From nobody Wed Mar 12 17:51:36 2025 Received: from mail-wr1-f48.google.com (mail-wr1-f48.google.com [209.85.221.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6C16E25D1FB for ; Tue, 11 Mar 2025 12:03:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.48 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741694616; cv=none; b=J3kNpUTT6DurJEhmtPf+o7vUy08OZ2fkTVvGnzUIN/at8R8jcsvPJMRjBZPZm7L3jFeOGEe0F2wR2Ijous9g6E5kHstidsYZ7cQ7Mq8HcMJv7gQBxKaZcWk8+9zc8araPy8K+m83caG5esFbwF+8SL3qPKJMmbPqjkrdBzCiT8o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741694616; c=relaxed/simple; bh=713g+yJ0g6AOQeSG8hgjY1V7Dkeft1yz/AuoWsjjQ+U=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=mrulOM5joC+O4Owq3QOLTx1X5ecEQywB49XFma+ZYRGfCCxmnNMVNQ1XVo7eiKNj/Soj0b5ykL8INsMX67uNNwduFgPkAC4S6D8jC2jUXnQwFiTRzTeD1XTQO38JSghvNg9aRYICDSLbZRt3lS7sctPDUTzZMmwgz7drhcRZaIQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=openvpn.net; spf=pass smtp.mailfrom=openvpn.com; dkim=pass (2048-bit key) header.d=openvpn.net header.i=@openvpn.net header.b=TXmIdEuI; arc=none smtp.client-ip=209.85.221.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=openvpn.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=openvpn.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=openvpn.net header.i=@openvpn.net header.b="TXmIdEuI" Received: by mail-wr1-f48.google.com with SMTP id ffacd0b85a97d-38dcac27bcbso4166984f8f.0 for ; Tue, 11 Mar 2025 05:03:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvpn.net; s=google; t=1741694610; x=1742299410; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=a6gUk+2hKXkgBC8KMjj3S7nE1zCYTLZQuwKjk/vQ5h0=; b=TXmIdEuIYx0aLiU0/eLmVQCx4Cpp65zEu2gFvobEu4sZv9gR9iOV4ZrjAEhR+233s/ c7ytSMZj2p5cvVBmFgRFgS8isze3L6JYQlmY2aXWvb5Rc1Fk35p96WgaA/RIdCAellsl Snm3D+XgFveiAkHjp8DWY+q1cccdKQM5In2fnZQPd1c1/h4SZ8uRdZVLP/gdWLG0qEDC 9gZ38imQVISOc3Y64T2e4WOXaURFfOIc4exIzL5/Zu1zz5fRy/qHcz8K6bWqridx2e9A JQERQWMiX8zZz5EPh6oeJ0uF0BuYrAhllnibcbG6uFYFdag06M5EwBsWFBRVByWhT/Ve NFNw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1741694610; x=1742299410; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=a6gUk+2hKXkgBC8KMjj3S7nE1zCYTLZQuwKjk/vQ5h0=; b=hi74kJ8HlCrshMdqSBRcS1ZLWSQ2FiksvV8AfZi4n4CK0FJcA5f6Cg3aEwAHb3IP8d 95Wbd6ZYNCMj+nCqWT9QbgIuguyzaBk5jPRN0NipdEPjg9rntCQVby9sjLFxFOGmmzb5 PHPbdI/94cVtMWUwDO2pYn9S8Gm5O2dOUVhTSZKI/1DNhF2kaGRqwxvsrvERgvo/gPs6 zZG7LC+sU7PNAIqrWs4IZa4NySXd8r+406q33PIENOoM2ZE5EsXBn+nDojBNNq/M7QN9 F2ryubQjD8Wo1UoyEBE38O5BGoihZAELQ66h8SXiamL3C4ABNFR7rSjk1OS8z7+71YAz iIuQ== X-Forwarded-Encrypted: i=1; AJvYcCXJXCISwYRmJBpO/aqFSWkdeNb/Zxb2kStUj9wap/BJYS+LVd8Q7ivkw4GlnNhQBdDwz4qRduadwnimAAQ=@vger.kernel.org X-Gm-Message-State: AOJu0YwmafKCr7Nee5/z0fYfntXFv5eWOoIk6+OocHh/4M/q8zWzESm+ b6FdA2CY5cOvtJT5MLxeYkVdKjW+qAB8bV/an4mVWjdt8hx8z0mzO+79lxamfsd1BQLHPuC9drf p X-Gm-Gg: ASbGncvUPT4r91lzvHxIh6/fBtxaY2dLWMee6kycB0/m57Vj5RufLEclqbYDoLz5HMV KAlkq1EaJZCYHYhb1wXZFgA/wFM2Ei6bQ/+PYr2FjEP0JgiFBkal5t0YS1+it1Mc6BlOVpFwGoG GHjz+R+PLSOdHKaQl2CYneXkVLF3Xvj8G7PqDmEK6kEzF1mTciKZsedzM0ViZrmQG9Lcie2ufoU