ovpn: add support for asymmetric peer IDs

+16 -1

Documentation/netlink/specs/ovpn.yaml

··· 43 43 type: u32 44 44 doc: >- 45 45 The unique ID of the peer in the device context. To be used to 46 - identify peers during operations for a specific device 46 + identify peers during operations for a specific device. 47 + Also used to match packets received from this peer. 47 48 checks: 48 49 max: 0xFFFFFF 49 50 - ··· 161 160 name: link-tx-packets 162 161 type: uint 163 162 doc: Number of packets transmitted at the transport level 163 + - 164 + name: tx-id 165 + type: u32 166 + doc: >- 167 + The ID value used when transmitting packets to this peer. This 168 + way outgoing packets can have a different ID than incoming ones. 169 + Useful in multipeer-to-multipeer connections, where each peer 170 + will advertise the tx-id to be used on the link. 171 + checks: 172 + max: 0xFFFFFF 164 173 - 165 174 name: peer-new-input 166 175 subset-of: peer ··· 199 188 name: keepalive-interval 200 189 - 201 190 name: keepalive-timeout 191 + - 192 + name: tx-id 202 193 - 203 194 name: peer-set-input 204 195 subset-of: peer ··· 227 214 name: keepalive-interval 228 215 - 229 216 name: keepalive-timeout 217 + - 218 + name: tx-id 230 219 - 231 220 name: peer-del-input 232 221 subset-of: peer

+1 -1

drivers/net/ovpn/crypto_aead.c

··· 122 122 memcpy(skb->data, iv, OVPN_NONCE_WIRE_SIZE); 123 123 124 124 /* add packet op as head of additional data */ 125 - op = ovpn_opcode_compose(OVPN_DATA_V2, ks->key_id, peer->id); 125 + op = ovpn_opcode_compose(OVPN_DATA_V2, ks->key_id, peer->tx_id); 126 126 __skb_push(skb, OVPN_OPCODE_SIZE); 127 127 BUILD_BUG_ON(sizeof(op) != OVPN_OPCODE_SIZE); 128 128 *((__force __be32 *)skb->data) = htonl(op);

+10 -3

drivers/net/ovpn/netlink-gen.c

··· 16 16 .max = 16777215ULL, 17 17 }; 18 18 19 + static const struct netlink_range_validation ovpn_a_peer_tx_id_range = { 20 + .max = 16777215ULL, 21 + }; 22 + 19 23 static const struct netlink_range_validation ovpn_a_keyconf_peer_id_range = { 20 24 .max = 16777215ULL, 21 25 }; ··· 55 51 [OVPN_A_KEYDIR_NONCE_TAIL] = NLA_POLICY_EXACT_LEN(OVPN_NONCE_TAIL_SIZE), 56 52 }; 57 53 58 - const struct nla_policy ovpn_peer_nl_policy[OVPN_A_PEER_LINK_TX_PACKETS + 1] = { 54 + const struct nla_policy ovpn_peer_nl_policy[OVPN_A_PEER_TX_ID + 1] = { 59 55 [OVPN_A_PEER_ID] = NLA_POLICY_FULL_RANGE(NLA_U32, &ovpn_a_peer_id_range), 60 56 [OVPN_A_PEER_REMOTE_IPV4] = { .type = NLA_BE32, }, 61 57 [OVPN_A_PEER_REMOTE_IPV6] = NLA_POLICY_EXACT_LEN(16), ··· 79 75 [OVPN_A_PEER_LINK_TX_BYTES] = { .type = NLA_UINT, }, 80 76 [OVPN_A_PEER_LINK_RX_PACKETS] = { .type = NLA_UINT, }, 81 77 [OVPN_A_PEER_LINK_TX_PACKETS] = { .type = NLA_UINT, }, 78 + [OVPN_A_PEER_TX_ID] = NLA_POLICY_FULL_RANGE(NLA_U32, &ovpn_a_peer_tx_id_range), 82 79 }; 83 80 84 81 const struct nla_policy ovpn_peer_del_input_nl_policy[OVPN_A_PEER_ID + 1] = { 85 82 [OVPN_A_PEER_ID] = NLA_POLICY_FULL_RANGE(NLA_U32, &ovpn_a_peer_id_range), 86 83 }; 87 84 88 - const struct nla_policy ovpn_peer_new_input_nl_policy[OVPN_A_PEER_KEEPALIVE_TIMEOUT + 1] = { 85 + const struct nla_policy ovpn_peer_new_input_nl_policy[OVPN_A_PEER_TX_ID + 1] = { 89 86 [OVPN_A_PEER_ID] = NLA_POLICY_FULL_RANGE(NLA_U32, &ovpn_a_peer_id_range), 90 87 [OVPN_A_PEER_REMOTE_IPV4] = { .type = NLA_BE32, }, 91 88 [OVPN_A_PEER_REMOTE_IPV6] = NLA_POLICY_EXACT_LEN(16), ··· 99 94 [OVPN_A_PEER_LOCAL_IPV6] = NLA_POLICY_EXACT_LEN(16), 100 95 [OVPN_A_PEER_KEEPALIVE_INTERVAL] = { .type = NLA_U32, }, 101 96 [OVPN_A_PEER_KEEPALIVE_TIMEOUT] = { .type = NLA_U32, }, 97 + [OVPN_A_PEER_TX_ID] = NLA_POLICY_FULL_RANGE(NLA_U32, &ovpn_a_peer_tx_id_range), 102 98 }; 103 99 104 - const struct nla_policy ovpn_peer_set_input_nl_policy[OVPN_A_PEER_KEEPALIVE_TIMEOUT + 1] = { 100 + const struct nla_policy ovpn_peer_set_input_nl_policy[OVPN_A_PEER_TX_ID + 1] = { 105 101 [OVPN_A_PEER_ID] = NLA_POLICY_FULL_RANGE(NLA_U32, &ovpn_a_peer_id_range), 106 102 [OVPN_A_PEER_REMOTE_IPV4] = { .type = NLA_BE32, }, 107 103 [OVPN_A_PEER_REMOTE_IPV6] = NLA_POLICY_EXACT_LEN(16), ··· 114 108 [OVPN_A_PEER_LOCAL_IPV6] = NLA_POLICY_EXACT_LEN(16), 115 109 [OVPN_A_PEER_KEEPALIVE_INTERVAL] = { .type = NLA_U32, }, 116 110 [OVPN_A_PEER_KEEPALIVE_TIMEOUT] = { .type = NLA_U32, }, 111 + [OVPN_A_PEER_TX_ID] = NLA_POLICY_FULL_RANGE(NLA_U32, &ovpn_a_peer_tx_id_range), 117 112 }; 118 113 119 114 /* OVPN_CMD_PEER_NEW - do */

+3 -3

drivers/net/ovpn/netlink-gen.h

··· 18 18 extern const struct nla_policy ovpn_keyconf_get_nl_policy[OVPN_A_KEYCONF_CIPHER_ALG + 1]; 19 19 extern const struct nla_policy ovpn_keyconf_swap_input_nl_policy[OVPN_A_KEYCONF_PEER_ID + 1]; 20 20 extern const struct nla_policy ovpn_keydir_nl_policy[OVPN_A_KEYDIR_NONCE_TAIL + 1]; 21 - extern const struct nla_policy ovpn_peer_nl_policy[OVPN_A_PEER_LINK_TX_PACKETS + 1]; 21 + extern const struct nla_policy ovpn_peer_nl_policy[OVPN_A_PEER_TX_ID + 1]; 22 22 extern const struct nla_policy ovpn_peer_del_input_nl_policy[OVPN_A_PEER_ID + 1]; 23 - extern const struct nla_policy ovpn_peer_new_input_nl_policy[OVPN_A_PEER_KEEPALIVE_TIMEOUT + 1]; 24 - extern const struct nla_policy ovpn_peer_set_input_nl_policy[OVPN_A_PEER_KEEPALIVE_TIMEOUT + 1]; 23 + extern const struct nla_policy ovpn_peer_new_input_nl_policy[OVPN_A_PEER_TX_ID + 1]; 24 + extern const struct nla_policy ovpn_peer_set_input_nl_policy[OVPN_A_PEER_TX_ID + 1]; 25 25 26 26 int ovpn_nl_pre_doit(const struct genl_split_ops *ops, struct sk_buff *skb, 27 27 struct genl_info *info);

