diff --git a/drivers/net/ovpn/peer.c b/drivers/net/ovpn/peer.c index c02dfab51a6e..8411a4ac85d6 100644 --- a/drivers/net/ovpn/peer.c +++ b/drivers/net/ovpn/peer.c @@ -82,6 +82,24 @@ static void ovpn_peer_keepalive_send(struct work_struct *work) local_bh_enable(); } +static void ovpn_peer_transport_error_work(struct work_struct *work) +{ + struct ovpn_peer *peer = container_of(work, struct ovpn_peer, + transport_error_work); + + ovpn_peer_del(peer, OVPN_DEL_PEER_REASON_TRANSPORT_ERROR); + ovpn_peer_put(peer); +} + +void ovpn_peer_del_transport_error(struct ovpn_peer *peer) +{ + if (WARN_ON(!ovpn_peer_hold(peer))) + return; + + if (!schedule_work(&peer->transport_error_work)) + ovpn_peer_put(peer); +} + /** * ovpn_peer_new - allocate and initialize a new peer object * @ovpn: the openvpn instance inside which the peer should be created @@ -115,6 +133,7 @@ struct ovpn_peer *ovpn_peer_new(struct ovpn_priv *ovpn, u32 id) kref_init(&peer->refcount); ovpn_peer_stats_init(&peer->vpn_stats); ovpn_peer_stats_init(&peer->link_stats); + INIT_WORK(&peer->transport_error_work, ovpn_peer_transport_error_work); INIT_WORK(&peer->keepalive_work, ovpn_peer_keepalive_send); ret = dst_cache_init(&peer->dst_cache, GFP_KERNEL); diff --git a/drivers/net/ovpn/peer.h b/drivers/net/ovpn/peer.h index 328401570cba..1b8142919da6 100644 --- a/drivers/net/ovpn/peer.h +++ b/drivers/net/ovpn/peer.h @@ -59,6 +59,7 @@ * @refcount: reference counter * @rcu: used to free peer in an RCU safe way * @release_entry: entry for the socket release list + * @transport_error_work: work used to delete peer on transport error * @keepalive_work: used to schedule keepalive sending */ struct ovpn_peer { @@ -94,8 +95,6 @@ struct ovpn_peer { struct proto *prot; const struct proto_ops *ops; } sk_cb; - - struct work_struct defer_del_work; } tcp; struct ovpn_crypto_state crypto; struct dst_cache dst_cache; @@ -113,6 +112,7 @@ struct ovpn_peer { struct kref refcount; struct rcu_head rcu; struct llist_node release_entry; + struct work_struct transport_error_work; struct work_struct keepalive_work; }; @@ -142,6 +142,7 @@ static inline void ovpn_peer_put(struct ovpn_peer *peer) struct ovpn_peer *ovpn_peer_new(struct ovpn_priv *ovpn, u32 id); int ovpn_peer_add(struct ovpn_priv *ovpn, struct ovpn_peer *peer); int ovpn_peer_del(struct ovpn_peer *peer, enum ovpn_del_peer_reason reason); +void ovpn_peer_del_transport_error(struct ovpn_peer *peer); void ovpn_peers_free(struct ovpn_priv *ovpn, struct sock *sock, enum ovpn_del_peer_reason reason); diff --git a/drivers/net/ovpn/tcp.c b/drivers/net/ovpn/tcp.c index 65054cc84be5..e98e253a3f5a 100644 --- a/drivers/net/ovpn/tcp.c +++ b/drivers/net/ovpn/tcp.c @@ -148,10 +148,7 @@ static void ovpn_tcp_rcv(struct strparser *strp, struct sk_buff *skb) ovpn_recv(peer, skb); return; err: - /* take reference for deferred peer deletion. should never fail */ - if (WARN_ON(!ovpn_peer_hold(peer))) - goto err_nopeer; - schedule_work(&peer->tcp.defer_del_work); + ovpn_peer_del_transport_error(peer); dev_dstats_rx_dropped(peer->ovpn->dev); err_nopeer: kfree_skb(skb); @@ -239,7 +236,7 @@ void ovpn_tcp_socket_wait_finish(struct ovpn_socket *sock) { struct ovpn_peer *peer = sock->peer; - /* NOTE: we don't wait for peer->tcp.defer_del_work to finish: + /* NOTE: we don't wait for peer->transport_error_work to finish: * either the worker is not running or this function * was invoked by that worker. */ @@ -282,8 +279,7 @@ static void ovpn_tcp_send_sock(struct ovpn_peer *peer, struct sock *sk) /* in case of TCP error we can't recover the VPN * stream therefore we abort the connection */ - ovpn_peer_hold(peer); - schedule_work(&peer->tcp.defer_del_work); + ovpn_peer_del_transport_error(peer); /* we bail out immediately and keep tx_in_progress set * to true. This way we prevent more TX attempts @@ -496,15 +492,6 @@ static void ovpn_tcp_build_protos(struct proto *new_prot, const struct proto *orig_prot, const struct proto_ops *orig_ops); -static void ovpn_tcp_peer_del_work(struct work_struct *work) -{ - struct ovpn_peer *peer = container_of(work, struct ovpn_peer, - tcp.defer_del_work); - - ovpn_peer_del(peer, OVPN_DEL_PEER_REASON_TRANSPORT_ERROR); - ovpn_peer_put(peer); -} - /* Set TCP encapsulation callbacks */ int ovpn_tcp_socket_attach(struct ovpn_socket *ovpn_sock, struct ovpn_peer *peer) @@ -537,8 +524,6 @@ int ovpn_tcp_socket_attach(struct ovpn_socket *ovpn_sock, goto err; } - INIT_WORK(&peer->tcp.defer_del_work, ovpn_tcp_peer_del_work); - __sk_dst_reset(ovpn_sock->sk); skb_queue_head_init(&peer->tcp.user_queue); skb_queue_head_init(&peer->tcp.out_queue); diff --git a/drivers/net/ovpn/udp.c b/drivers/net/ovpn/udp.c index 49dc15486043..b8aa7e47df8e 100644 --- a/drivers/net/ovpn/udp.c +++ b/drivers/net/ovpn/udp.c @@ -311,6 +311,7 @@ static int ovpn_udp6_output(struct ovpn_peer *peer, struct ovpn_bind *bind, static int ovpn_udp_output(struct ovpn_peer *peer, struct dst_cache *cache, struct sock *sk, struct sk_buff *skb) { + unsigned short sock_family; struct ovpn_bind *bind; int ret; @@ -327,18 +328,35 @@ static int ovpn_udp_output(struct ovpn_peer *peer, struct dst_cache *cache, goto out; } + sock_family = READ_ONCE(sk->sk_family); + ret = -EAFNOSUPPORT; switch (bind->remote.in4.sin_family) { case AF_INET: + /* userspace might have set IPV6_V6ONLY */ + if (unlikely(sock_family == AF_INET6 && ipv6_only_sock(sk))) { + net_warn_ratelimited("%s: peer %u: IPv4 remote, IPv6-only socket\n", + netdev_name(peer->ovpn->dev), + peer->id); + ovpn_peer_del_transport_error(peer); + break; + } + ret = ovpn_udp4_output(peer, bind, cache, sk, skb); break; #if IS_ENABLED(CONFIG_IPV6) case AF_INET6: + /* userspace might have set IPV6_ADDRFORM */ + if (unlikely(sock_family != AF_INET6)) { + net_warn_ratelimited("%s: peer %u: IPv6 remote, IPv4 socket\n", + netdev_name(peer->ovpn->dev), + peer->id); + ovpn_peer_del_transport_error(peer); + break; + } + ret = ovpn_udp6_output(peer, bind, cache, sk, skb); break; #endif - default: - ret = -EAFNOSUPPORT; - break; } out: