From nobody Wed Mar 12 17:49:51 2025 Received: from mail-wm1-f42.google.com (mail-wm1-f42.google.com [209.85.128.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6ADAB2566CE for ; Tue, 11 Mar 2025 12:03:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741694589; cv=none; b=rJVgHn55+o2D4fyBofZVc9la2n0ffZ+djHADuLMKJcCphXQLsQGvBTExEHXZ2t1CqjepTvzvf6WDfWuKqJGcIgT3B2wTwYO9+zHQFxUzX/hIH4iijwCvCavE3hSyKsnztU60tCsUQmQXXRa+7NUdrMnNk99OVIi5c7I4o8Xc0Cs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741694589; c=relaxed/simple; bh=uSOUWy2gcaOyxO2yK9ikZRNVlUZs3s1sA+GDp534zsQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=NttQ18hduXOi8fGxRcOTThyKxyJfasPejwTrtrR8wtDDaXuMvE3rD++yn5r3tcvXZpzSHEnBC4nnI1OKkW9TOdsCHGbieRgDgcpqZQzrxdJRgdlu3sFqlcVrr5+m2qvDtpb3mFAqqyYNxeHpr5WEy/F53bMsEIj3rzU2GvOH/os= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=openvpn.net; spf=pass smtp.mailfrom=openvpn.com; dkim=pass (2048-bit key) header.d=openvpn.net header.i=@openvpn.net header.b=FPGZRK3Z; arc=none smtp.client-ip=209.85.128.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=openvpn.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=openvpn.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=openvpn.net header.i=@openvpn.net header.b="FPGZRK3Z" Received: by mail-wm1-f42.google.com with SMTP id 5b1f17b1804b1-43d0618746bso2818325e9.2 for ; Tue, 11 Mar 2025 05:03:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvpn.net; s=google; t=1741694584; x=1742299384; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=nJil3tYFQ6KEuVJV8jEmM4Z9bHCAizOaFqQNQcAOScc=; b=FPGZRK3ZFKudFzbn8TS0y92/d6Jdply2+TyGVB429uEgFi9yXlHuKcdVlWUJ4O0EC7 3YkE1YgyA0Y/bvH46YWXYcu3Eky8YTKfhVjST0dqFjO2RaJff22d9OkCD5HDWLimzvO9 U7ndMi/rvsmNRV4jaYLR8bF3az/MntjYxTOsoqx93Y7A7U+xABwPB74ZeUD/SrdUSBbp AY395nmU8WvMP9Bz90p2qGf0TzCgOlqdlAp55UNlKvpn4juPj+PftaoeJnoGjY8uRXDw pB1ewerI5n+2ZhTHwVkDDYc+JjnZJYuu9mcRDUF82Q6g81lp/ukJgdeLka167jmnfofp NgHQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1741694584; x=1742299384; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=nJil3tYFQ6KEuVJV8jEmM4Z9bHCAizOaFqQNQcAOScc=; b=gH/Bhe6p0UTkngapiY8Z8qpBCesnnRiBPdNaGj3VwjGpA6VbDLfOsTuiGIeFHc5Jr/ Agrdn36tBqjHXxyhkmG6wmu8beP4uzLekbzpcd2YgmthkNdckESclXVLVBEXSBqd+ozc 5vnqr0HqewL4QKsLyd18LHnJcqP9bOXI4my8UI2d+0KUj7onyuSTMxk5ETHYAPhxNBRp bVP+kwRG1Z4aEWirEAehFmOEwYV0IVICMgj9VEivtm21wOp1VRmPpIK7m6z1l+P/eCFa eyjyoIxkE+9RONSfpyfPvm0zc8YHCLkYyWyn8ZExJk/9uZ2DYieXyOltjDLn3Wz8w8Z+ PZBQ== X-Forwarded-Encrypted: i=1; AJvYcCXxSVI/EviCs0JG4ktqTQU7Jp53dNyKMQ7hjvjQvnbOZ8+ZCLX7oyjiObgmTmCKpl9tsxa4ujq/ictXiEU=@vger.kernel.org X-Gm-Message-State: AOJu0Ywdw+Ckixp0WP275gP8tgKAzA7wkk/pIee6W9HQrGDsRKZWSjla CuQtOD/89jAQcW/9iAMOQm18bzQc+XkoYEDNW4ehijiNIUplwE2tK/bwqbPTrzKCDV2y4Se1erP j X-Gm-Gg: ASbGncvpE2Pp2zfS/y30Yf8vTftYH2bLsqd8PQJS2NT7fkCgS9fkgj8e85fMCA3PVQD YeqJmK7vWA731t4qe1OcEOLIy6M71YI/YPGvEJAmqUcltKmzS9TeVnmehokTOarFXlyUbSo2R/3 vjMAS+UKJVUW6S/UbSKuAomW40xNdVQoDjjDCGCX6CCDmls9nPACtFUIgY2YoFESey4BY4AZfIZ aoGqojQ9wUc/Cv0OfWkR3pKrcuhnZryuze014apPb9rVkyWu6Se7LLTFMn/MM3ySiPy24Sv0g+/ rAD4L6DJ0u/qGW7CqT42qaHtWAqIw3SrJu/8y8JfgVn4Qbh2lrY2 X-Google-Smtp-Source: AGHT+IF/5BwbigNPXOGfeuu2hIf8G4JuUiUJKtuTb77qRHcAFDB/8ZTFlgkCsw8TBzPV1TrYeqHoTw== X-Received: by 2002:a05:600c:1d18:b0:43c:f050:fed1 with SMTP id 5b1f17b1804b1-43cf051014bmr86457555e9.12.1741694584296; Tue, 11 Mar 2025 05:03:04 -0700 (PDT) Received: from [127.0.0.1] ([2001:67c:2fbc:1:52de:66e8:f2da:9714]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-43ceafc09d5sm110537605e9.31.2025.03.11.05.03.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Mar 2025 05:03:03 -0700 (PDT) From: Antonio Quartulli Date: Tue, 11 Mar 2025 13:02:04 +0100 Subject: [PATCH net-next v22 03/23] ovpn: add basic interface creation/destruction/management routines Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20250311-b4-ovpn-v22-3-2b7b02155412@openvpn.net> References: <20250311-b4-ovpn-v22-0-2b7b02155412@openvpn.net> In-Reply-To: <20250311-b4-ovpn-v22-0-2b7b02155412@openvpn.net> To: netdev@vger.kernel.org, Eric Dumazet , Jakub Kicinski , Paolo Abeni , Donald Hunter , Antonio Quartulli , Shuah Khan , sd@queasysnail.net, ryazanov.s.a@gmail.com, Andrew Lunn Cc: Simon Horman , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, Xiao Liang X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=11062; i=antonio@openvpn.net; h=from:subject:message-id; bh=uSOUWy2gcaOyxO2yK9ikZRNVlUZs3s1sA+GDp534zsQ=; b=owEBbQGS/pANAwAIAQtw5TqgONWHAcsmYgBn0CZwx9VbpwPxzaVq1a7++hC1/sTjkcRS2O5f7 OrbSGCud/eJATMEAAEIAB0WIQSZq9xs+NQS5N5fwPwLcOU6oDjVhwUCZ9AmcAAKCRALcOU6oDjV h4pdCACcpH39mOJ/8Xix66E33/l0B0SKBakIBMz++3SqEfrOMGLNnZI6NRbBYw0shNrokYeqC5Y vn0fmvatdljtZJzKFpCmwwTovEPCOpJW2Krosbv5na5sN6eSMEM5s+aS9k5DslOjFVCTH1p4r6o LLyY/IhPvFb1+mg+/3h+h46glvRW6KPoD0pgU0Lr1BPwtv6nImr7HZQ8kFWEzFls13/7FHB0H4H yOh7iIccz++A3PMFH7pdJZjkrnedk4bU277FrwZrpf24W00WeFZIxZo7VZfivVgIN5iDGHvxS4M DxYe3L35RZRTaKEZEQwUPJoTCukbUOSQCfluVciE2xyv8fiv X-Developer-Key: i=antonio@openvpn.net; a=openpgp; fpr=CABDA1282017C267219885C748F0CCB68F59D14C Add basic infrastructure for handling ovpn interfaces. Tested-by: Donald Hunter Signed-off-by: Antonio Quartulli --- Documentation/netlink/specs/rt_link.yaml | 16 +++++ drivers/net/ovpn/Makefile | 1 + drivers/net/ovpn/io.c | 22 ++++++ drivers/net/ovpn/io.h | 24 +++++++ drivers/net/ovpn/main.c | 114 +++++++++++++++++++++++++++= ++-- drivers/net/ovpn/ovpnpriv.h | 7 ++ drivers/net/ovpn/proto.h | 38 +++++++++++ include/uapi/linux/if_link.h | 15 ++++ 8 files changed, 232 insertions(+), 5 deletions(-) diff --git a/Documentation/netlink/specs/rt_link.yaml b/Documentation/netli= nk/specs/rt_link.yaml index 31238455f8e9d29531884cad4951391fa47ccfaf..a50d9d7d882e7e4f9de29b2a4e7= acc602972f6b3 100644 --- a/Documentation/netlink/specs/rt_link.yaml +++ b/Documentation/netlink/specs/rt_link.yaml @@ -938,6 +938,12 @@ definitions: entries: - name: none - name: default + - + name: ovpn-mode + type: enum + entries: + - p2p + - mp =20 attribute-sets: - @@ -2272,6 +2278,13 @@ attribute-sets: - name: tailroom type: u16 + - + name: linkinfo-ovpn-attrs + attributes: + - + name: mode + type: u8 + enum: ovpn-mode =20 sub-messages: - @@ -2322,6 +2335,9 @@ sub-messages: - value: netkit attribute-set: linkinfo-netkit-attrs + - + value: ovpn + attribute-set: linkinfo-ovpn-attrs - name: linkinfo-member-data-msg formats: diff --git a/drivers/net/ovpn/Makefile b/drivers/net/ovpn/Makefile index 75ac62bba02937bc49cb2a0dec5ca3cc31a8ee00..0e5f686672fb5052cee5a2c2879= 7b70859514a7f 100644 --- a/drivers/net/ovpn/Makefile +++ b/drivers/net/ovpn/Makefile @@ -8,5 +8,6 @@ =20 obj-$(CONFIG_OVPN) :=3D ovpn.o ovpn-y +=3D main.o +ovpn-y +=3D io.o ovpn-y +=3D netlink.o ovpn-y +=3D netlink-gen.o diff --git a/drivers/net/ovpn/io.c b/drivers/net/ovpn/io.c new file mode 100644 index 0000000000000000000000000000000000000000..4b71c38165d7adbb1a2d1a64d27= a13b7f76cfbfe --- /dev/null +++ b/drivers/net/ovpn/io.c @@ -0,0 +1,22 @@ +// SPDX-License-Identifier: GPL-2.0 +/* OpenVPN data channel offload + * + * Copyright (C) 2019-2025 OpenVPN, Inc. + * + * Author: James Yonan + * Antonio Quartulli + */ + +#include +#include + +#include "io.h" + +/* Send user data to the network + */ +netdev_tx_t ovpn_net_xmit(struct sk_buff *skb, struct net_device *dev) +{ + skb_tx_error(skb); + kfree_skb(skb); + return NET_XMIT_DROP; +} diff --git a/drivers/net/ovpn/io.h b/drivers/net/ovpn/io.h new file mode 100644 index 0000000000000000000000000000000000000000..afea5f81f5628dcb9afda9a7897= 4bbf6f2101c13 --- /dev/null +++ b/drivers/net/ovpn/io.h @@ -0,0 +1,24 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* OpenVPN data channel offload + * + * Copyright (C) 2019-2025 OpenVPN, Inc. + * + * Author: James Yonan + * Antonio Quartulli + */ + +#ifndef _NET_OVPN_OVPN_H_ +#define _NET_OVPN_OVPN_H_ + +/* DATA_V2 header size with AEAD encryption */ +#define OVPN_HEAD_ROOM (OVPN_OPCODE_SIZE + OVPN_NONCE_WIRE_SIZE + \ + 16 /* AEAD TAG length */ + \ + max(sizeof(struct udphdr), sizeof(struct tcphdr)) +\ + max(sizeof(struct ipv6hdr), sizeof(struct iphdr))) + +/* max padding required by encryption */ +#define OVPN_MAX_PADDING 16 + +netdev_tx_t ovpn_net_xmit(struct sk_buff *skb, struct net_device *dev); + +#endif /* _NET_OVPN_OVPN_H_ */ diff --git a/drivers/net/ovpn/main.c b/drivers/net/ovpn/main.c index 28133e7e15e74b8a4a937ed03f70d9f83d7a14c8..e71183e6f42cd801861caaec9eb= 0f6828b64cda9 100644 --- a/drivers/net/ovpn/main.c +++ b/drivers/net/ovpn/main.c @@ -10,14 +10,42 @@ #include #include #include +#include +#include #include -#include +#include =20 #include "ovpnpriv.h" #include "main.h" #include "netlink.h" +#include "io.h" +#include "proto.h" + +static int ovpn_net_open(struct net_device *dev) +{ + netif_tx_start_all_queues(dev); + return 0; +} + +static int ovpn_net_stop(struct net_device *dev) +{ + netif_tx_stop_all_queues(dev); + return 0; +} =20 static const struct net_device_ops ovpn_netdev_ops =3D { + .ndo_open =3D ovpn_net_open, + .ndo_stop =3D ovpn_net_stop, + .ndo_start_xmit =3D ovpn_net_xmit, +}; + +static const struct device_type ovpn_type =3D { + .name =3D OVPN_FAMILY_NAME, +}; + +static const struct nla_policy ovpn_policy[IFLA_OVPN_MAX + 1] =3D { + [IFLA_OVPN_MODE] =3D NLA_POLICY_RANGE(NLA_U8, OVPN_MODE_P2P, + OVPN_MODE_MP), }; =20 /** @@ -31,44 +59,120 @@ bool ovpn_dev_is_valid(const struct net_device *dev) return dev->netdev_ops =3D=3D &ovpn_netdev_ops; } =20 +static void ovpn_setup(struct net_device *dev) +{ + netdev_features_t feat =3D NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_RXCSUM | + NETIF_F_GSO | NETIF_F_GSO_SOFTWARE | + NETIF_F_HIGHDMA; + + dev->needs_free_netdev =3D true; + + dev->pcpu_stat_type =3D NETDEV_PCPU_STAT_TSTATS; + + dev->netdev_ops =3D &ovpn_netdev_ops; + + dev->hard_header_len =3D 0; + dev->addr_len =3D 0; + dev->mtu =3D ETH_DATA_LEN - OVPN_HEAD_ROOM; + dev->min_mtu =3D IPV4_MIN_MTU; + dev->max_mtu =3D IP_MAX_MTU - OVPN_HEAD_ROOM; + + dev->type =3D ARPHRD_NONE; + dev->flags =3D IFF_POINTOPOINT | IFF_NOARP; + dev->priv_flags |=3D IFF_NO_QUEUE; + + dev->lltx =3D true; + dev->features |=3D feat; + dev->hw_features |=3D feat; + dev->hw_enc_features |=3D feat; + + dev->needed_headroom =3D ALIGN(OVPN_HEAD_ROOM, 4); + dev->needed_tailroom =3D OVPN_MAX_PADDING; + + SET_NETDEV_DEVTYPE(dev, &ovpn_type); +} + static int ovpn_newlink(struct net_device *dev, struct rtnl_newlink_params *params, struct netlink_ext_ack *extack) { - return -EOPNOTSUPP; + struct ovpn_priv *ovpn =3D netdev_priv(dev); + struct nlattr **data =3D params->data; + enum ovpn_mode mode =3D OVPN_MODE_P2P; + + if (data && data[IFLA_OVPN_MODE]) { + mode =3D nla_get_u8(data[IFLA_OVPN_MODE]); + netdev_dbg(dev, "setting device mode: %u\n", mode); + } + + ovpn->dev =3D dev; + ovpn->mode =3D mode; + + /* turn carrier explicitly off after registration, this way state is + * clearly defined + */ + netif_carrier_off(dev); + + return register_netdevice(dev); +} + +static int ovpn_fill_info(struct sk_buff *skb, const struct net_device *de= v) +{ + struct ovpn_priv *ovpn =3D netdev_priv(dev); + + if (nla_put_u8(skb, IFLA_OVPN_MODE, ovpn->mode)) + return -EMSGSIZE; + + return 0; } =20 static struct rtnl_link_ops ovpn_link_ops =3D { .kind =3D "ovpn", .netns_refund =3D false, + .priv_size =3D sizeof(struct ovpn_priv), + .setup =3D ovpn_setup, + .policy =3D ovpn_policy, + .maxtype =3D IFLA_OVPN_MAX, .newlink =3D ovpn_newlink, .dellink =3D unregister_netdevice_queue, + .fill_info =3D ovpn_fill_info, }; =20 static int ovpn_netdev_notifier_call(struct notifier_block *nb, unsigned long state, void *ptr) { struct net_device *dev =3D netdev_notifier_info_to_dev(ptr); + struct ovpn_priv *ovpn; =20 if (!ovpn_dev_is_valid(dev)) return NOTIFY_DONE; =20 + ovpn =3D netdev_priv(dev); + switch (state) { case NETDEV_REGISTER: - /* add device to internal list for later destruction upon - * unregistration - */ + ovpn->registered =3D true; break; case NETDEV_UNREGISTER: + /* twiddle thumbs on netns device moves */ + if (dev->reg_state !=3D NETREG_UNREGISTERING) + break; + /* can be delivered multiple times, so check registered flag, * then destroy the interface */ + if (!ovpn->registered) + return NOTIFY_DONE; + + netif_carrier_off(dev); + ovpn->registered =3D false; break; case NETDEV_POST_INIT: case NETDEV_GOING_DOWN: case NETDEV_DOWN: case NETDEV_UP: case NETDEV_PRE_UP: + break; default: return NOTIFY_DONE; } diff --git a/drivers/net/ovpn/ovpnpriv.h b/drivers/net/ovpn/ovpnpriv.h index f9322536b06d6baa5524de57cd7d69f5ecbbd194..33c2a41edf9b3204e8aebd26796= 49cb7158f05f2 100644 --- a/drivers/net/ovpn/ovpnpriv.h +++ b/drivers/net/ovpn/ovpnpriv.h @@ -10,12 +10,19 @@ #ifndef _NET_OVPN_OVPNSTRUCT_H_ #define _NET_OVPN_OVPNSTRUCT_H_ =20 +#include +#include + /** * struct ovpn_priv - per ovpn interface state * @dev: the actual netdev representing the tunnel + * @registered: whether dev is still registered with netdev or not + * @mode: device operation mode (i.e. p2p, mp, ..) */ struct ovpn_priv { struct net_device *dev; + bool registered; + enum ovpn_mode mode; }; =20 #endif /* _NET_OVPN_OVPNSTRUCT_H_ */ diff --git a/drivers/net/ovpn/proto.h b/drivers/net/ovpn/proto.h new file mode 100644 index 0000000000000000000000000000000000000000..5f95a78bebd3702868ffeeab3ea= 4938e957d568c --- /dev/null +++ b/drivers/net/ovpn/proto.h @@ -0,0 +1,38 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* OpenVPN data channel offload + * + * Copyright (C) 2020-2025 OpenVPN, Inc. + * + * Author: Antonio Quartulli + * James Yonan + */ + +#ifndef _NET_OVPN_PROTO_H_ +#define _NET_OVPN_PROTO_H_ + +/* When the OpenVPN protocol is ran in AEAD mode, use + * the OpenVPN packet ID as the AEAD nonce: + * + * 00000005 521c3b01 4308c041 + * [seq # ] [ nonce_tail ] + * [ 12-byte full IV ] -> OVPN_NONCE_SIZE + * [4-bytes -> OVPN_NONCE_WIRE_SIZE + * on wire] + */ + +/* nonce size (96bits) as required by AEAD ciphers */ +#define OVPN_NONCE_SIZE 12 +/* last 8 bytes of AEAD nonce: provided by userspace and usually derived + * from key material generated during TLS handshake + */ +#define OVPN_NONCE_TAIL_SIZE 8 + +/* OpenVPN nonce size reduced by 8-byte nonce tail -- this is the + * size of the AEAD Associated Data (AD) sent over the wire + * and is normally the head of the IV + */ +#define OVPN_NONCE_WIRE_SIZE (OVPN_NONCE_SIZE - OVPN_NONCE_TAIL_SIZE) + +#define OVPN_OPCODE_SIZE 4 /* DATA_V2 opcode size */ + +#endif /* _NET_OVPN_PROTO_H_ */ diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h index 318386cc5b0d19ed6a37734feffb450353dd9440..3ad2d5d9803479a10a6b2cfab2d= f98ce0f823926 100644 --- a/include/uapi/linux/if_link.h +++ b/include/uapi/linux/if_link.h @@ -1986,4 +1986,19 @@ enum { =20 #define IFLA_DSA_MAX (__IFLA_DSA_MAX - 1) =20 +/* OVPN section */ + +enum ovpn_mode { + OVPN_MODE_P2P, + OVPN_MODE_MP, +}; + +enum { + IFLA_OVPN_UNSPEC, + IFLA_OVPN_MODE, + __IFLA_OVPN_MAX, +}; + +#define IFLA_OVPN_MAX (__IFLA_OVPN_MAX - 1) + #endif /* _UAPI_LINUX_IF_LINK_H */ --=20 2.48.1