From patchwork Wed Dec 11 21:15:07 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Antonio Quartulli X-Patchwork-Id: 849484 Received: from mail-wm1-f44.google.com (mail-wm1-f44.google.com [209.85.128.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B1A081F2362 for ; Wed, 11 Dec 2024 21:32:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733952773; cv=none; b=DQXVsrR/BEA1a6bNe8sv81GdZQMev25hezWRQYH+aLBgyauqF8oG9HdMB4Mw/aWyTuhMdyomjbme7RxFLOOSuHtGA83UjnKy7XmWu7gLxYDKfUEkt9L3I7Ab0amOtS52hpPYgoEcEmgBLQKeJ+a4LTsn7I+BXoIaN1JZDKdgyEI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1733952773; c=relaxed/simple; bh=X3mTVEA+PgpFPZ6zk06BhXfFTGDpOorOn89sfnoavcI=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=UZB0rOBDQ8vVASVziISv3Y1/sxAfZk7hRM9+93lFHi8AVIIsrwi/ofjtfn5Pjju7otwFnbVIuk9brH8Q40Yr+vU6tTNnrtEwSE47rXfi5od06JEi0x4ZO52OlrAiW33u1q1LktB/86ZCwMqR9uzDvSbj+vj5ULVjhl7FpNpBT0g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=openvpn.net; spf=pass smtp.mailfrom=openvpn.com; dkim=pass (2048-bit key) header.d=openvpn.net header.i=@openvpn.net header.b=ZYe327uc; arc=none smtp.client-ip=209.85.128.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=openvpn.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=openvpn.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=openvpn.net header.i=@openvpn.net header.b="ZYe327uc" Received: by mail-wm1-f44.google.com with SMTP id 5b1f17b1804b1-43622354a3eso3014055e9.1 for ; Wed, 11 Dec 2024 13:32:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvpn.net; s=google; t=1733952769; x=1734557569; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=JuTvswZrfbk+Pwmni1boh1eY8SKytc8co2ge4ZsDCHE=; b=ZYe327uc+qUKu03JsYDqnWzrJqBRMTV9uMLDY+OikMiErrxHAnYy0DzZc77PMlThde DAtcMHVEhFtBUpUQBkjOALYSNry4MCvTsyY3F9ZNsbGssOXAKwYwDu1oTwK+hBw23oOI 70ekvo9GwGKjQ0R1kdjcU18Nz1LfIaASr8eWNukmZiOyQ0xb0PBUhucQfwKCkFwLSQIV KTtl71nPjdcx29xBqFijnneSBfi19Qvj1tDz/GXMfRmBpGDBH/dCc1HEtrBiEbE6Uuxa JGDADuY+vJXiA4vRIThy+/1qBF1jGkH8uvEm1AJLEpq5VMg0eQTmL5VqEBPtejJ6bXG/ Opnw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733952769; x=1734557569; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=JuTvswZrfbk+Pwmni1boh1eY8SKytc8co2ge4ZsDCHE=; b=p5IzRIGLMvjWESBagZVwaYzGU4S0jZF9quJ9dvcoy3bUD5TbkiJXGLZJG2VqPccKab 4c7hmY35W5pV99WGLK+gO7ZjePAkt/6iFd8+Hl6wWTQfOoZyXzpJnGMd8RUI/6NWTen1 gEAlxTTqtenGZxGkwDd0Q0suSB1Pk8BbHp6qUKcUzUnFzCm9onxpbPxJaT320wDHNgI9 RQTGPmisjmDYoUNc+y97iStpQmLgV+np0H20xu0s4au4DpvLfaDQwhYJYkYcAduoeN9T 2HwkKgF9eNys7Bh+pRSfccfgVRrSdqgXFISSmUdqjDMlYqcQam8IbjXUe/grw1gwx7pW jY1Q== X-Forwarded-Encrypted: i=1; AJvYcCU7BO3s6heWWUcmcspd/NaEsUjQFsC6x9BM3BPTfLSuifwW7dbCkTgw5Xoz+o9xAmD+OlFYSWoRpBQmEIeptjM=@vger.kernel.org X-Gm-Message-State: AOJu0Yx7lWy936wwkS75tyFdefaTdjaUU421c1zcMd5ru+NFesWqNxOP