genl.hpp

Go to the documentation of this file.

//    OpenVPN -- An application to securely tunnel IP networks
//               over a single port, with support for SSL/TLS-based
//               session authentication and key exchange,
//               packet encryption, packet authentication, and
//               packet compression.
//
//    Copyright (C) 2012- OpenVPN Inc.
//    Copyright (C) 2020-2022 Lev Stipakov <lev@openvpn.net>
//
//    SPDX-License-Identifier: MPL-2.0 OR AGPL-3.0-only WITH openvpn3-openssl-exception
//
 
 
#pragma once
 
#include <openvpn/addr/ipv4.hpp>
#include <openvpn/addr/ipv6.hpp>
#include <openvpn/buffer/buffer.hpp>
#include <openvpn/buffer/bufstr.hpp>
#include <openvpn/common/exception.hpp>
#include <openvpn/dco/key.hpp>
 
#include <openvpn/dco/ovpn_dco_linux.h>
#include <netlink/genl/ctrl.h>
#include <netlink/genl/family.h>
#include <netlink/genl/genl.h>
#include <netlink/netlink.h>
#include <netlink/socket.h>
 
#include <memory>
 
namespace openvpn {
 
#define nla_nest_start(_msg, _type) nla_nest_start(_msg, (_type) | NLA_F_NESTED)
 
typedef int (*ovpn_nl_cb)(struct nl_msg *msg, void *arg);
 
struct OvpnDcoPeer
{
    typedef RCPtr<struct OvpnDcoPeer> Ptr;
    __u32 id;
    struct in_addr ipv4;
    struct in6_addr ipv6;
    __u16 local_port;
    struct sockaddr_storage remote;
    struct
    {
        __u32 interval;
        __u32 timeout;
    } keepalive;
    struct
    {
        __u64 rx_bytes, tx_bytes;
        __u32 rx_pkts, tx_pkts;
    } vpn;
    struct
    {
        __u64 rx_bytes, tx_bytes;
        __u32 rx_pkts, tx_pkts;
    } transport;
};
 
template <typename ReadHandler>
class GeNL : public RC<thread_unsafe_refcount>
{
    OPENVPN_EXCEPTION(netlink_error);
 
    typedef std::unique_ptr<nl_msg, decltype(&nlmsg_free)> NlMsgPtr;
    typedef std::unique_ptr<nl_sock, decltype(&nl_socket_free)> NlSockPtr;
    typedef std::unique_ptr<nl_cb, decltype(&nl_cb_put)> NlCbPtr;
 
  public:
    typedef RCPtr<GeNL> Ptr;
 
    static bool available()
    {
        NlSockPtr sock_ptr(nl_socket_alloc(), nl_socket_free);
 
        int nl_family_id = -1;
        if (sock_ptr && genl_connect(sock_ptr.get()) == 0)
            nl_family_id = genl_ctrl_resolve(sock_ptr.get(), OVPN_NL_NAME);
 
        return nl_family_id >= 0;
    }
 
    explicit GeNL(openvpn_io::io_context &io_context,
                  unsigned int ifindex_arg,
                  ReadHandler read_handler_arg)
        : sock_ptr(nl_socket_alloc(), nl_socket_free),
          cb_ptr(nl_cb_alloc(NL_CB_DEFAULT), nl_cb_put),
          sock(sock_ptr.get()),
          cb(cb_ptr.get()),
          ifindex(ifindex_arg),
          read_handler(read_handler_arg),
          halt(false)
    {
        nl_socket_set_buffer_size(sock, 8192, 8192);
 
        int ret = genl_connect(sock);
        if (ret != 0)
            OPENVPN_THROW(netlink_error,
                          " cannot connect to generic netlink: " << nl_geterror(ret));
 
        int mcast_id = get_mcast_id();
        if (mcast_id < 0)
            OPENVPN_THROW(netlink_error,
                          " cannot get multicast group: " << nl_geterror(mcast_id));
 
        ret = nl_socket_add_membership(sock, mcast_id);
        if (ret)
            OPENVPN_THROW(netlink_error, "failed to join mcast group: " << ret);
 
        ovpn_dco_id = genl_ctrl_resolve(sock, OVPN_NL_NAME);
        if (ovpn_dco_id < 0)
            OPENVPN_THROW(netlink_error,
                          " cannot find ovpn_dco netlink component: " << ovpn_dco_id);
 
