On 20/01/2025 11:45, Antonio Quartulli wrote: [...]
I'm not sure what this (and the peer flushing on NETDEV_DOWN) is trying to accomplish. Is it a problem to keep peers when the netdevice is down?
This is the result of my discussion with Sergey that started in v23 5/23:
https://lore.kernel.org/r/netdev/20241029-b4-ovpn-v11-5- de4698c73a25@openvpn.net/
The idea was to match operational state with actual connectivity to peer(s).
Originally I wanted to simply kee the carrier always on, but after further discussion (including the meaning of the openvpn option --persist- tun) we agreed on following the logic where an UP device has a peer connected (logic is slightly different between MP and P2P).
I am not extremely happy with the resulting complexity, but it seemed to be blocker for Sergey.
[after re-reading that discussion with Sergey]
I don't understand why "admin does 'ip link set tun0 down'" means "we should get rid of all peers. For me the carrier situation goes the other way: no peer, no carrier (as if I unplugged the cable from my ethernet card), and it's independent of what the user does (ip link set XXX up/down). You have that with netif_carrier_{on,off}, but flushing peers when the admin does "ip link set tun0 down" is separate IMO.
The reasoning was "the user is asking the VPN to go down - it should be assumed that from that moment on no VPN traffic whatsoever should flow in either direction". Similarly to when you bring an Eth interface dwn - the phy link goes down as well.
Does it make sense?
I'm not sure. If I turn the ovpn interface down for a second, the peers are removed. Will they come back when I bring the interface back up? That'd have to be done by userspace (which could also watch for the DOWN events and tell the kernel to flush the peers) - but some of the peers could have timed out in the meantime.
If I set the VPN interface down, I expect no packets flowing through that interface (dropping the peers isn't necessary for that), but all non-data (key exchange etc sent by openvpn's userspace) should still go through, and IMO peer keepalive fits in that "non-data" category.
This was my original thought too and my original proposal followed this idea :-)
However Sergey had a strong opinion about "the user expect no traffic whatsoever".
I'd be happy about going again with your proposed approach, but I need to be sure that on the next revision nobody will come asking to revert this logic again :(
What does openvpn currently do if I do ip link set tun0 down ; sleep 5 ; ip link set tun0 up with a tuntap interface?
I think nothing happens, because userspace doesn't monitor the netdev status. Therefore, unless tun closed the socket (which I think it does only when the interface is destroyed), userspace does not even realize that the interface went down.
What does IPsec do in this case? Does it keep connections open and keepalives flowing?
One counter example we have in the kernel are 802.11 interfaces. Any 802.11 interface must be brought up before you can possibly establish a WiFi link. If you bring the interface down the link is closed and no 802.11 control packets flow anymore.
However, 802.11 is different as we are controlling a "physical behaviour", while in ovpn (like other tunneling modules) we are controlling a "virtual behaviour".
Regards,
Regards,