xref: /freebsd/sys/net/if_ovpn.c (revision 969be39fb3caf4272f128dbf3267ceba5966a6ce)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2021-2022 Rubicon Communications, LLC (Netgate)
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  *
27  */
28 #include "opt_inet.h"
29 #include "opt_inet6.h"
30 
31 #include <sys/param.h>
32 #include <sys/systm.h>
33 #include <sys/buf_ring.h>
34 #include <sys/epoch.h>
35 #include <sys/file.h>
36 #include <sys/filedesc.h>
37 #include <sys/jail.h>
38 #include <sys/kernel.h>
39 #include <sys/malloc.h>
40 #include <sys/mbuf.h>
41 #include <sys/module.h>
42 #include <sys/nv.h>
43 #include <sys/osd.h>
44 #include <sys/priv.h>
45 #include <sys/protosw.h>
46 #include <sys/rmlock.h>
47 #include <sys/sdt.h>
48 #include <sys/smp.h>
49 #include <sys/socket.h>
50 #include <sys/socketvar.h>
51 #include <sys/sockio.h>
52 #include <sys/sysctl.h>
53 #include <sys/time.h>
54 
55 #include <machine/atomic.h>
56 
57 #include <net/bpf.h>
58 #include <net/if.h>
59 #include <net/if_clone.h>
60 #include <net/if_types.h>
61 #include <net/if_var.h>
62 #include <net/if_private.h>
63 #include <net/netisr.h>
64 #include <net/route/nhop.h>
65 
66 #include <netinet/in.h>
67 #include <netinet/in_fib.h>
68 #include <netinet/ip.h>
69 #include <netinet/ip6.h>
70 #include <netinet/ip_var.h>
71 #include <netinet/udp.h>
72 #include <netinet/udp_var.h>
73 
74 #include <netinet6/ip6_var.h>
75 #include <netinet6/in6_fib.h>
76 
77 #include <machine/in_cksum.h>
78 
79 #include <opencrypto/cryptodev.h>
80 
81 #include "if_ovpn.h"
82 
83 struct ovpn_kkey_dir {
84 	uint8_t			key[32];
85 	uint8_t			keylen;
86 	uint8_t			nonce[8];
87 	uint8_t			noncelen;
88 	enum ovpn_key_cipher	cipher;
89 	crypto_session_t	cryptoid;
90 
91 	struct mtx		replay_mtx;
92 	/*
93 	 * Last seen gapless sequence number. New rx seq numbers must be
94 	 * strictly higher than this.
95 	 */
96 	uint32_t		rx_seq;
97 	uint64_t		tx_seq;
98 
99 	/* Seen packets, relative to rx_seq. bit(0) will always be 0. */
100 	uint64_t		rx_window;
101 };
102 
103 struct ovpn_kkey {
104 	struct ovpn_kkey_dir	*encrypt;
105 	struct ovpn_kkey_dir	*decrypt;
106 	uint8_t			 keyid;
107 	uint32_t		 peerid;
108 };
109 
110 struct ovpn_keepalive {
111 	uint32_t	interval;
112 	uint32_t	timeout;
113 };
114 
115 struct ovpn_wire_header {
116 	uint32_t	 opcode; /* opcode, key id, peer id */
117 	uint32_t	 seq;
118 	uint8_t		 auth_tag[16];
119 };
120 
121 struct ovpn_peer_counters {
122 	uint64_t	pkt_in;
123 	uint64_t	pkt_out;
124 	uint64_t	bytes_in;
125 	uint64_t	bytes_out;
126 };
127 #define OVPN_PEER_COUNTER_SIZE (sizeof(struct ovpn_peer_counters)/sizeof(uint64_t))
128 
129 struct ovpn_notification {
130 	enum ovpn_notif_type	type;
131 	uint32_t		peerid;
132 
133 	/* Delete notification */
134 	enum ovpn_del_reason	del_reason;
135 	struct ovpn_peer_counters	counters;
136 
137 	/* Float notification */