        // set callback to handle control channel messages
        nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, message_received, this);
 
        // clang-format off
        nl_cb_set(cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
            [](struct nl_msg *, void *) -> int
            { return NL_OK; },
            NULL);
        // clang-format on
 
        nl_socket_set_cb(sock, cb);
 
        // wrap netlink socket into ASIO primitive for async read
        stream.reset(new openvpn_io::posix::stream_descriptor(
            io_context, nl_socket_get_fd(sock)));
 
        nl_socket_set_nonblocking(sock);
 
        queue_genl_read();
    }
 
    void new_peer(int peer_id,
                  int fd,
                  struct sockaddr *sa,
                  socklen_t salen,
                  IPv4::Addr vpn4,
                  IPv6::Addr vpn6)
    {
        auto msg_ptr = create_msg(OVPN_CMD_NEW_PEER);
        auto *msg = msg_ptr.get();
        struct nlattr *attr = nla_nest_start(msg, OVPN_ATTR_NEW_PEER);
 
        NLA_PUT_U32(msg, OVPN_NEW_PEER_ATTR_PEER_ID, peer_id);
        NLA_PUT_U32(msg, OVPN_NEW_PEER_ATTR_SOCKET, fd);
        NLA_PUT(msg, OVPN_NEW_PEER_ATTR_SOCKADDR_REMOTE, salen, sa);
 
        if (vpn4.specified())
        {
            NLA_PUT_U32(msg, OVPN_NEW_PEER_ATTR_IPV4, vpn4.to_uint32_net());
        }
 
        if (vpn6.specified())
        {
            struct in6_addr addr6 = vpn6.to_in6_addr();
            NLA_PUT(msg, OVPN_NEW_PEER_ATTR_IPV6, sizeof(addr6), &addr6);
        }
 
        nla_nest_end(msg, attr);
 
        send_netlink_message(msg);
        return;
 
    nla_put_failure:
        OPENVPN_THROW(netlink_error, " new_peer() nla_put_failure");
    }
 
    void new_key(unsigned int key_slot, const KoRekey::KeyConfig *kc)
    {
        auto msg_ptr = create_msg(OVPN_CMD_NEW_KEY);
        auto *msg = msg_ptr.get();
 
        const int NONCE_TAIL_LEN = 8;
 
        struct nlattr *key_dir;
 
        struct nlattr *attr = nla_nest_start(msg, OVPN_ATTR_NEW_KEY);
        if (!attr)
            OPENVPN_THROW(netlink_error, " new_key() cannot allocate submessage");
 
        NLA_PUT_U32(msg, OVPN_NEW_KEY_ATTR_PEER_ID, kc->remote_peer_id);
        NLA_PUT_U8(msg, OVPN_NEW_KEY_ATTR_KEY_SLOT, static_cast<uint8_t>(key_slot));
        NLA_PUT_U8(msg, OVPN_NEW_KEY_ATTR_KEY_ID, static_cast<uint8_t>(kc->key_id));
        NLA_PUT_U16(msg, OVPN_NEW_KEY_ATTR_CIPHER_ALG, static_cast<uint16_t>(kc->cipher_alg));
 
        key_dir = nla_nest_start(msg, OVPN_NEW_KEY_ATTR_ENCRYPT_KEY);
        if (!key_dir)
            OPENVPN_THROW(netlink_error,
                          " new_key() cannot allocate encrypt key submessage");
 
        NLA_PUT(msg, OVPN_KEY_DIR_ATTR_CIPHER_KEY, kc->encrypt.cipher_key_size, kc->encrypt.cipher_key);
        if (kc->cipher_alg == OVPN_CIPHER_ALG_AES_GCM
            || kc->cipher_alg == OVPN_CIPHER_ALG_CHACHA20_POLY1305)
        {
            NLA_PUT(msg, OVPN_KEY_DIR_ATTR_NONCE_TAIL, NONCE_TAIL_LEN, kc->encrypt.nonce_tail);
        }
        nla_nest_end(msg, key_dir);
 
        key_dir = nla_nest_start(msg, OVPN_NEW_KEY_ATTR_DECRYPT_KEY);
        if (!key_dir)
            OPENVPN_THROW(netlink_error,
                          " new_key() cannot allocate decrypt key submessage");
 
