Commit a3aaef8c authored by Antonio Quartulli's avatar Antonio Quartulli Committed by Paolo Abeni
Browse files

ovpn: implement peer lookup logic 



In a multi-peer scenario there are a number of situations when a
specific peer needs to be looked up.

We may want to lookup a peer by:
1. its ID
2. its VPN destination IP
3. its transport IP/port couple

For each of the above, there is a specific routing table referencing all
peers for fast look up.

Case 2. is a bit special in the sense that an outgoing packet may not be
sent to the peer VPN IP directly, but rather to a network behind it. For
this reason we first perform a nexthop lookup in the system routing
table and then we use the retrieved nexthop as peer search key.

Signed-off-by: default avatarAntonio Quartulli <antonio@openvpn.net>
Link: https://patch.msgid.link/20250415-b4-ovpn-v26-15-577f6097b964@openvpn.net


Reviewed-by: default avatarSabrina Dubroca <sd@queasysnail.net>
Tested-by: default avatarOleksandr Natalenko <oleksandr@natalenko.name>
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parent 05003b40

drivers/net/ovpn/peer.c

+291 −10
Original line number Diff line number Diff line
@@ -10,6 +10,7 @@ 
#include <linux/skbuff.h>

#include <linux/list.h>

#include <linux/hashtable.h>

#include <net/ip6_route.h>



#include "ovpnpriv.h"

#include "bind.h"
@@ -150,6 +151,121 @@ static int ovpn_peer_skb_to_sockaddr(struct sk_buff *skb, 
	return -1;

}



/**

 * ovpn_nexthop_from_skb4 - retrieve IPv4 nexthop for outgoing skb

 * @skb: the outgoing packet

 *

 * Return: the IPv4 of the nexthop

 */

static __be32 ovpn_nexthop_from_skb4(struct sk_buff *skb)

{

	const struct rtable *rt = skb_rtable(skb);



	if (rt && rt->rt_uses_gateway)

		return rt->rt_gw4;



	return ip_hdr(skb)->daddr;

}



/**

 * ovpn_nexthop_from_skb6 - retrieve IPv6 nexthop for outgoing skb

 * @skb: the outgoing packet

 *

 * Return: the IPv6 of the nexthop

 */

static struct in6_addr ovpn_nexthop_from_skb6(struct sk_buff *skb)

{

	const struct rt6_info *rt = skb_rt6_info(skb);



	if (!rt || !(rt->rt6i_flags & RTF_GATEWAY))

		return ipv6_hdr(skb)->daddr;



	return rt->rt6i_gateway;

}



/* variable name __tbl2 needs to be different from __tbl1

 * in the macro below to avoid confusing clang

 */

#define ovpn_get_hash_slot(_tbl, _key, _key_len) ({	\

	typeof(_tbl) *__tbl2 = &(_tbl);			\

	jhash(_key, _key_len, 0) % HASH_SIZE(*__tbl2);	\

})



#define ovpn_get_hash_head(_tbl, _key, _key_len) ({		\

	typeof(_tbl) *__tbl1 = &(_tbl);				\

	&(*__tbl1)[ovpn_get_hash_slot(*__tbl1, _key, _key_len)];\

})



/**

 * ovpn_peer_get_by_vpn_addr4 - retrieve peer by its VPN IPv4 address

 * @ovpn: the openvpn instance to search

 * @addr: VPN IPv4 to use as search key

 *

 * Refcounter is not increased for the returned peer.

 *

 * Return: the peer if found or NULL otherwise

 */

static struct ovpn_peer *ovpn_peer_get_by_vpn_addr4(struct ovpn_priv *ovpn,

						    __be32 addr)

{

	struct hlist_nulls_head *nhead;

	struct hlist_nulls_node *ntmp;

	struct ovpn_peer *tmp;

	unsigned int slot;



begin:

	slot = ovpn_get_hash_slot(ovpn->peers->by_vpn_addr4, &addr,

				  sizeof(addr));

	nhead = &ovpn->peers->by_vpn_addr4[slot];



	hlist_nulls_for_each_entry_rcu(tmp, ntmp, nhead, hash_entry_addr4)

		if (addr == tmp->vpn_addrs.ipv4.s_addr)

			return tmp;



	/* item may have moved during lookup - check nulls and restart

	 * if that's the case

	 */

	if (get_nulls_value(ntmp) != slot)

		goto begin;



	return NULL;

}



/**

 * ovpn_peer_get_by_vpn_addr6 - retrieve peer by its VPN IPv6 address

 * @ovpn: the openvpn instance to search

 * @addr: VPN IPv6 to use as search key

 *

 * Refcounter is not increased for the returned peer.

