92e42f6c0ee12226a553cafc1529da9187a4903..9df662869df2a9f22b9b3fe4632= 15ac624e40c03 100644 --- a/drivers/net/ovpn/udp.c +++ b/drivers/net/ovpn/udp.c @@ -7,15 +7,249 @@ */ =20 #include +#include +#include #include #include +#include +#include +#include +#include #include +#include =20 #include "ovpnpriv.h" #include "main.h" +#include "bind.h" +#include "io.h" +#include "peer.h" #include "socket.h" #include "udp.h" =20 +/** + * ovpn_udp4_output - send IPv4 packet over udp socket + * @peer: the destination peer + * @bind: the binding related to the destination peer + * @cache: dst cache + * @sk: the socket to send the packet over + * @skb: the packet to send + * + * Return: 0 on success or a negative error code otherwise + */ +static int ovpn_udp4_output(struct ovpn_peer *peer, struct ovpn_bind *bind, + struct dst_cache *cache, struct sock *sk, + struct sk_buff *skb) +{ + struct rtable *rt; + struct flowi4 fl =3D { + .saddr =3D bind->local.ipv4.s_addr, + .daddr =3D bind->remote.in4.sin_addr.s_addr, + .fl4_sport =3D inet_sk(sk)->inet_sport, + .fl4_dport =3D bind->remote.in4.sin_port, + .flowi4_proto =3D sk->sk_protocol, + .flowi4_mark =3D sk->sk_mark, + }; + int ret; + + local_bh_disable(); + rt =3D dst_cache_get_ip4(cache, &fl.saddr); + if (rt) + goto transmit; + + if (unlikely(!inet_confirm_addr(sock_net(sk), NULL, 0, fl.saddr, + RT_SCOPE_HOST))) { + /* we may end up here when the cached address is not usable + * anymore. In this case we reset address/cache and perform a + * new look up + */ + fl.saddr =3D 0; + spin_lock_bh(&peer->lock); + bind->local.ipv4.s_addr =3D 0; + spin_unlock_bh(&peer->lock); + dst_cache_reset(cache); + } + + rt =3D ip_route_output_flow(sock_net(sk), &fl, sk); + if (IS_ERR(rt) && PTR_ERR(rt) =3D=3D -EINVAL) { + fl.saddr =3D 0; + spin_lock_bh(&peer->lock); + bind->local.ipv4.s_addr =3D 0; + spin_unlock_bh(&peer->lock); + dst_cache_reset(cache); + + rt =3D ip_route_output_flow(sock_net(sk), &fl, sk); + } + + if (IS_ERR(rt)) { + ret =3D PTR_ERR(rt); + net_dbg_ratelimited("%s: no route to host %pISpc: %d\n", + netdev_name(peer->ovpn->dev), + &bind->remote.in4, + ret); + goto err; + } + dst_cache_set_ip4(cache, &rt->dst, fl.saddr); + +transmit: + udp_tunnel_xmit_skb(rt, sk, skb, fl.saddr, fl.daddr, 0, + ip4_dst_hoplimit(&rt->dst), 0, fl.fl4_sport, + fl.fl4_dport, false, sk->sk_no_check_tx); + ret =3D 0; +err: + local_bh_enable(); + return ret; +} + +#if IS_ENABLED(CONFIG_IPV6) +/** + * ovpn_udp6_output - send IPv6 packet over udp socket + * @peer: the destination peer + * @bind: the binding related to the destination peer + * @cache: dst cache + * @sk: the socket to send the packet over + * @skb: the packet to send + * + * Return: 0 on success or a negative error code otherwise + */ +static int ovpn_udp6_output(struct ovpn_peer *peer, struct ovpn_bind *bind, + struct dst_cache *cache, struct sock *sk, + struct sk_buff *skb) +{ + struct dst_entry *dst; + int ret; + + struct flowi6 fl =3D { + .saddr =3D bind->local.ipv6, + .daddr =3D bind->remote.in6.sin6_addr, + .fl6_sport =3D inet_sk(sk)->inet_sport, + .fl6_dport =3D bind->remote.in6.sin6_port, + .flowi6_proto =3D sk->sk_protocol, + .flowi6_mark =3D sk->sk_mark, + .flowi6_oif =3D bind->remote.in6.sin6_scope_id, + }; + + local_bh_disable(); + dst =3D dst_cache_get_ip6(cache, &fl.saddr); + if (dst) + goto transmit; + + if (unlikely(!ipv6_chk_addr(sock_net(sk), &fl.saddr, NULL, 0))) { + /* we may end up here when the cached address is not usable + * anymore. In this