        NLA_PUT(msg, OVPN_KEY_DIR_ATTR_CIPHER_KEY, kc->decrypt.cipher_key_size, kc->decrypt.cipher_key);
        if (kc->cipher_alg == OVPN_CIPHER_ALG_AES_GCM
            || kc->cipher_alg == OVPN_CIPHER_ALG_CHACHA20_POLY1305)
        {
            NLA_PUT(msg, OVPN_KEY_DIR_ATTR_NONCE_TAIL, NONCE_TAIL_LEN, kc->decrypt.nonce_tail);
        }
        nla_nest_end(msg, key_dir);
 
        nla_nest_end(msg, attr);
 
        send_netlink_message(msg);
        return;
 
    nla_put_failure:
        OPENVPN_THROW(netlink_error, " new_key() nla_put_failure");
    }
 
    void swap_keys(int peer_id)
    {
        auto msg_ptr = create_msg(OVPN_CMD_SWAP_KEYS);
        auto *msg = msg_ptr.get();
        struct nlattr *attr = nla_nest_start(msg, OVPN_ATTR_SWAP_KEYS);
        if (!attr)
            OPENVPN_THROW(netlink_error, " swap_keys() cannot allocate submessage");
 
        NLA_PUT_U32(msg, OVPN_SWAP_KEYS_ATTR_PEER_ID, peer_id);
 
        nla_nest_end(msg, attr);
 
        send_netlink_message(msg);
        return;
 
    nla_put_failure:
        OPENVPN_THROW(netlink_error, " swap_keys() nla_put_failure");
    }
 
    void del_key(int peer_id, unsigned int key_slot)
    {
        auto msg_ptr = create_msg(OVPN_CMD_DEL_KEY);
        auto *msg = msg_ptr.get();
        struct nlattr *attr = nla_nest_start(msg, OVPN_ATTR_DEL_KEY);
        if (!attr)
            OPENVPN_THROW(netlink_error, " del_key() cannot allocate submessage");
 
        NLA_PUT_U32(msg, OVPN_DEL_KEY_ATTR_PEER_ID, peer_id);
        NLA_PUT_U8(msg, OVPN_DEL_KEY_ATTR_KEY_SLOT, static_cast<uint8_t>(key_slot));
 
        nla_nest_end(msg, attr);
 
        send_netlink_message(msg);
        return;
 
    nla_put_failure:
        OPENVPN_THROW(netlink_error, " del_key() nla_put_failure");
    }
 
    void set_peer(int peer_id, unsigned int keepalive_interval, unsigned int keepalive_timeout)
    {
        auto msg_ptr = create_msg(OVPN_CMD_SET_PEER);
        auto *msg = msg_ptr.get();
        struct nlattr *attr = nla_nest_start(msg, OVPN_ATTR_SET_PEER);
        if (!attr)
            OPENVPN_THROW(netlink_error, " set_peer() cannot allocate submessage");
 
        NLA_PUT_U32(msg, OVPN_SET_PEER_ATTR_PEER_ID, peer_id);
        NLA_PUT_U32(msg, OVPN_SET_PEER_ATTR_KEEPALIVE_INTERVAL, keepalive_interval);
        NLA_PUT_U32(msg, OVPN_SET_PEER_ATTR_KEEPALIVE_TIMEOUT, keepalive_timeout);
 
        nla_nest_end(msg, attr);
 
        send_netlink_message(msg);
        return;
 
    nla_put_failure:
        OPENVPN_THROW(netlink_error, " set_peer() nla_put_failure");
    }
 
    void del_peer(int peer_id)
    {
        auto msg_ptr = create_msg(OVPN_CMD_DEL_PEER);
        auto *msg = msg_ptr.get();
        struct nlattr *attr = nla_nest_start(msg, OVPN_ATTR_DEL_PEER);
        if (!attr)
            OPENVPN_THROW(netlink_error, " del_peer() cannot allocate submessage");
 
        NLA_PUT_U32(msg, OVPN_DEL_PEER_ATTR_PEER_ID, peer_id);
 
        nla_nest_end(msg, attr);
 
        send_netlink_message(msg);
        return;
 
    nla_put_failure:
        OPENVPN_THROW(netlink_error, " del_peer() nla_put_failure");
    }
 
    void get_peer(int peer_id, bool sync)
    {
        auto msg_ptr = create_msg(OVPN_CMD_GET_PEER);
        auto *msg = msg_ptr.get();
        struct nlattr *attr = nla_nest_start(msg, OVPN_ATTR_GET_PEER);
        if (!attr)
            OPENVPN_THROW(netlink_error, " get_peer() cannot allocate submessage");
 