+12 -2

drivers/net/ovpn/netlink.c

··· 305 305 dst_cache_reset(&peer->dst_cache); 306 306 } 307 307 308 + /* In a multipeer-to-multipeer setup we may have asymmetric peer IDs, 309 + * that is peer->id might be different from peer->tx_id. 310 + */ 311 + if (attrs[OVPN_A_PEER_TX_ID]) 312 + peer->tx_id = nla_get_u32(attrs[OVPN_A_PEER_TX_ID]); 313 + 308 314 if (attrs[OVPN_A_PEER_VPN_IPV4]) { 309 315 rehash = true; 310 316 peer->vpn_addrs.ipv4.s_addr = ··· 332 326 } 333 327 334 328 netdev_dbg(peer->ovpn->dev, 335 - "modify peer id=%u endpoint=%pIScp VPN-IPv4=%pI4 VPN-IPv6=%pI6c\n", 336 - peer->id, &ss, 329 + "modify peer id=%u tx_id=%u endpoint=%pIScp VPN-IPv4=%pI4 VPN-IPv6=%pI6c\n", 330 + peer->id, peer->tx_id, &ss, 337 331 &peer->vpn_addrs.ipv4.s_addr, &peer->vpn_addrs.ipv6); 338 332 339 333 spin_unlock_bh(&peer->lock); ··· 379 373 } 380 374 381 375 peer_id = nla_get_u32(attrs[OVPN_A_PEER_ID]); 376 + 382 377 peer = ovpn_peer_new(ovpn, peer_id); 383 378 if (IS_ERR(peer)) { 384 379 NL_SET_ERR_MSG_FMT_MOD(info->extack, ··· 577 570 rcu_read_unlock(); 578 571 579 572 if (nla_put_u32(skb, OVPN_A_PEER_ID, peer->id)) 573 + goto err; 574 + 575 + if (nla_put_u32(skb, OVPN_A_PEER_TX_ID, peer->tx_id)) 580 576 goto err; 581 577 582 578 if (peer->vpn_addrs.ipv4.s_addr != htonl(INADDR_ANY))

+4

drivers/net/ovpn/peer.c

··· 99 99 if (!peer) 100 100 return ERR_PTR(-ENOMEM); 101 101 102 + /* in the default case TX and RX IDs are the same. 103 + * the user may set a different TX ID via netlink 104 + */ 102 105 peer->id = id; 106 + peer->tx_id = id; 103 107 peer->ovpn = ovpn; 104 108 105 109 peer->vpn_addrs.ipv4.s_addr = htonl(INADDR_ANY);

+3 -1

drivers/net/ovpn/peer.h

··· 21 21 * struct ovpn_peer - the main remote peer object 22 22 * @ovpn: main openvpn instance this peer belongs to 23 23 * @dev_tracker: reference tracker for associated dev 24 - * @id: unique identifier 24 + * @id: unique identifier, used to match incoming packets 25 + * @tx_id: identifier to be used in TX packets 25 26 * @vpn_addrs: IP addresses assigned over the tunnel 26 27 * @vpn_addrs.ipv4: IPv4 assigned to peer on the tunnel 27 28 * @vpn_addrs.ipv6: IPv6 assigned to peer on the tunnel ··· 65 64 struct ovpn_priv *ovpn; 66 65 netdevice_tracker dev_tracker; 67 66 u32 id; 67 + u32 tx_id; 68 68 struct { 69 69 struct in_addr ipv4; 70 70 struct in6_addr ipv6;

+1

include/uapi/linux/ovpn.h

··· 55 55 OVPN_A_PEER_LINK_TX_BYTES, 56 56 OVPN_A_PEER_LINK_RX_PACKETS, 57 57 OVPN_A_PEER_LINK_TX_PACKETS, 58 + OVPN_A_PEER_TX_ID, 58 59 59 60 __OVPN_A_PEER_MAX, 60 61 OVPN_A_PEER_MAX = (__OVPN_A_PEER_MAX - 1)

Configure Feed

Configure Feed