 *

 * Return: the peer if found or NULL otherwise

 */

static struct ovpn_peer *ovpn_peer_get_by_vpn_addr6(struct ovpn_priv *ovpn,

						    struct in6_addr *addr)

{

	struct hlist_nulls_head *nhead;

	struct hlist_nulls_node *ntmp;

	struct ovpn_peer *tmp;

	unsigned int slot;



begin:

	slot = ovpn_get_hash_slot(ovpn->peers->by_vpn_addr6, addr,

				  sizeof(*addr));

	nhead = &ovpn->peers->by_vpn_addr6[slot];



	hlist_nulls_for_each_entry_rcu(tmp, ntmp, nhead, hash_entry_addr6)

		if (ipv6_addr_equal(addr, &tmp->vpn_addrs.ipv6))

			return tmp;



	/* item may have moved during lookup - check nulls and restart

	 * if that's the case

	 */

	if (get_nulls_value(ntmp) != slot)

		goto begin;



	return NULL;

}



/**

 * ovpn_peer_transp_match - check if sockaddr and peer binding match

 * @peer: the peer to get the binding from
@@ -227,14 +343,43 @@ ovpn_peer_get_by_transp_addr_p2p(struct ovpn_priv *ovpn, 
struct ovpn_peer *ovpn_peer_get_by_transp_addr(struct ovpn_priv *ovpn,

					       struct sk_buff *skb)

{

	struct ovpn_peer *peer = NULL;

	struct ovpn_peer *tmp, *peer = NULL;

	struct sockaddr_storage ss = { 0 };

	struct hlist_nulls_head *nhead;

	struct hlist_nulls_node *ntmp;

	unsigned int slot;

	ssize_t sa_len;



	if (unlikely(!ovpn_peer_skb_to_sockaddr(skb, &ss)))

	sa_len = ovpn_peer_skb_to_sockaddr(skb, &ss);

	if (unlikely(sa_len < 0))

		return NULL;



	if (ovpn->mode == OVPN_MODE_P2P)

		peer = ovpn_peer_get_by_transp_addr_p2p(ovpn, &ss);

		return ovpn_peer_get_by_transp_addr_p2p(ovpn, &ss);



	rcu_read_lock();

begin:

	slot = ovpn_get_hash_slot(ovpn->peers->by_transp_addr, &ss, sa_len);

	nhead = &ovpn->peers->by_transp_addr[slot];



	hlist_nulls_for_each_entry_rcu(tmp, ntmp, nhead,

				       hash_entry_transp_addr) {

		if (!ovpn_peer_transp_match(tmp, &ss))

			continue;



		if (!ovpn_peer_hold(tmp))

			continue;



		peer = tmp;

		break;

	}



	/* item may have moved during lookup - check nulls and restart

	 * if that's the case

	 */

	if (!peer && get_nulls_value(ntmp) != slot)

		goto begin;

	rcu_read_unlock();



	return peer;

}
@@ -269,10 +414,27 @@ static struct ovpn_peer *ovpn_peer_get_by_id_p2p(struct ovpn_priv *ovpn, 
 */

struct ovpn_peer *ovpn_peer_get_by_id(struct ovpn_priv *ovpn, u32 peer_id)

{

	struct ovpn_peer *peer = NULL;

	struct ovpn_peer *tmp, *peer = NULL;

	struct hlist_head *head;



	if (ovpn->mode == OVPN_MODE_P2P)

		peer = ovpn_peer_get_by_id_p2p(ovpn, peer_id);

		return ovpn_peer_get_by_id_p2p(ovpn, peer_id);



	head = ovpn_get_hash_head(ovpn->peers->by_id, &peer_id,

				  sizeof(peer_id));



	rcu_read_lock();

	hlist_for_each_entry_rcu(tmp, head, hash_entry_id) {

		if (tmp->id != peer_id)

			continue;



		if (!ovpn_peer_hold(tmp))

			continue;



		peer = tmp;

		break;

	}

	rcu_read_unlock();



	return peer;

}
@@ -330,6 +492,8 @@ struct ovpn_peer *ovpn_peer_get_by_dst(struct ovpn_priv *ovpn, 
				       struct sk_buff *skb)

{

	struct ovpn_peer *peer = NULL;

	struct in6_addr addr6;

	__be32 addr4;



	/* in P2P mode, no matter the destination, packets are always sent to

	 * the single peer listening on the other side
@@ -340,11 +504,109 @@ struct ovpn_peer *ovpn_peer_get_by_dst(struct ovpn_priv *ovpn, 
		if (unlikely(peer && !ovpn_peer_hold(peer)))

			peer = NULL;

		rcu_read_unlock();

		return peer;

	}



	rcu_read_lock();

	switch (skb->protocol) {

	case htons(ETH_P_IP):

		addr4 = ovpn_nexthop_from_skb4(skb);

		peer = ovpn_peer_get_by_vpn_addr4(ovpn, addr4);

		break;

	case htons(ETH_P_IPV6):

		addr6 = ovpn_nexthop_from_skb6(skb);

		peer = ovpn_peer_get_by_vpn_addr6(ovpn, &addr6);

		break;

	}



	if (unlikely(peer && !ovpn_peer_hold(peer)))

		peer = NULL;

	rcu_read_unlock();



	return peer;

}



/**

 * ovpn_nexthop_from_rt4 - look up the IPv4 nexthop for the given destination

 * @ovpn: the private data representing the current VPN session

 * @dest: the destination to be looked up

 *

 * Looks up in the IPv4 system routing table the IP of the nexthop to be used

 * to reach the destination passed as argument. If no nexthop can be found, the

 * destination itself is returned as it probably has to be used as nexthop.