case we reset address/cache and perform a + * new look up + */ + fl.saddr =3D in6addr_any; + spin_lock_bh(&peer->lock); + bind->local.ipv6 =3D in6addr_any; + spin_unlock_bh(&peer->lock); + dst_cache_reset(cache); + } + + dst =3D ipv6_stub->ipv6_dst_lookup_flow(sock_net(sk), sk, &fl, NULL); + if (IS_ERR(dst)) { + ret =3D PTR_ERR(dst); + net_dbg_ratelimited("%s: no route to host %pISpc: %d\n", + netdev_name(peer->ovpn->dev), + &bind->remote.in6, ret); + goto err; + } + dst_cache_set_ip6(cache, dst, &fl.saddr); + +transmit: + udp_tunnel6_xmit_skb(dst, sk, skb, skb->dev, &fl.saddr, &fl.daddr, 0, + ip6_dst_hoplimit(dst), 0, fl.fl6_sport, + fl.fl6_dport, udp_get_no_check6_tx(sk)); + ret =3D 0; +err: + local_bh_enable(); + return ret; +} +#endif + +/** + * ovpn_udp_output - transmit skb using udp-tunnel + * @peer: the destination peer + * @cache: dst cache + * @sk: the socket to send the packet over + * @skb: the packet to send + * + * rcu_read_lock should be held on entry. + * On return, the skb is consumed. + * + * Return: 0 on success or a negative error code otherwise + */ +static int ovpn_udp_output(struct ovpn_peer *peer, struct dst_cache *cache, + struct sock *sk, struct sk_buff *skb) +{ + struct ovpn_bind *bind; + int ret; + + /* set sk to null if skb is already orphaned */ + if (!skb->destructor) + skb->sk =3D NULL; + + /* always permit openvpn-created packets to be (outside) fragmented */ + skb->ignore_df =3D 1; + + rcu_read_lock(); + bind =3D rcu_dereference(peer->bind); + if (unlikely(!bind)) { + net_warn_ratelimited("%s: no bind for remote peer %u\n", + netdev_name(peer->ovpn->dev), peer->id); + ret =3D -ENODEV; + goto out; + } + + switch (bind->remote.in4.sin_family) { + case AF_INET: + ret =3D ovpn_udp4_output(peer, bind, cache, sk, skb); + break; +#if IS_ENABLED(CONFIG_IPV6) + case AF_INET6: + ret =3D ovpn_udp6_output(peer, bind, cache, sk, skb); + break; +#endif + default: + ret =3D -EAFNOSUPPORT; + break; + } + +out: + rcu_read_unlock(); + return ret; +} + +/** + * ovpn_udp_send_skb - prepare skb and send it over via UDP + * @peer: the destination peer + * @sock: the RCU protected peer socket + * @skb: the packet to send + */ +void ovpn_udp_send_skb(struct ovpn_peer *peer, struct socket *sock, + struct sk_buff *skb) +{ + int ret =3D -1; + + skb->dev =3D peer->ovpn->dev; + /* no checksum performed at this layer */ + skb->ip_summed =3D CHECKSUM_NONE; + + /* get socket info */ + if (unlikely(!sock)) { + net_warn_ratelimited("%s: no sock for remote peer %u\n", + netdev_name(peer->ovpn->dev), peer->id); + goto out; + } + + /* crypto layer -> transport (UDP) */ + ret =3D ovpn_udp_output(peer, &peer->dst_cache, sock->sk, skb); +out: + if (unlikely(ret < 0)) { + kfree_skb(skb); + return; + } +} + /** * ovpn_udp_socket_attach - set udp-tunnel CBs on socket and link it to ov= pn * @sock: socket to configure diff --git a/drivers/net/ovpn/udp.h b/drivers/net/ovpn/udp.h index 1864f123f99d29b5e814679404276f8f8c3876c2..24d121cc41f33dd7c89d446e02b= 0a2ba8195b3b0 100644 --- a/drivers/net/ovpn/udp.h +++ b/drivers/net/ovpn/udp.h @@ -9,10 +9,16 @@ #ifndef _NET_OVPN_UDP_H_ #define _NET_OVPN_UDP_H_ =20 +#include + +struct ovpn_peer; struct ovpn_priv; struct socket; =20 int ovpn_udp_socket_attach(struct socket *sock, struct ovpn_priv *ovpn); void ovpn_udp_socket_detach(struct ovpn_socket *ovpn_sock); =20 +void ovpn_udp_send_skb(struct ovpn_peer *peer, struct socket *sock, + struct sk_buff *skb); + #endif /* _NET_OVPN_UDP_H_ */ --=20 2.45.3