        NLA_PUT_U32(msg, OVPN_GET_PEER_ATTR_PEER_ID, peer_id);
 
        nla_nest_end(msg, attr);
 
        nl_status = 1;
        send_netlink_message(msg);
 
        /* if the user has requested a synchronous execution, wait for the reply and parse
         * it here directly
         */
        while (sync && nl_status == 1)
        {
            stream->wait(openvpn_io::posix::stream_descriptor::wait_read);
            read_netlink_message();
        }
 
        return;
 
    nla_put_failure:
        OPENVPN_THROW(netlink_error, " get_peer() nla_put_failure");
    }
 
    void stop()
    {
        if (!halt)
        {
            halt = true;
 
            try
            {
                stream->cancel();
                stream->close();
            }
            catch (...)
            {
                // ASIO might throw transport exceptions which I found is safe to ignore
            }
 
            // contrary to what ASIO doc says, stream->close() doesn't
            // cancel async read on netlink socket, explicitly close it here
            sock_ptr.reset();
            cb_ptr.reset();
        }
    }
 
  private:
    struct mcast_handler_args
    {
        const char *group;
        int id;
    };
 
    static int mcast_family_handler(struct nl_msg *msg, void *arg)
    {
        struct mcast_handler_args *grp = static_cast<mcast_handler_args *>(arg);
        struct nlattr *tb[CTRL_ATTR_MAX + 1];
        struct genlmsghdr *gnlh = static_cast<genlmsghdr *>(
            nlmsg_data(reinterpret_cast<const nlmsghdr *>(nlmsg_hdr(msg))));
        struct nlattr *mcgrp;
        int rem_mcgrp;
 
        nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0), genlmsg_attrlen(gnlh, 0), NULL);
 
        if (!tb[CTRL_ATTR_MCAST_GROUPS])
            return NL_SKIP;
 
        nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], rem_mcgrp)
        {
            struct nlattr *tb_mcgrp[CTRL_ATTR_MCAST_GRP_MAX + 1];
 
            nla_parse(tb_mcgrp,
                      CTRL_ATTR_MCAST_GRP_MAX,
                      static_cast<nlattr *>(nla_data(mcgrp)),
                      nla_len(mcgrp),
                      NULL);
 
            if (!tb_mcgrp[CTRL_ATTR_MCAST_GRP_NAME] || !tb_mcgrp[CTRL_ATTR_MCAST_GRP_ID])
                continue;
            if (strncmp((const char *)nla_data(tb_mcgrp[CTRL_ATTR_MCAST_GRP_NAME]),
                        grp->group,
                        nla_len(tb_mcgrp[CTRL_ATTR_MCAST_GRP_NAME])))
                continue;
            grp->id = nla_get_u32(tb_mcgrp[CTRL_ATTR_MCAST_GRP_ID]);
            break;
        }
 
        return NL_SKIP;
    }
 
    int get_mcast_id()
    {
        int ret = 1;
        struct mcast_handler_args grp = {
            .group = OVPN_NL_MULTICAST_GROUP_PEERS,
            .id = -ENOENT,
        };
        NlMsgPtr msg_ptr(nlmsg_alloc(), nlmsg_free);
        auto *msg = msg_ptr.get();
 
        NlCbPtr mcast_cb_ptr(nl_cb_alloc(NL_CB_DEFAULT), nl_cb_put);
        auto *mcast_cb = mcast_cb_ptr.get();
 
        int ctrlid = genl_ctrl_resolve(sock, "nlctrl");
 
        genlmsg_put(msg, 0, 0, ctrlid, 0, 0, CTRL_CMD_GETFAMILY, 0);
        NLA_PUT_STRING(msg, CTRL_ATTR_FAMILY_NAME, OVPN_NL_NAME);
 
        send_netlink_message(msg);
 
