diff mbox series

[Openvpn-devel,v6] Support pre-existing Linux DCO interfaces

Message ID 20261110095259.23298-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v6] Support pre-existing Linux DCO interfaces |

Commit Message

Gert Doering Nov. 10, 2026, 9:52 a.m. UTC 
  From: Ralf Lici <ralf@mandelbit.com>

When creating an ovpn interface returns -EEXIST, still retrieve the
ifindex and return the error to the generic DCO open path. This lets the
caller mark the interface as pre-existing and avoid deleting it on
close.

Before accepting the existing interface, query its rtnetlink link info
and verify that it is an ovpn device with the expected mode. The ovpn
mode is fixed at interface creation time, so attaching to an interface
created for the other mode cannot work.

Honor the pre-existing state on close by skipping net_iface_del() for
persistent interfaces.

Github: closes OpenVPN/openvpn#1064
Change-Id: I72302403bddee4b0b0ee2441ae9e246f48d0bc81
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
Acked-by: Antonio Quartulli <antonio@mandelbit.com>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1734
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1734
This mail reflects revision 6 of this Change.

Acked-by according to Gerrit (reflected above):
Antonio Quartulli <antonio@mandelbit.com>
diff mbox series

Patch

diff --git a/src/openvpn/dco.h b/src/openvpn/dco.h
index c435f8c..02ff9b3 100644
--- a/src/openvpn/dco.h
+++ b/src/openvpn/dco.h
@@ -109,7 +109,8 @@ 
 bool ovpn_dco_init(struct context *c);
 
 /**
- * Open/create a DCO interface
+ * Open/create a DCO interface and store its ifindex.
+ * If the interface already exists, save the ifindex anyway and return -EEXIST.
  *
  * @param tt        the tuntap context
  * @param ctx       the networking API context
diff --git a/src/openvpn/dco_linux.c b/src/openvpn/dco_linux.c
index a84e310..4d24122 100644
--- a/src/openvpn/dco_linux.c
+++ b/src/openvpn/dco_linux.c
@@ -540,6 +540,19 @@ 
     CLEAR(*dco);
 }
 
+static const char *
+ovpn_mode_to_str(enum ovpn_mode mode)
+{
+    switch (mode)
+    {
+        case OVPN_MODE_P2P:
+            return "p2p";
+        case OVPN_MODE_MP:
+            return "server";
+    }
+    return "unknown";
+}
+
 int
 open_tun_dco(struct tuntap *tt, openvpn_net_ctx_t *ctx, const char *dev)
 {
@@ -547,11 +560,30 @@ 
     ASSERT(tt->type == DEV_TYPE_TUN);
 
     int ret = net_iface_new(ctx, dev, OVPN_FAMILY_NAME, &tt->dco);
-    if (ret < 0)
+    if (ret < 0 && ret != -EEXIST)
     {
         msg(D_DCO_DEBUG, "Cannot create DCO interface %s: %d", dev, ret);
         return ret;
     }
+    if (ret == -EEXIST)
+    {
+        enum ovpn_mode mode;
+        int mode_ret = net_iface_ovpn_mode(ctx, dev, &mode);
+
+        if (mode_ret < 0)
+        {
+            msg(M_WARN, "DCO: cannot retrieve mode of existing interface %s: %s (%d)", dev,
+                strerror(-mode_ret), mode_ret);
+            return mode_ret;
+        }
+
+        if (mode != tt->dco.ifmode)
+        {
+            msg(M_WARN, "DCO: existing interface %s is in %s mode, expected %s mode",
+                dev, ovpn_mode_to_str(mode), ovpn_mode_to_str(tt->dco.ifmode));
+            return -EINVAL;
+        }
+    }
 
     tt->dco.ifindex = if_nametoindex(dev);
     if (!tt->dco.ifindex)
@@ -559,7 +591,7 @@ 
         msg(M_FATAL, "DCO: cannot retrieve ifindex for interface %s", dev);
     }
 
-    return 0;
+    return ret;
 }
 
 void
@@ -567,7 +599,10 @@ 
 {
     msg(D_DCO_DEBUG, __func__);
 
-    net_iface_del(ctx, tt->actual_name);
+    if (!tt->persistent_if)
+    {
+        net_iface_del(ctx, tt->actual_name);
+    }
     ovpn_dco_uninit_netlink(&tt->dco);
 }
 
diff --git a/src/openvpn/dco_linux.h b/src/openvpn/dco_linux.h
index c487581..a999d77 100644
--- a/src/openvpn/dco_linux.h
+++ b/src/openvpn/dco_linux.h
@@ -24,6 +24,7 @@ 
 #if defined(ENABLE_DCO) && defined(TARGET_LINUX)
 
 #include "event.h"
+#include "networking_sitnl.h"
 
 #include "ovpn_dco_linux.h"
 
@@ -38,28 +39,6 @@ 
 typedef enum ovpn_key_slot dco_key_slot_t;
 typedef enum ovpn_cipher_alg dco_cipher_t;
 
-/* OVPN section */
-
-#ifndef IFLA_OVPN_MAX
-
-enum ovpn_mode
-{
-    OVPN_MODE_P2P,
-    OVPN_MODE_MP,
-};
-
-enum ovpn_ifla_attrs
-{
-    IFLA_OVPN_UNSPEC = 0,
-    IFLA_OVPN_MODE,
-
-    __IFLA_OVPN_MAX,
-};
-
-#define IFLA_OVPN_MAX (__IFLA_OVPN_MAX - 1)
-
-#endif /* ifndef IFLA_OVPN_MAX */
-
 typedef struct
 {
     /* socket used for synchronous request/reply transactions (commands and
diff --git a/src/openvpn/networking.h b/src/openvpn/networking.h
index 7ad6e2e..83bce57 100644
--- a/src/openvpn/networking.h
+++ b/src/openvpn/networking.h
@@ -115,6 +115,19 @@ 
  */
 int net_iface_type(const openvpn_net_ctx_t *ctx, const char *iface, char type[IFACE_TYPE_LEN_MAX]);
 
+#if defined(ENABLE_DCO) && defined(TARGET_LINUX)
+/**
+ * Retrieve the ovpn interface mode
+ *
+ * @param ctx       the implementation specific context
+ * @param iface     interface to query
+ * @param mode      variable where the ovpn mode attribute will be stored
+ *
+ * @return          0 on success, a negative error code otherwise
+ */
+int net_iface_ovpn_mode(openvpn_net_ctx_t *ctx, const char *iface, enum ovpn_mode *mode);
+#endif
+
 /**
  * Remove an interface
  *
diff --git a/src/openvpn/networking_iproute2.c b/src/openvpn/networking_iproute2.c
index d987478..dd240d1 100644
--- a/src/openvpn/networking_iproute2.c
+++ b/src/openvpn/networking_iproute2.c
@@ -80,6 +80,16 @@ 
     return -1;
 }
 
+#if defined(ENABLE_DCO)
+int
+net_iface_ovpn_mode(openvpn_net_ctx_t *ctx, const char *iface, enum ovpn_mode *mode)
+{
+    /* not supported by iproute2 */
+    msg(M_WARN, "%s: operation not supported by iproute2 backend", __func__);
+    return -EOPNOTSUPP;
+}
+#endif
+
 int
 net_iface_del(const openvpn_net_ctx_t *ctx, const char *iface)
 {
diff --git a/src/openvpn/networking_sitnl.c b/src/openvpn/networking_sitnl.c
index 97ff7bd..6d47b62 100644
--- a/src/openvpn/networking_sitnl.c
+++ b/src/openvpn/networking_sitnl.c
@@ -1430,8 +1430,18 @@ 
     return 0;
 }
 
-int
-net_iface_type(const openvpn_net_ctx_t *ctx, const char *iface, char type[IFACE_TYPE_LEN_MAX])
+/**
+ * Issue an RTM_GETLINK query for an interface and feed the reply to the given
+ * parsing callback.
+ *
+ * @param iface     name of the interface to query
+ * @param cb        callback invoked with the netlink reply
+ * @param arg       opaque argument passed through to the callback
+ *
+ * @return          0 on success, a negative error code otherwise
+ */
+static int
+sitnl_link_get(const char *iface, sitnl_parse_reply_cb cb, void *arg)
 {
     struct sitnl_link_req req = {};
     int ifindex = if_nametoindex(iface);
@@ -1448,9 +1458,15 @@ 
     req.i.ifi_family = AF_PACKET;
     req.i.ifi_index = ifindex;
 
+    return sitnl_send(&req.n, 0, 0, cb, arg);
+}
+
+int
+net_iface_type(const openvpn_net_ctx_t *ctx, const char *iface, char type[IFACE_TYPE_LEN_MAX])
+{
     memset(type, 0, IFACE_TYPE_LEN_MAX);
 