138 	struct sockaddr_storage	address;
139 };
140 
141 struct ovpn_softc;
142 
143 struct ovpn_kpeer {
144 	RB_ENTRY(ovpn_kpeer)	 tree;
145 	int			 refcount;
146 	uint32_t		 peerid;
147 
148 	struct ovpn_softc	*sc;
149 	struct sockaddr_storage	 local;
150 	struct sockaddr_storage	 remote;
151 
152 	struct in_addr		 vpn4;
153 	struct in6_addr		 vpn6;
154 
155 	struct ovpn_kkey	 keys[2];
156 
157 	enum ovpn_del_reason	 del_reason;
158 	struct ovpn_keepalive	 keepalive;
159 	uint32_t		*last_active;
160 	struct callout		 ping_send;
161 	struct callout		 ping_rcv;
162 
163 	counter_u64_t		 counters[OVPN_PEER_COUNTER_SIZE];
164 };
165 
166 struct ovpn_counters {
167 	uint64_t	lost_ctrl_pkts_in;
168 	uint64_t	lost_ctrl_pkts_out;
169 	uint64_t	lost_data_pkts_in;
170 	uint64_t	lost_data_pkts_out;
171 	uint64_t	nomem_data_pkts_in;
172 	uint64_t	nomem_data_pkts_out;
173 	uint64_t	received_ctrl_pkts;
174 	uint64_t	received_data_pkts;
175 	uint64_t	sent_ctrl_pkts;
176 	uint64_t	sent_data_pkts;
177 
178 	uint64_t	transport_bytes_sent;
179 	uint64_t	transport_bytes_received;
180 	uint64_t	tunnel_bytes_sent;
181 	uint64_t	tunnel_bytes_received;
182 };
183 #define OVPN_COUNTER_SIZE (sizeof(struct ovpn_counters)/sizeof(uint64_t))
184 
185 RB_HEAD(ovpn_kpeers, ovpn_kpeer);
186 
187 struct ovpn_softc {
188 	int			 refcount;
189 	struct rmlock		 lock;
190 	struct ifnet		*ifp;
191 	struct socket		*so;
192 	int			 peercount;
193 	struct ovpn_kpeers	 peers;
194 
195 	/* Pending notification */
196 	struct buf_ring		*notifring;
197 
198 	counter_u64_t 		 counters[OVPN_COUNTER_SIZE];
199 
200 	struct epoch_context	 epoch_ctx;
201 };
202 
203 struct ovpn_mtag {
204 	struct sockaddr_storage	 addr;
205 };
206 
207 static struct ovpn_kpeer *ovpn_find_peer(struct ovpn_softc *, uint32_t);
208 static bool ovpn_udp_input(struct mbuf *, int, struct inpcb *,
209     const struct sockaddr *, void *);
210 static int ovpn_transmit_to_peer(struct ifnet *, struct mbuf *,
211     struct ovpn_kpeer *, struct rm_priotracker *);
212 static int ovpn_encap(struct ovpn_softc *, uint32_t, struct mbuf *);
213 static int ovpn_get_af(struct mbuf *);
214 static void ovpn_free_kkey_dir(struct ovpn_kkey_dir *);
215 static bool ovpn_check_replay(struct ovpn_kkey_dir *, uint32_t);
216 static int ovpn_peer_compare(const struct ovpn_kpeer *,
217     const struct ovpn_kpeer *);
218 static bool ovpn_sockaddr_compare(const struct sockaddr *,
219     const struct sockaddr *);
220 
221 static RB_PROTOTYPE(ovpn_kpeers, ovpn_kpeer, tree, ovpn_peer_compare);
222 static RB_GENERATE(ovpn_kpeers, ovpn_kpeer, tree, ovpn_peer_compare);
223 
224 #define OVPN_MTU_MIN		576
225 #define OVPN_MTU_MAX		(IP_MAXPACKET - sizeof(struct ip) - \
226     sizeof(struct udphdr) - sizeof(struct ovpn_wire_header))
227 
228 #define OVPN_OP_DATA_V2		0x09
229 #define OVPN_OP_SHIFT		3
230 #define OVPN_SEQ_ROTATE		0x80000000
231 
232 VNET_DEFINE_STATIC(struct if_clone *, ovpn_cloner);
233 #define	V_ovpn_cloner	VNET(ovpn_cloner)
234 
235 #define OVPN_RLOCK_TRACKER	struct rm_priotracker _ovpn_lock_tracker; \
236     struct rm_priotracker *_ovpn_lock_trackerp = &_ovpn_lock_tracker
237 #define OVPN_RLOCK(sc)		rm_rlock(&(sc)->lock, _ovpn_lock_trackerp)
238 #define OVPN_RUNLOCK(sc)	rm_runlock(&(sc)->lock, _ovpn_lock_trackerp)
239 #define OVPN_WLOCK(sc)		rm_wlock(&(sc)->lock)
240 #define OVPN_WUNLOCK(sc)	rm_wunlock(&(sc)->lock)
241 #define OVPN_ASSERT(sc)		rm_assert(&(sc)->lock, RA_LOCKED)
242 #define OVPN_RASSERT(sc)	rm_assert(&(sc)->lock, RA_RLOCKED)
243 #define OVPN_WASSERT(sc)	rm_assert(&(sc)->lock, RA_WLOCKED)
244 #define OVPN_UNLOCK_ASSERT(sc)	rm_assert(&(sc)->lock, RA_UNLOCKED)
245 
246 #define OVPN_COUNTER(sc, name) \
247 	((sc)->counters[offsetof(struct ovpn_counters, name)/sizeof(uint64_t)])
248 #define OVPN_PEER_COUNTER(peer, name) \
249 	((peer)->counters[offsetof(struct ovpn_peer_counters, name) / \
250 	 sizeof(uint64_t)])
251 
252 #define OVPN_COUNTER_ADD(sc, name, val)	\
253 	counter_u64_add(OVPN_COUNTER(sc, name), val)
254 #define OVPN_PEER_COUNTER_ADD(p, name, val)	\
255 	counter_u64_add(OVPN_PEER_COUNTER(p, name), val)
256 
257 #define TO_IN(x)		((struct sockaddr_in *)(x))
258 #define TO_IN6(x)		((struct sockaddr_in6 *)(x))
259 
260 SDT_PROVIDER_DEFINE(if_ovpn);
261 SDT_PROBE_DEFINE1(if_ovpn, tx, transmit, start, "struct mbuf *");
262 SDT_PROBE_DEFINE2(if_ovpn, tx, route, ip4, "struct in_addr *", "struct ovpn_kpeer *");
263 SDT_PROBE_DEFINE2(if_ovpn, tx, route, ip6, "struct in6_addr *", "struct ovpn_kpeer *");
264 
265 static const char ovpnname[] = "ovpn";
266 static const char ovpngroupname[] = "openvpn";
267 
268 static MALLOC_DEFINE(M_OVPN, ovpnname, "OpenVPN DCO Interface");
269 #define	MTAG_OVPN_LOOP		0x6f76706e /* ovpn */
270 
271 SYSCTL_DECL(_net_link);
272 static SYSCTL_NODE(_net_link, IFT_OTHER, openvpn, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
273     "OpenVPN DCO Interface");
274 VNET_DEFINE_STATIC(int, replay_protection) = 0;
275 #define	V_replay_protection	VNET(replay_protection)
276 SYSCTL_INT(_net_link_openvpn, OID_AUTO, replay_protection, CTLFLAG_VNET | CTLFLAG_RW,
277     &VNET_NAME(replay_protection), 0, "Validate sequence numbers");
278 
279 VNET_DEFINE_STATIC(int, async_crypto);
280 #define	V_async_crypto		VNET(async_crypto)
281 SYSCTL_INT(_net_link_openvpn, OID_AUTO, async_crypto,
282 	CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(async_crypto), 0,
283 	"Use asynchronous mode to parallelize crypto jobs.");
284 
285 VNET_DEFINE_STATIC(int, async_netisr_queue);
286 #define	V_async_netisr_queue		VNET(async_netisr_queue)
287 SYSCTL_INT(_net_link_openvpn, OID_AUTO, netisr_queue,
288 	CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(async_netisr_queue), 0,
289 	"Use netisr_queue() rather than netisr_dispatch().");