        // clang-format off
        nl_cb_err(mcast_cb, NL_CB_CUSTOM,
                  [](struct sockaddr_nl *nla, struct nlmsgerr *err, void *arg) -> int
                  {
                          int *ret = static_cast<int *>(arg);
                          *ret = err->error;
                          return NL_STOP; },
                  &ret);
        nl_cb_set(mcast_cb, NL_CB_ACK, NL_CB_CUSTOM,
                  [](struct nl_msg *msg, void *arg) -> int
                  {
                          int *ret = static_cast<int *>(arg);
                          *ret = 0;
                          return NL_STOP; },
                  &ret);
        // clang-format on
 
        nl_cb_set(mcast_cb, NL_CB_VALID, NL_CB_CUSTOM, mcast_family_handler, &grp);
 
        while (ret > 0)
            nl_recvmsgs(sock, mcast_cb);
 
        if (ret == 0)
            ret = grp.id;
 
        return ret;
 
    nla_put_failure:
        OPENVPN_THROW(netlink_error, "get_mcast_id() nla_put_failure");
    }
 
    void handle_read(const openvpn_io::error_code &error)
    {
        if (halt)
            return;
 
        std::ostringstream os;
        if (error)
        {
            os << "error reading netlink message: " << error.message() << ", "
               << error;
            reset_buffer();
            int8_t cmd = -1;
            buf.write(&cmd, sizeof(cmd));
            buf_write_string(buf, os.str());
            read_handler->tun_read_handler(buf);
        }
 
        try
        {
            read_netlink_message();
            queue_genl_read();
        }
        catch (const netlink_error &e)
        {
            reset_buffer();
            int8_t cmd = -1;
            buf.write(&cmd, sizeof(cmd));
            buf_write_string(buf, e.what());
            read_handler->tun_read_handler(buf);
        }
    }
 
    void queue_genl_read()
    {
        stream->async_wait(openvpn_io::posix::stream_descriptor::wait_read,
                           [self = Ptr(this)](const openvpn_io::error_code &error)
                           {
                               self->handle_read(error);
                           });
    }
 
    NlMsgPtr create_msg(enum ovpn_nl_commands cmd)
    {
        NlMsgPtr msg_ptr(nlmsg_alloc(), nlmsg_free);
        genlmsg_put(msg_ptr.get(), 0, 0, ovpn_dco_id, 0, 0, cmd, 0);
        NLA_PUT_U32(msg_ptr.get(), OVPN_ATTR_IFINDEX, ifindex);
        return msg_ptr;
 
    nla_put_failure:
        OPENVPN_THROW(netlink_error, " create_msg() nla_put_failure");
    }
 
    void read_netlink_message()
    {
        // this is standard error code returned from kernel
        // and assigned inside ovpn_nl_cb_error()
        int ovpn_dco_err = 0;
        nl_cb_err(cb, NL_CB_CUSTOM, ovpn_nl_cb_error, &ovpn_dco_err);
 
        // this triggers reading callback, GeNL::message_received(),
        // and, if neccessary, ovpn_nl_cb_error() and returns netlink error code
        int netlink_err = nl_recvmsgs(sock, cb);
 
        if (ovpn_dco_err != 0)
            OPENVPN_THROW(netlink_error,
                          "ovpn-dco error on receiving message: "
                              << strerror(-ovpn_dco_err) << ", " << ovpn_dco_err);
 
        if (netlink_err < 0)
            OPENVPN_THROW(netlink_error,
                          "netlink error on receiving message: "
                              << nl_geterror(netlink_err) << ", " << netlink_err);
    }
 
    static int message_received(struct nl_msg *msg, void *arg)
    {
        GeNL *self = static_cast<GeNL *>(arg);
        int ret;
 
        struct genlmsghdr *gnlh = static_cast<genlmsghdr *>(
            nlmsg_data(reinterpret_cast<const nlmsghdr *>(nlmsg_hdr(msg))));
        struct nlmsghdr *nlh = nlmsg_hdr(msg);
        struct nlattr *attrs[OVPN_ATTR_MAX + 1];
 
        if (!genlmsg_valid_hdr(nlh, 0))
        {
            OPENVPN_LOG("ovpn-dco: invalid header");
            return NL_SKIP;
        }
 
        if (nla_parse(attrs, OVPN_ATTR_MAX, genlmsg_attrdata(gnlh, 0), genlmsg_attrlen(gnlh, 0), NULL))
        {
            OPENVPN_LOG("received bogus data from ovpn-dco");
            return NL_SKIP;
        }
 
        if (!attrs[OVPN_ATTR_IFINDEX])
        {
            OPENVPN_LOG("missing OVPN_ATTR_IFINDEX attribute in message");
            return NL_SKIP;
        }
 
        if (self->ifindex != nla_get_u32(attrs[OVPN_ATTR_IFINDEX]))
            return NL_SKIP;
 
        switch (gnlh->cmd)
        {
        case OVPN_CMD_DEL_PEER:
            if (!attrs[OVPN_ATTR_DEL_PEER])
                OPENVPN_THROW(netlink_error, "missing OVPN_ATTR_DEL_PEER attribute in "
                                             "OVPN_CMD_DEL_PEER command");
 
            struct nlattr *del_peer_attrs[OVPN_DEL_PEER_ATTR_MAX + 1];
            ret = nla_parse_nested(del_peer_attrs, OVPN_DEL_PEER_ATTR_MAX, attrs[OVPN_ATTR_DEL_PEER], NULL);
            if (ret)
                OPENVPN_THROW(netlink_error,
                              "cannot parse OVPN_ATTR_DEL_PEER attribute");
 
            if (!del_peer_attrs[OVPN_DEL_PEER_ATTR_PEER_ID] || !del_peer_attrs[OVPN_DEL_PEER_ATTR_REASON])
                OPENVPN_THROW(netlink_error, "missing attributes in OVPN_CMD_DEL_PEER");
 
            self->reset_buffer();
            self->buf.write(&gnlh->cmd, sizeof(gnlh->cmd));
 
            {
                uint32_t peer_id = nla_get_u32(del_peer_attrs[OVPN_DEL_PEER_ATTR_PEER_ID]);
                self->buf.write(&peer_id, sizeof(peer_id));
            }
 
            {
                uint8_t reason = nla_get_u8(del_peer_attrs[OVPN_DEL_PEER_ATTR_REASON]);
                self->buf.write(&reason, sizeof(reason));
            }
 
            self->read_handler->tun_read_handler(self->buf);
            break;
 
        case OVPN_CMD_GET_PEER:
            {
                if (!attrs[OVPN_ATTR_GET_PEER])
                    OPENVPN_THROW(netlink_error, "missing OVPN_ATTR_GET_PEER attribute in "
                                                 "OVPN_CMD_GET_PEER command reply");
 
                struct nlattr *get_peer_attrs[OVPN_GET_PEER_RESP_ATTR_MAX + 1];
                ret = nla_parse_nested(get_peer_attrs, OVPN_GET_PEER_RESP_ATTR_MAX, attrs[OVPN_ATTR_GET_PEER], NULL);
                if (ret)
                    OPENVPN_THROW(netlink_error, "cannot parse OVPN_ATTR_GET_PEER attribute");
 
                if (!get_peer_attrs[OVPN_GET_PEER_RESP_ATTR_PEER_ID])
                    OPENVPN_THROW(netlink_error, "missing attributes in OVPN_CMD_DEL_PEER");
 
                struct OvpnDcoPeer peer = {0};
                peer.id = nla_get_u32(get_peer_attrs[OVPN_GET_PEER_RESP_ATTR_PEER_ID]);
                memcpy(&peer.ipv4, nla_data(get_peer_attrs[OVPN_GET_PEER_RESP_ATTR_IPV4]), sizeof(peer.ipv4));
                memcpy(&peer.ipv6, nla_data(get_peer_attrs[OVPN_GET_PEER_RESP_ATTR_IPV6]), sizeof(peer.ipv6));
                peer.local_port = nla_get_u16(get_peer_attrs[OVPN_GET_PEER_RESP_ATTR_LOCAL_PORT]);
                memcpy(&peer.remote,
                       nla_data(get_peer_attrs[OVPN_GET_PEER_RESP_ATTR_SOCKADDR_REMOTE]),
                       nla_len(get_peer_attrs[OVPN_GET_PEER_RESP_ATTR_SOCKADDR_REMOTE]));
                peer.keepalive.interval = nla_get_u32(get_peer_attrs[OVPN_GET_PEER_RESP_ATTR_KEEPALIVE_INTERVAL]);
                peer.keepalive.timeout = nla_get_u32(get_peer_attrs[OVPN_GET_PEER_RESP_ATTR_KEEPALIVE_TIMEOUT]);
                peer.vpn.rx_bytes = nla_get_u64(get_peer_attrs[OVPN_GET_PEER_RESP_ATTR_VPN_RX_BYTES]);
                peer.vpn.tx_bytes = nla_get_u64(get_peer_attrs[OVPN_GET_PEER_RESP_ATTR_VPN_TX_BYTES]);
                peer.vpn.rx_pkts = nla_get_u32(get_peer_attrs[OVPN_GET_PEER_RESP_ATTR_VPN_RX_PACKETS]);
                peer.vpn.tx_pkts = nla_get_u32(get_peer_attrs[OVPN_GET_PEER_RESP_ATTR_VPN_TX_PACKETS]);
 