fAr8bX0xd4B5LqvllE6cB4tW4tefoJWbO5QfONKUzHFEFsg4X47CANGRC4FhT6k= X-Gm-Gg: ASbGnctbtx52fpsQPnb/EeXRy4/HiPSAkFNmU6v8BhdQMJ92V3SZVx2fteSVcq5r8Zw GK/UpdNAHju2k5VN1tLsiejmp+2tCb6KmFDOPm0U6xKIJq52ES0m6RZxG2jfaos9g1rFBA5GGok 6vzfWc1thg/xxFabaSxo6QNZtbkB0O5KDBS3DDTUUnfR8/+79GmKaL6YlyuNf2dUHFotRntSD2y r6JhqwGiv9FuBF3O4N4Gg1hWzSjF/MO2d6XRDMxxM+XEZxOqOYRea3IiP7lgLc7xg== X-Google-Smtp-Source: AGHT+IFjFulHhPdYv13DRsnGuLtfK+OfnvfknBWfW0b3ZVwI31ahIbhZQx4UUUGIjwucBhLfL8w7yA== X-Received: by 2002:adf:e192:0:b0:385:ee40:2d75 with SMTP id ffacd0b85a97d-3864ce559camr3810531f8f.20.1733952768864; Wed, 11 Dec 2024 13:32:48 -0800 (PST) Received: from serenity.mandelbit.com ([2001:67c:2fbc:1:3115:252a:3e6f:da41]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-3878248f5a0sm2136252f8f.13.2024.12.11.13.32.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Dec 2024 13:32:48 -0800 (PST) From: Antonio Quartulli Date: Wed, 11 Dec 2024 22:15:07 +0100 Subject: [PATCH net-next v15 03/22] ovpn: add basic interface creation/destruction/management routines Precedence: bulk X-Mailing-List: linux-kselftest@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-Id: <20241211-b4-ovpn-v15-3-314e2cad0618@openvpn.net> References: <20241211-b4-ovpn-v15-0-314e2cad0618@openvpn.net> In-Reply-To: <20241211-b4-ovpn-v15-0-314e2cad0618@openvpn.net> To: netdev@vger.kernel.org, Eric Dumazet , Jakub Kicinski , Paolo Abeni , Donald Hunter , Antonio Quartulli , Shuah Khan , sd@queasysnail.net, ryazanov.s.a@gmail.com, Andrew Lunn Cc: Simon Horman , linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, Xiao Liang X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=9741; i=antonio@openvpn.net; h=from:subject:message-id; bh=X3mTVEA+PgpFPZ6zk06BhXfFTGDpOorOn89sfnoavcI=; b=owEBbQGS/pANAwAIAQtw5TqgONWHAcsmYgBnWgUkeJRNTraCDcVXnWLzHn1QNdSjpcsHCcFBP Xjw1u4RGPOJATMEAAEIAB0WIQSZq9xs+NQS5N5fwPwLcOU6oDjVhwUCZ1oFJAAKCRALcOU6oDjV h+xUCACl74Tou+16RvcF368BY+ii/MTw4VJMm84dGH8jFFUCC31YKN4cTvnif4g8KIE90fu0nkV Y2+RYbTMcBYGHjoXmHHtrxBgAeMEpIuB4W+yPzBpvYhgN1Sbuxg0Ohy6eFZJCDwSh3VVcTH1hY5 yFVQb4uDFGax0gtYreDUdc5Es32pq2PKZquLJW4Wmh5Ij4Dkmo0Sht12ohp8tjna2LpbGYsrZ+p StDLIvUFcGFHeuJIKNubiOskgYPKu/X71aoTYK+ahCv62iFJw1U3h3xHwaDhiEhwNDrZ+ZWyx+F kdf1N8BEPIeDWJihod2ZCUbz3T5Wi7LG/Yfi6FH6CmVwLt4p X-Developer-Key: i=antonio@openvpn.net; a=openpgp; fpr=CABDA1282017C267219885C748F0CCB68F59D14C Add basic infrastructure for handling ovpn interfaces. Signed-off-by: Antonio Quartulli --- drivers/net/ovpn/Makefile | 1 + drivers/net/ovpn/io.c | 22 +++++++++ drivers/net/ovpn/io.h | 24 ++++++++++ drivers/net/ovpn/main.c | 102 +++++++++++++++++++++++++++++++++++++++--- drivers/net/ovpn/ovpnstruct.h | 6 +++ drivers/net/ovpn/proto.h | 38 ++++++++++++++++ include/uapi/linux/if_link.h | 15 +++++++ 7 files changed, 203 insertions(+), 5 deletions(-) diff --git a/drivers/net/ovpn/Makefile b/drivers/net/ovpn/Makefile index 19305a39e57eede2dc391aa0423702c5321649a6..201dc001419f1d99ae95c0ee0f96e68f8a4eac16 100644 --- a/drivers/net/ovpn/Makefile +++ b/drivers/net/ovpn/Makefile @@ -8,5 +8,6 @@ obj-$(CONFIG_OVPN) := ovpn.o ovpn-y += main.o +ovpn-y += io.o ovpn-y += netlink.o ovpn-y += netlink-gen.o diff --git a/drivers/net/ovpn/io.c b/drivers/net/ovpn/io.c new file mode 100644 index 0000000000000000000000000000000000000000..ad3813419c33cbdfe7e8ad6f5c8b444a3540a69f --- /dev/null +++ b/drivers/net/ovpn/io.c @@ -0,0 +1,22 @@ +// SPDX-License-Identifier: GPL-2.0 +/* OpenVPN data channel offload + * + * Copyright (C) 2019-2024 OpenVPN, Inc. + * + * Author: James Yonan + * Antonio Quartulli + */ + +#include +#include + +#include "io.h" + +/* Send user data to the network + */ +netdev_tx_t ovpn_net_xmit(struct sk_buff *skb, struct net_device *dev) +{ + skb_tx_error(skb); + kfree_skb(skb); + return NET_XMIT_DROP; +} diff --git a/drivers/net/ovpn/io.h b/drivers/net/ovpn/io.h new file mode 100644 index 0000000000000000000000000000000000000000..a90537e9af6c0d2f38da229bdc2d8c639f2d11d1 --- /dev/null +++ b/drivers/net/ovpn/io.h @@ -0,0 +1,24 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* OpenVPN data channel offload + * + * Copyright (C) 2019-2024 OpenVPN, Inc. + * + * Author: James Yonan + * Antonio Quartulli + */ + +#ifndef _NET_OVPN_OVPN_H_ +#define _NET_OVPN_OVPN_H_ + +/* DATA_V2 header size with AEAD encryption */ +#define OVPN_HEAD_ROOM (OVPN_OPCODE_SIZE + OVPN_NONCE_WIRE_SIZE + \ + 16 /* AEAD TAG length */ + \ + max(sizeof(struct udphdr), sizeof(struct tcphdr)) +\ + max(sizeof(struct ipv6hdr), sizeof(struct iphdr))) + +/* max padding required by encryption */ +#define OVPN_MAX_PADDING 16 + +netdev_tx_t ovpn_net_xmit(struct sk_buff *skb, struct net_device *dev); + +#endif /* _NET_OVPN_OVPN_H_ */ diff --git a/drivers/net/ovpn/main.c b/drivers/net/ovpn/main.c index 3475dab4b40f3edd882e05dbdf8badd03d7c78a3..60954c5b2b9254db1d24d01ac383935765c7ce5b 100644 --- a/drivers/net/ovpn/main.c +++ b/drivers/net/ovpn/main.c @@ -10,14 +10,42 @@ #include #include #include +#include +#include #include -#include +#include #include "ovpnstruct.h" #include "main.h" #include "netlink.h" +#include "io.h" +#include "proto.h" + +static int ovpn_net_open(struct net_device *dev) +{ + netif_tx_start_all_queues(dev); + return 0; +} + +static int ovpn_net_stop(struct net_device *dev) +{ + netif_tx_stop_all_queues(dev); + return 0; +} static const struct net_device_ops ovpn_netdev_ops = { + .ndo_open = ovpn_net_open, + .ndo_stop = ovpn_net_stop, + .ndo_start_xmit = ovpn_net_xmit, +}; + +static const struct device_type ovpn_type = { + .name = OVPN_FAMILY_NAME, +}; + +static const struct nla_policy ovpn_policy[IFLA_OVPN_MAX + 1] = { + [IFLA_OVPN_MODE] = NLA_POLICY_RANGE(NLA_U8, OVPN_MODE_P2P, + OVPN_MODE_MP), }; /** @@ -31,16 +59,69 @@ bool ovpn_dev_is_valid(const struct net_device *dev) return dev->netdev_ops == &ovpn_netdev_ops; } +static void ovpn_setup(struct net_device *dev) +{ + netdev_features_t feat = NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_RXCSUM | + NETIF_F_GSO | NETIF_F_GSO_SOFTWARE | + NETIF_F_HIGHDMA; + + dev->needs_free_netdev = true; + + dev->pcpu_stat_type = NETDEV_PCPU_STAT_TSTATS; + + dev->netdev_ops = &ovpn_netdev_ops; + + dev->hard_header_len = 0; + dev->addr_len = 0; + dev->mtu = ETH_DATA_LEN - OVPN_HEAD_ROOM; + dev->min_mtu = IPV4_MIN_MTU; + dev->max_mtu = IP_MAX_MTU - OVPN_HEAD_ROOM; + + dev->type = ARPHRD_NONE; + dev->flags = IFF_POINTOPOINT | IFF_NOARP; + dev->priv_flags |= IFF_NO_QUEUE; + + dev->lltx = true; + dev->features |= feat; + dev->hw_features |= feat; + dev->hw_enc_features |= feat; + + dev->needed_headroom = ALIGN(OVPN_HEAD_ROOM, 4); + dev->needed_tailroom = OVPN_MAX_PADDING; + + SET_NETDEV_DEVTYPE(dev, &ovpn_type); +} + static int ovpn_newlink(struct net *src_net, struct net_device *dev, struct nlattr *tb[], struct nlattr *data[], struct netlink_ext_ack *extack) { - return -EOPNOTSUPP; + struct ovpn_priv *ovpn = netdev_priv(dev); + enum ovpn_mode mode = OVPN_MODE_P2P; + + if (data && data[IFLA_OVPN_MODE]) { + mode = nla_get_u8(data[IFLA_OVPN_MODE]); + netdev_dbg(dev, "setting device mode: %u\n", mode); + } + + ovpn->dev = dev; + ovpn->mode = mode; + + /* turn carrier explicitly off after registration, this way state is + * clearly defined + */ + netif_carrier_off(dev); + + return register_netdevice(dev); } static struct rtnl_link_ops ovpn_link_ops = { .kind = "ovpn", .netns_refund = false, + .priv_size = sizeof(struct ovpn_priv), + .setup = ovpn_setup, + .policy = ovpn_policy, + .maxtype = IFLA_OVPN_MAX, .newlink = ovpn_newlink, .dellink = unregister_netdevice_queue, }; @@ -49,26 +130,37 @@ static int ovpn_netdev_notifier_call(struct notifier_block *nb, unsigned long state, void *ptr) { struct net_device *dev = netdev_notifier_info_to_dev(ptr); + struct ovpn_priv *ovpn; if (!ovpn_dev_is_valid(dev)) return NOTIFY_DONE; + ovpn = netdev_priv(dev); + switch (state) { case NETDEV_REGISTER: - /* add device to internal list for later destruction upon - * unregistration - */ + ovpn->registered = true; break; case NETDEV_UNREGISTER: + /* twiddle thumbs on netns device moves */ + if (dev->reg_state != NETREG_UNREGISTERING) + break; + /* can be delivered multiple times, so check registered flag, * then destroy the interface */ + if (!ovpn->registered) + return NOTIFY_DONE; + + netif_carrier_off(dev); + ovpn->registered = false; break; case NETDEV_POST_INIT: case NETDEV_GOING_DOWN: case NETDEV_DOWN: case NETDEV_UP: case NETDEV_PRE_UP: + break; default: return NOTIFY_DONE; } diff --git a/drivers/net/ovpn/ovpnstruct.h b/drivers/net/ovpn/ovpnstruct.h index b4e37e922fe5a5659e030174f1e42b3935967ca0..312bc22199383fed0746335fde3339646bb68b2b 100644 --- a/drivers/net/ovpn/ovpnstruct.h +++ b/drivers/net/ovpn/ovpnstruct.h @@ -11,15 +11,21 @@ #define _NET_OVPN_OVPNSTRUCT_H_ #include +#include +#include /** * struct ovpn_priv - per ovpn interface state * @dev: the actual netdev representing the tunnel * @dev_tracker: reference tracker for associated dev + * @registered: whether dev is still registered with netdev or not + * @mode: device operation mode (i.e. p2p, mp, ..) */ struct ovpn_priv { struct net_device *dev; netdevice_tracker dev_tracker; + bool registered; + enum ovpn_mode mode; }; #endif /* _NET_OVPN_OVPNSTRUCT_H_ */ diff --git a/drivers/net/ovpn/proto.h b/drivers/net/ovpn/proto.h new file mode 100644 index 0000000000000000000000000000000000000000..00bb3725ac7ab7040c97eb012c2639b2d6967de1 --- /dev/null +++ b/drivers/net/ovpn/proto.h @@ -0,0 +1,38 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* OpenVPN data channel offload + * + * Copyright (C) 2020-2024 OpenVPN, Inc. + * + * Author: Antonio Quartulli + * James Yonan + */ + +#ifndef _NET_OVPN_PROTO_H_ +#define _NET_OVPN_PROTO_H_ + +/* When the OpenVPN protocol is ran in AEAD mode, use + * the OpenVPN packet ID as the AEAD nonce: + * + * 00000005 521c3b01 4308c041 + * [seq # ] [ nonce_tail ] + * [ 12-byte full IV ] -> OVPN_NONCE_SIZE + * [4-bytes -> OVPN_NONCE_WIRE_SIZE + * on wire] + */ + +/* nonce size (96bits) as required by AEAD ciphers */ +#define OVPN_NONCE_SIZE 12 +/* last 8 bytes of AEAD nonce: provided by userspace and usually derived + * from key material generated during TLS handshake + */ +#define OVPN_NONCE_TAIL_SIZE 8 + +/* OpenVPN nonce size reduced by 8-byte nonce tail -- this is the + * size of the AEAD Associated Data (AD) sent over the wire + * and is normally the head of the IV + */ +#define OVPN_NONCE_WIRE_SIZE (OVPN_NONCE_SIZE - OVPN_NONCE_TAIL_SIZE) + +#define OVPN_OPCODE_SIZE 4 /* DATA_V2 opcode size */ + +#endif /* _NET_OVPN_PROTO_H_ */ diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h index 77730c340c8f3191bfc810f39662315370fd43b1..5652ca8936d19bf0e31d10caa6d74659ffd17ee1 100644 --- a/include/uapi/linux/if_link.h +++ b/include/uapi/linux/if_link.h @@ -1977,4 +1977,19 @@ enum { #define IFLA_DSA_MAX (__IFLA_DSA_MAX - 1) +/* OVPN section */ + +enum ovpn_mode { + OVPN_MODE_P2P, + OVPN_MODE_MP, +}; + +enum { + IFLA_OVPN_UNSPEC, + IFLA_OVPN_MODE, + __IFLA_OVPN_MAX, +}; + +#define IFLA_OVPN_MAX (__IFLA_OVPN_MAX - 1) + #endif /* _UAPI_LINUX_IF_LINK_H */