HXJff4FSyHJVChGMfGp2/ZPL4lkRY7HzrzQa2hkQPAt4/XUvksIELqDnbyRw2FJkbmL/QF/8Cxw ySz+JDYS2tiV84wbDSTi7xkwNLvb/NDt0JoCtlQ+Ig== X-Google-Smtp-Source: AGHT+IF2jc2WUCWXVL1lr9uSVDyKWrMCmX+4ZMrxy/SwBGT7ytYTqTk5e3BHKlCA4XvIBmsxDlSDQA== X-Received: by 2002:a5d:64c9:0:b0:391:22e2:ccd2 with SMTP id ffacd0b85a97d-3926bdf5b78mr3435058f8f.3.1741694609949; Tue, 11 Mar 2025 05:03:29 -0700 (PDT) Received: from [127.0.0.1] ([2001:67c:2fbc:1:52de:66e8:f2da:9714]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-43ceafc09d5sm110537605e9.31.2025.03.11.05.03.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Mar 2025 05:03:29 -0700 (PDT) From: Antonio Quartulli Date: Tue, 11 Mar 2025 13:02:20 +0100 Subject: [PATCH net-next v22 19/23] ovpn: implement key add/get/del/swap via netlink Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20250311-b4-ovpn-v22-19-2b7b02155412@openvpn.net> References: <20250311-b4-ovpn-v22-0-2b7b02155412@openvpn.net> In-Reply-To: <20250311-b4-ovpn-v22-0-2b7b02155412@openvpn.net> To: netdev@vger.kernel.org, Eric Dumazet , Jakub Kicinski , Paolo Abeni , Donald Hunter , Antonio Quartulli , Shuah Khan , sd@queasysnail.net, ryazanov.s.a@gmail.com, Andrew Lunn Cc: Simon Horman , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, Xiao Liang X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=13973; i=antonio@openvpn.net; h=from:subject:message-id; bh=713g+yJ0g6AOQeSG8hgjY1V7Dkeft1yz/AuoWsjjQ+U=; b=owEBbQGS/pANAwAIAQtw5TqgONWHAcsmYgBn0CZxp50IGleaMRjbYmXVzt8wENGoQrE4JkiZn SzYuqfxLn6JATMEAAEIAB0WIQSZq9xs+NQS5N5fwPwLcOU6oDjVhwUCZ9AmcQAKCRALcOU6oDjV h/6AB/9h8GRPvoGr2X946SHF4K+JWV5mkjQd7m8th3KkfdTwNb5ejWuCiEZwTInLJn2oeQA0Tzw E0OgZ7QJspmuH/S5DEcVqvDEXwgOj6qon0bz9Njh52wNYYqWs5+Aw2loBpHbfSeprhqYjvLxJ5U 7ftJNKQtU26ZqlkQts4LnhHMQXvME7NSy8eG21mdR2ALp7Dy44Ft9u4HkQLHFgAUuMBQKxp7Jf8 VKCtWxEZDfK5ERl53oflofQGBPiUREoKcGZUT4Epup0haM92EcCqwynnYawIBZGYyLJpKcOdzJn F+irw/tdLBqmvHm+zgbqsn1OnUdLjApqpboXhCV492cpT5+E X-Developer-Key: i=antonio@openvpn.net; a=openpgp; fpr=CABDA1282017C267219885C748F0CCB68F59D14C This change introduces the netlink commands needed to add, get, delete and swap keys for a specific peer. Userspace is expected to use these commands to create, inspect (non sensitive data only), destroy and rotate session keys for a specific peer. Signed-off-by: Antonio Quartulli --- drivers/net/ovpn/crypto.c | 40 ++++++ drivers/net/ovpn/crypto.h | 4 + drivers/net/ovpn/crypto_aead.c | 17 +++ drivers/net/ovpn/crypto_aead.h | 2 + drivers/net/ovpn/netlink.c | 301 +++++++++++++++++++++++++++++++++++++= +++- 5 files changed, 360 insertions(+), 4 deletions(-) diff --git a/drivers/net/ovpn/crypto.c b/drivers/net/ovpn/crypto.c index db243cb48142f4a20aaf7a29eadda1b19ea344a7..3c15d6d78f0f5ceeeb5ee39bfaa= a7005d01a87fc 100644 --- a/drivers/net/ovpn/crypto.c +++ b/drivers/net/ovpn/crypto.c @@ -150,3 +150,43 @@ void ovpn_crypto_key_slots_swap(struct ovpn_crypto_sta= te *cs) =20 spin_unlock_bh(&cs->lock); } + +/** + * ovpn_crypto_config_get - populate keyconf object with non-sensible key = data + * @cs: the crypto state to extract the key data from + * @slot: the specific slot to inspect + * @keyconf: the output object to populate + * + * Return: 0 on success or a negative error code otherwise + */ +int ovpn_crypto_config_get(struct ovpn_crypto_state *cs, + enum ovpn_key_slot slot, + struct ovpn_key_config *keyconf) +{ + struct ovpn_crypto_key_slot *ks; + int idx; + + switch (slot) { + case OVPN_KEY_SLOT_PRIMARY: + idx =3D cs->primary_idx; + break; + case OVPN_KEY_SLOT_SECONDARY: + idx =3D !cs->primary_idx; + break; + default: + return -EINVAL; + } + + rcu_read_lock(); + ks =3D rcu_dereference(cs->slots[idx]); + if (!ks) { + rcu_read_unlock(); + return -ENOENT; + } + + keyconf->cipher_alg =3D ovpn_aead_crypto_alg(ks); + keyconf->key_id =3D ks->key_id; + rcu_read_unlock(); + + return 0; +} diff --git a/drivers/net/ovpn/crypto.h b/drivers/net/ovpn/crypto.h index 5155791b87df7cccc76a011fa751686180074982..487d24a7d26635c9ca0fd66c757= 17502f60e7a0c 100644 --- a/drivers/net/ovpn/crypto.h +++ b/drivers/net/ovpn/crypto.h @@ -136,4 +136,8 @@ void ovpn_crypto_state_release(struct ovpn_crypto_state= *cs); =20 void ovpn_crypto_key_slots_swap(struct ovpn_crypto_state *cs); =20 +int ovpn_crypto_config_get(struct ovpn_crypto_state *cs, + enum ovpn_key_slot slot, + struct ovpn_key_config *keyconf); + #endif /* _NET_OVPN_OVPNCRYPTO_H_ */ diff --git a/drivers/net/ovpn/crypto_aead.c b/drivers/net/ovpn/crypto_aead.c index e87e33f49c3088a21f7032e9fd9b2bb0aa50ef83..26efe72987f3c3858f9398a757b= 6a70128c498bd 100644 --- a/drivers/net/ovpn/crypto_aead.c +++ b/drivers/net/ovpn/crypto_aead.c @@ -390,3 +390,20 @@ ovpn_aead_crypto_key_slot_new(const struct ovpn_key_co= nfig *kc) ovpn_aead_crypto_key_slot_destroy(ks); return ERR_PTR(ret); } + +enum ovpn_cipher_alg ovpn_aead_crypto_alg(struct ovpn_crypto_key_slot *ks) +{ + const char *alg_name; + + if (!ks->encrypt) + return OVPN_CIPHER_ALG_NONE; + + alg_name =3D crypto_tfm_alg_name(crypto_aead_tfm(ks->encrypt)); + + if (!strcmp(alg_name, ALG_NAME_AES)) + return OVPN_CIPHER_ALG_AES_GCM; + else if (!strcmp(alg_name, ALG_NAME_CHACHAPOLY)) + return OVPN_CIPHER_ALG_CHACHA20_POLY1305; + else + return OVPN_CIPHER_ALG_NONE; +} diff --git a/drivers/net/ovpn/crypto_aead.h b/drivers/net/ovpn/crypto_aead.h index 40c056558add3b9d17fda5c43eb858cb44c95945..65a2ff30789862bf52bbda389a9= 95f8edff48e7e 100644 --- a/drivers/net/ovpn/crypto_aead.h +++ b/drivers/net/ovpn/crypto_aead.h @@ -24,4 +24,6 @@ struct ovpn_crypto_key_slot * ovpn_aead_crypto_key_slot_new(const struct ovpn_key_config *kc); void ovpn_aead_crypto_key_slot_destroy(struct ovpn_crypto_key_slot *ks); =20 +enum ovpn_cipher_alg ovpn_aead_crypto_alg(struct ovpn_crypto_key_slot *ks); + #endif /* _NET_OVPN_OVPNAEAD_H_ */ diff --git a/drivers/net/ovpn/netlink.c b/drivers/net/ovpn/netlink.c index 407b5b908be431625a3c258e7887211ef0f4b197..0dedafea01858bddd457af0c956= 14e61c113682e 100644 --- a/drivers/net/ovpn/netlink.c +++ b/drivers/net/ovpn/netlink.c @@ -17,6 +17,7 @@ #include "netlink.h" #include "netlink-gen.h" #include "bind.h" +#include "crypto.h" #include "peer.h" #include "socket.h" =20 @@ -781,24 +782,316 @@ int ovpn_nl_peer_del_doit(struct sk_buff *skb, struc= t genl_info *info) return ret; } =20 +static int ovpn_nl_get_key_dir(struct genl_info *info, struct nlattr *key, + enum ovpn_cipher_alg cipher, + struct ovpn_key_direction *dir) +{ + struct nlattr *attrs[OVPN_A_KEYDIR_MAX + 1]; + int ret; + + ret =3D nla_parse_nested(attrs, OVPN_A_KEYDIR_MAX, key, + ovpn_keydir_nl_policy, info->extack); + if (ret) + return ret; + + switch (cipher) { + case OVPN_CIPHER_ALG_AES_GCM: + case OVPN_CIPHER_ALG_CHACHA20_POLY1305: + if (NL_REQ_ATTR_CHECK(info->extack, key, attrs, + OVPN_A_KEYDIR_CIPHER_KEY) || + NL_REQ_ATTR_CHECK(info->extack, key, attrs, + OVPN_A_KEYDIR_NONCE_TAIL)) + return -EINVAL; + + dir->cipher_key =3D nla_data(attrs[OVPN_A_KEYDIR_CIPHER_KEY]); + dir->cipher_key_size =3D nla_len(attrs[OVPN_A_KEYDIR_CIPHER_KEY]); + + /* These algorithms require a 96bit nonce, + * Construct it by combining 4-bytes packet id and + * 8-bytes nonce-tail from userspace + */ + dir->nonce_tail =3D nla_data(attrs[OVPN_A_KEYDIR_NONCE_TAIL]); + dir->nonce_tail_size =3D nla_len(attrs[OVPN_A_KEYDIR_NONCE_TAIL]); + break; + default: + NL_SET_ERR_MSG_MOD(info->extack, "unsupported cipher"); + return -EINVAL; + } + + return 0; +} + +/** + * ovpn_nl_key_new_doit - configure a new key for the specified peer + * @skb: incoming netlink message + * @info: genetlink metadata + * + * This function allows the user to install a new key in the peer crypto + * state. + * Each peer has two 'slots', namely 'primary' and 'secondary', where + * keys can be installed. The key in the 'primary' slot is used for + * encryption, while both keys can be used for decryption by matching the + * key ID carried in the incoming packet. + * + * The user is responsible for rotating keys when necessary. The user + * may fetch peer traffic statistics via netlink in order to better + * identify the right time to rotate keys. + * The renegotiation follows these steps: + * 1. a new key is computed by the user and is installed in the 'secondary' + * slot + * 2. at user discretion (usually after a predetermined time) 'primary' and + * 'secondary' contents are swapped and the new key starts being used f= or + * encryption, while the old key is kept around for decryption of late + * packets. + * + * Return: 0 on success or a negative error code otherwise. + */ int ovpn_nl_key_new_doit(struct sk_buff *skb, struct genl_info *info) { - return -EOPNOTSUPP; + struct nlattr *attrs[OVPN_A_KEYCONF_MAX + 1]; + struct ovpn_priv *ovpn =3D info->user_ptr[0]; + struct ovpn_peer_key_reset pkr; + struct ovpn_peer *peer; + u32 peer_id; + int ret; + + if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF)) + return -EINVAL; + + ret =3D nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX, + info->attrs[OVPN_A_KEYCONF], + ovpn_keyconf_nl_policy, info->extack); + if (ret) + return ret; + + if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, + OVPN_A_KEYCONF_PEER_ID)) + return -EINVAL; + + if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, + OVPN_A_KEYCONF_SLOT) || + NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, + OVPN_A_KEYCONF_KEY_ID) || + NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, + OVPN_A_KEYCONF_CIPHER_ALG) || + NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, + OVPN_A_KEYCONF_ENCRYPT_DIR) || + NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, + OVPN_A_KEYCONF_DECRYPT_DIR)) + return -EINVAL; + + pkr.slot =3D nla_get_u32(attrs[OVPN_A_KEYCONF_SLOT]); + pkr.key.key_id =3D nla_get_u32(attrs[OVPN_A_KEYCONF_KEY_ID]); + pkr.key.cipher_alg =3D nla_get_u32(attrs[OVPN_A_KEYCONF_CIPHER_ALG]); + + ret =3D ovpn_nl_get_key_dir(info, attrs[OVPN_A_KEYCONF_ENCRYPT_DIR], + pkr.key.cipher_alg, &pkr.key.encrypt); + if (ret < 0) + return ret; + + ret =3D ovpn_nl_get_key_dir(info, attrs[OVPN_A_KEYCONF_DECRYPT_DIR], + pkr.key.cipher_alg, &pkr.key.decrypt); + if (ret < 0) + return ret; + + peer_id =3D nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]); + peer =3D ovpn_peer_get_by_id(ovpn, peer_id); + if (!peer) { + NL_SET_ERR_MSG_FMT_MOD(info->extack, + "no peer with id %u to set key for", + peer_id); + return -ENOENT; + } + + ret =3D ovpn_crypto_state_reset(&peer->crypto, &pkr); + if (ret < 0) { + NL_SET_ERR_MSG_FMT_MOD(info->extack, + "cannot install new key for peer %u", + peer_id); + goto out; + } + + netdev_dbg(ovpn->dev, "new key installed (id=3D%u) for peer %u\n", + pkr.key.key_id, peer_id); +out: + ovpn_peer_put(peer); + return ret; +} + +static int ovpn_nl_send_key(struct sk_buff *skb, const struct genl_info *i= nfo, + u32 peer_id, enum ovpn_key_slot slot, + const struct ovpn_key_config *keyconf) +{ + struct nlattr *attr; + void *hdr; + + hdr =3D genlmsg_put(skb, info->snd_portid, info->snd_seq, &ovpn_nl_family, + 0, OVPN_CMD_KEY_GET); + if (!hdr) + return -ENOBUFS; + + attr =3D nla_nest_start(skb, OVPN_A_KEYCONF); + if (!attr) + goto err; + + if (nla_put_u32(skb, OVPN_A_KEYCONF_PEER_ID, peer_id)) + goto err; + + if (nla_put_u32(skb, OVPN_A_KEYCONF_SLOT, slot) || + nla_put_u32(skb, OVPN_A_KEYCONF_KEY_ID, keyconf->key_id) || + nla_put_u32(skb, OVPN_A_KEYCONF_CIPHER_ALG, keyconf->cipher_alg)) + goto err; + + nla_nest_end(skb, attr); + genlmsg_end(skb, hdr); + + return 0; +err: + genlmsg_cancel(skb, hdr); + return -EMSGSIZE; } =20 int ovpn_nl_key_get_doit(struct sk_buff *skb, struct genl_info *info) { - return -EOPNOTSUPP; + struct nlattr *attrs[OVPN_A_KEYCONF_MAX + 1]; + struct ovpn_priv *ovpn =3D info->user_ptr[0]; + struct ovpn_key_config keyconf =3D { 0 }; + enum ovpn_key_slot slot; + struct ovpn_peer *peer; + struct sk_buff *msg; + u32 peer_id; + int ret; + + if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF)) + return -EINVAL; + + ret =3D nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX, + info->attrs[OVPN_A_KEYCONF], + ovpn_keyconf_nl_policy, info->extack); + if (ret) + return ret; + + if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, + OVPN_A_KEYCONF_PEER_ID)) + return -EINVAL; + + if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, + OVPN_A_KEYCONF_SLOT)) + return -EINVAL; + + peer_id =3D nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]); + peer =3D ovpn_peer_get_by_id(ovpn, peer_id); + if (!peer) { + NL_SET_ERR_MSG_FMT_MOD(info->extack, + "cannot find peer with id %u", peer_id); + return -ENOENT; + } + + slot =3D nla_get_u32(attrs[OVPN_A_KEYCONF_SLOT]); + + ret =3D ovpn_crypto_config_get(&peer->crypto, slot, &keyconf); + if (ret < 0) { + NL_SET_ERR_MSG_FMT_MOD(info->extack, + "cannot extract key from slot %u for peer %u", + slot, peer_id); + goto err; + } + + msg =3D nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); + if (!msg) { + ret =3D -ENOMEM; + goto err; + } + + ret =3D ovpn_nl_send_key(msg, info, peer->id, slot, &keyconf); + if (ret < 0) { + nlmsg_free(msg); + goto err; + } + + ret =3D genlmsg_reply(msg, info); +err: + ovpn_peer_put(peer); + return ret; } =20 int ovpn_nl_key_swap_doit(struct sk_buff *skb, struct genl_info *info) { - return -EOPNOTSUPP; + struct ovpn_priv *ovpn =3D info->user_ptr[0]; + struct nlattr *attrs[OVPN_A_PEER_MAX + 1]; + struct ovpn_peer *peer; + u32 peer_id; + int ret; + + if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF)) + return -EINVAL; + + ret =3D nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX, + info->attrs[OVPN_A_KEYCONF], + ovpn_keyconf_nl_policy, info->extack); + if (ret) + return ret; + + if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, + OVPN_A_KEYCONF_PEER_ID)) + return -EINVAL; + + peer_id =3D nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]); + peer =3D ovpn_peer_get_by_id(ovpn, peer_id); + if (!peer) { + NL_SET_ERR_MSG_FMT_MOD(info->extack, + "no peer with id %u to swap keys for", + peer_id); + return -ENOENT; + } + + ovpn_crypto_key_slots_swap(&peer->crypto); + ovpn_peer_put(peer); + + return 0; } =20 int ovpn_nl_key_del_doit(struct sk_buff *skb, struct genl_info *info) { - return -EOPNOTSUPP; + struct nlattr *attrs[OVPN_A_KEYCONF_MAX + 1]; + struct ovpn_priv *ovpn =3D info->user_ptr[0]; + enum ovpn_key_slot slot; + struct ovpn_peer *peer; + u32 peer_id; + int ret; + + if (GENL_REQ_ATTR_CHECK(info, OVPN_A_KEYCONF)) + return -EINVAL; + + ret =3D nla_parse_nested(attrs, OVPN_A_KEYCONF_MAX, + info->attrs[OVPN_A_KEYCONF], + ovpn_keyconf_nl_policy, info->extack); + if (ret) + return ret; + + if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, + OVPN_A_KEYCONF_PEER_ID)) + return -EINVAL; + + if (NL_REQ_ATTR_CHECK(info->extack, info->attrs[OVPN_A_KEYCONF], attrs, + OVPN_A_KEYCONF_SLOT)) + return -EINVAL; + + peer_id =3D nla_get_u32(attrs[OVPN_A_KEYCONF_PEER_ID]); + slot =3D nla_get_u32(attrs[OVPN_A_KEYCONF_SLOT]); + + peer =3D ovpn_peer_get_by_id(ovpn, peer_id); + if (!peer) { + NL_SET_ERR_MSG_FMT_MOD(info->extack, + "no peer with id %u to delete key for", + peer_id); + return -ENOENT; + } + + ovpn_crypto_key_slot_delete(&peer->crypto, slot); + ovpn_peer_put(peer); + + return 0; } =20 /** --=20 2.48.1