                peer.transport.rx_bytes = nla_get_u64(get_peer_attrs[OVPN_GET_PEER_RESP_ATTR_LINK_RX_BYTES]);
                peer.transport.tx_bytes = nla_get_u64(get_peer_attrs[OVPN_GET_PEER_RESP_ATTR_LINK_TX_BYTES]);
                peer.transport.rx_pkts = nla_get_u32(get_peer_attrs[OVPN_GET_PEER_RESP_ATTR_LINK_RX_PACKETS]);
                peer.transport.tx_pkts = nla_get_u32(get_peer_attrs[OVPN_GET_PEER_RESP_ATTR_LINK_TX_PACKETS]);
 
                self->reset_buffer();
                self->buf.write(&gnlh->cmd, sizeof(gnlh->cmd));
                self->buf.write(&peer, sizeof(peer));
 
                self->read_handler->tun_read_handler(self->buf);
                /* report to the other context that the reply has been received */
                nl_status = 0;
                break;
            }
        default:
            OPENVPN_LOG(__func__ << " unknown netlink command: " << (int)gnlh->cmd);
        }
 
        return NL_SKIP;
    }
 
    void reset_buffer()
    {
        // good enough values to handle control packets
        buf.reset(512, 3072, BufAllocFlags::GROW | BufAllocFlags::CONSTRUCT_ZERO | BufAllocFlags::DESTRUCT_ZERO);
    }
 
    static int ovpn_nl_cb_error(struct sockaddr_nl *nla,
                                struct nlmsgerr *err,
                                void *arg)
    {
        struct nlmsghdr *nlh = (struct nlmsghdr *)err - 1;
        struct nlattr *tb_msg[NLMSGERR_ATTR_MAX + 1];
        int len = nlh->nlmsg_len;
        struct nlattr *attrs;
        int *ret = static_cast<int *>(arg);
        int ack_len = sizeof(*nlh) + sizeof(int) + sizeof(*nlh);
 
        *ret = err->error;
 
        if (!(nlh->nlmsg_flags & NLM_F_ACK_TLVS))
            return NL_STOP;
 
        if (!(nlh->nlmsg_flags & NLM_F_CAPPED))
            ack_len += static_cast<int>(err->msg.nlmsg_len - sizeof(*nlh));
 
        if (len <= ack_len)
            return NL_STOP;
 
        attrs = reinterpret_cast<nlattr *>((unsigned char *)nlh + ack_len);
        len -= ack_len;
 
        nla_parse(tb_msg, NLMSGERR_ATTR_MAX, attrs, len, NULL);
        if (tb_msg[NLMSGERR_ATTR_MSG])
        {
            OPENVPN_LOG(__func__ << " kernel error "
                                 << (char *)nla_data(tb_msg[NLMSGERR_ATTR_MSG]));
        }
 
        return NL_STOP;
    }
 
    void send_netlink_message(struct nl_msg *msg)
    {
        int netlink_err = nl_send_auto(sock, msg);
 
        if (netlink_err < 0)
            OPENVPN_THROW(netlink_error,
                          "netlink error on sending message: "
                              << nl_geterror(netlink_err) << ", " << netlink_err);
    }
 
    NlSockPtr sock_ptr;
    NlCbPtr cb_ptr;
 
    struct nl_sock *sock;
    struct nl_cb *cb;
 
    int ovpn_dco_id;
    unsigned int ifindex;
 
    ReadHandler read_handler;
 
    bool halt;
    BufferAllocated buf;
 
    std::unique_ptr<openvpn_io::posix::stream_descriptor> stream;
    static int nl_status;
};
 
template <typename ReadHandler>
int GeNL<ReadHandler>::nl_status = 0;
 
} // namespace openvpn