-    int ret = sitnl_send(&req.n, 0, 0, sitnl_type_save, type);
+    int ret = sitnl_link_get(iface, sitnl_type_save, type);
     if (ret < 0)
     {
         msg(D_ROUTE, "%s: cannot retrieve iface %s: %s (%d)", __func__, iface, strerror(-ret), ret);
@@ -1462,6 +1478,82 @@ 
     return 0;
 }
 
+#if defined(ENABLE_DCO)
+static int
+sitnl_ovpn_mode_save(struct nlmsghdr *n, void *arg)
+{
+    struct ifinfomsg *ifi = NLMSG_DATA(n);
+    struct rtattr *tb[IFLA_MAX + 1];
+    struct rtattr *tb_link[IFLA_INFO_MAX + 1];
+    struct rtattr *tb_data[IFLA_OVPN_MAX + 1];
+    enum ovpn_mode *mode = arg;
+    uint8_t raw_mode;
+
+    if (n->nlmsg_type != RTM_NEWLINK)
+    {
+        return -EINVAL;
+    }
+
+    if (n->nlmsg_len < NLMSG_LENGTH(sizeof(*ifi)))
+    {
+        return -EINVAL;
+    }
+
+    sitnl_parse_rtattr(tb, IFLA_MAX, IFLA_RTA(ifi), IFLA_PAYLOAD(n));
+
+    if (!tb[IFLA_LINKINFO])
+    {
+        return -ENOENT;
+    }
+
+    sitnl_parse_rtattr_nested(tb_link, IFLA_INFO_MAX, tb[IFLA_LINKINFO]);
+
+    if (!tb_link[IFLA_INFO_KIND]
+        || strcmp(RTA_DATA(tb_link[IFLA_INFO_KIND]), OVPN_FAMILY_NAME) != 0)
+    {
+        return -EINVAL;
+    }
+
+    if (!tb_link[IFLA_INFO_DATA])
+    {
+        return -ENOENT;
+    }
+
+    sitnl_parse_rtattr_nested(tb_data, IFLA_OVPN_MAX, tb_link[IFLA_INFO_DATA]);
+
+    if (!tb_data[IFLA_OVPN_MODE])
+    {
+        return -ENOENT;
+    }
+
+    if (RTA_PAYLOAD(tb_data[IFLA_OVPN_MODE]) < sizeof(raw_mode))
+    {
+        return -EINVAL;
+    }
+
+    raw_mode = *(uint8_t *)RTA_DATA(tb_data[IFLA_OVPN_MODE]);
+    *mode = (enum ovpn_mode)raw_mode;
+
+    return 0;
+}
+
+int
+net_iface_ovpn_mode(openvpn_net_ctx_t *ctx, const char *iface, enum ovpn_mode *mode)
+{
+    int ret = sitnl_link_get(iface, sitnl_ovpn_mode_save, mode);
+    if (ret < 0)
+    {
+        msg(D_ROUTE, "%s: cannot retrieve ovpn mode for iface %s: %s (%d)", __func__, iface,
+            strerror(-ret), ret);
+        return ret;
+    }
+
+    msg(D_ROUTE, "%s: mode of %s: %d", __func__, iface, *mode);
+
+    return 0;
+}
+#endif /* defined(ENABLE_DCO) */
+
 int
 net_iface_del(const openvpn_net_ctx_t *ctx, const char *iface)
 {
diff --git a/src/openvpn/networking_sitnl.h b/src/openvpn/networking_sitnl.h
index 481cc36..7a2d964 100644
--- a/src/openvpn/networking_sitnl.h
+++ b/src/openvpn/networking_sitnl.h
@@ -24,4 +24,30 @@ 
 typedef char openvpn_net_iface_t;
 typedef void *openvpn_net_ctx_t;
 
+#if defined(TARGET_LINUX)
+
+#include <linux/if_link.h>
+
+#ifndef IFLA_OVPN_MAX
+
+enum ovpn_mode
+{
+    OVPN_MODE_P2P,
+    OVPN_MODE_MP,
+};
+
+enum ovpn_ifla_attrs
+{
+    IFLA_OVPN_UNSPEC = 0,
+    IFLA_OVPN_MODE,
+
+    __IFLA_OVPN_MAX,
+};
+
+#define IFLA_OVPN_MAX (__IFLA_OVPN_MAX - 1)
+
+#endif /* ifndef IFLA_OVPN_MAX */
+
+#endif /* if defined(TARGET_LINUX) */
+
 #endif /* NETWORKING_SITNL_H_ */