 *

 * Return: the IP of the next hop if found or dest itself otherwise

 */

static __be32 ovpn_nexthop_from_rt4(struct ovpn_priv *ovpn, __be32 dest)

{

	struct rtable *rt;

	struct flowi4 fl = {

		.daddr = dest

	};



	rt = ip_route_output_flow(dev_net(ovpn->dev), &fl, NULL);

	if (IS_ERR(rt)) {

		net_dbg_ratelimited("%s: no route to host %pI4\n",

				    netdev_name(ovpn->dev), &dest);

		/* if we end up here this packet is probably going to be

		 * thrown away later

		 */

		return dest;

	}



	if (!rt->rt_uses_gateway)

		goto out;



	dest = rt->rt_gw4;

out:

	ip_rt_put(rt);

	return dest;

}



/**

 * ovpn_nexthop_from_rt6 - look up the IPv6 nexthop for the given destination

 * @ovpn: the private data representing the current VPN session

 * @dest: the destination to be looked up

 *

 * Looks up in the IPv6 system routing table the IP of the nexthop to be used

 * to reach the destination passed as argument. If no nexthop can be found, the

 * destination itself is returned as it probably has to be used as nexthop.

 *

 * Return: the IP of the next hop if found or dest itself otherwise

 */

static struct in6_addr ovpn_nexthop_from_rt6(struct ovpn_priv *ovpn,

					     struct in6_addr dest)

{

#if IS_ENABLED(CONFIG_IPV6)

	struct dst_entry *entry;

	struct rt6_info *rt;

	struct flowi6 fl = {

		.daddr = dest,

	};



	entry = ipv6_stub->ipv6_dst_lookup_flow(dev_net(ovpn->dev), NULL, &fl,

						NULL);

	if (IS_ERR(entry)) {

		net_dbg_ratelimited("%s: no route to host %pI6c\n",

				    netdev_name(ovpn->dev), &dest);

		/* if we end up here this packet is probably going to be

		 * thrown away later

		 */

		return dest;

	}



	rt = dst_rt6_info(entry);



	if (!(rt->rt6i_flags & RTF_GATEWAY))

		goto out;



	dest = rt->rt6i_gateway;

out:

	dst_release((struct dst_entry *)rt);

#endif

	return dest;

}



/**

 * ovpn_peer_check_by_src - check that skb source is routed via peer

 * @ovpn: the openvpn instance to search
@@ -357,20 +619,39 @@ bool ovpn_peer_check_by_src(struct ovpn_priv *ovpn, struct sk_buff *skb, 
			    struct ovpn_peer *peer)

{

	bool match = false;

	struct in6_addr addr6;

	__be32 addr4;



	if (ovpn->mode == OVPN_MODE_P2P) {

		/* in P2P mode, no matter the destination, packets are always

		 * sent to the single peer listening on the other side

		 */

		match = (peer == rcu_access_pointer(ovpn->peer));

		return peer == rcu_access_pointer(ovpn->peer);

	}



	return match;

	/* This function performs a reverse path check, therefore we now

	 * lookup the nexthop we would use if we wanted to route a packet

	 * to the source IP. If the nexthop matches the sender we know the

	 * latter is valid and we allow the packet to come in

	 */



	switch (skb->protocol) {

	case htons(ETH_P_IP):

		addr4 = ovpn_nexthop_from_rt4(ovpn, ip_hdr(skb)->saddr);

		rcu_read_lock();

		match = (peer == ovpn_peer_get_by_vpn_addr4(ovpn, addr4));

		rcu_read_unlock();

		break;

	case htons(ETH_P_IPV6):

		addr6 = ovpn_nexthop_from_rt6(ovpn, ipv6_hdr(skb)->saddr);

		rcu_read_lock();

		match = (peer == ovpn_peer_get_by_vpn_addr6(ovpn, &addr6));

		rcu_read_unlock();

		break;

	}



#define ovpn_get_hash_head(_tbl, _key, _key_len) ({		\

	typeof(_tbl) *__tbl = &(_tbl);				\

	(&(*__tbl)[jhash(_key, _key_len, 0) % HASH_SIZE(*__tbl)]); }) \

	return match;

}



/**

 * ovpn_peer_add_mp - add peer to related tables in a MP instance