290 
291 static int
ovpn_peer_compare(const struct ovpn_kpeer * a,const struct ovpn_kpeer * b)292 ovpn_peer_compare(const struct ovpn_kpeer *a, const struct ovpn_kpeer *b)
293 {
294 	return (a->peerid - b->peerid);
295 }
296 
297 static bool
ovpn_sockaddr_compare(const struct sockaddr * a,const struct sockaddr * b)298 ovpn_sockaddr_compare(const struct sockaddr *a,
299     const struct sockaddr *b)
300 {
301 	if (a->sa_family != b->sa_family)
302 		return (false);
303 	MPASS(a->sa_len == b->sa_len);
304 
305 	switch (a->sa_family) {
306 	case AF_INET: {
307 		const struct sockaddr_in *a4, *b4;
308 
309 		a4 = (const struct sockaddr_in *)a;
310 		b4 = (const struct sockaddr_in *)b;
311 
312 		if (a4->sin_port != b4->sin_port)
313 			return (false);
314 
315 		return (a4->sin_addr.s_addr == b4->sin_addr.s_addr);
316 	}
317 	case AF_INET6: {
318 		const struct sockaddr_in6 *a6, *b6;
319 
320 		a6 = (const struct sockaddr_in6 *)a;
321 		b6 = (const struct sockaddr_in6 *)b;
322 
323 		if (a6->sin6_port != b6->sin6_port)
324 			return (false);
325 		if (a6->sin6_scope_id != b6->sin6_scope_id)
326 			return (false);
327 
328 		return (memcmp(&a6->sin6_addr, &b6->sin6_addr,
329 		    sizeof(a6->sin6_addr)) == 0);
330 	}
331 	default:
332 		panic("Unknown address family %d", a->sa_family);
333 	}
334 }
335 
336 static struct ovpn_kpeer *
ovpn_find_peer(struct ovpn_softc * sc,uint32_t peerid)337 ovpn_find_peer(struct ovpn_softc *sc, uint32_t peerid)
338 {
339 	struct ovpn_kpeer p;
340 
341 	OVPN_ASSERT(sc);
342 
343 	p.peerid = peerid;
344 
345 	return (RB_FIND(ovpn_kpeers, &sc->peers, &p));
346 }
347 
348 static struct ovpn_kpeer *
ovpn_find_only_peer(struct ovpn_softc * sc)349 ovpn_find_only_peer(struct ovpn_softc *sc)
350 {
351 	OVPN_ASSERT(sc);
352 
353 	return (RB_ROOT(&sc->peers));
354 }
355 
356 static uint16_t
ovpn_get_port(const struct sockaddr_storage * s)357 ovpn_get_port(const struct sockaddr_storage *s)
358 {
359 	switch (s->ss_family) {
360 	case AF_INET: {
361 		const struct sockaddr_in *in = (const struct sockaddr_in *)s;
362 		return (in->sin_port);
363 	}
364 	case AF_INET6: {
365 		const struct sockaddr_in6 *in6 = (const struct sockaddr_in6 *)s;
366 		return (in6->sin6_port);
367 	}
368 	default:
369 		panic("Unsupported address family %d", s->ss_family);
370 	}
371 }
372 
373 static void
ovpn_set_port(struct sockaddr_storage * s,unsigned short port)374 ovpn_set_port(struct sockaddr_storage *s, unsigned short port)
375 {
376 	switch (s->ss_family) {
377 	case AF_INET: {
378 		struct sockaddr_in *in = (struct sockaddr_in *)s;
379 		in->sin_port = port;
380 		break;
381 	}
382 	case AF_INET6: {
383 		struct sockaddr_in6 *in6 = (struct sockaddr_in6 *)s;
384 		in6->sin6_port = port;
385 		break;
386 	}
387 	default:
388 		panic("Unsupported address family %d", s->ss_family);
389 	}
390 }
391 
392 static int
ovpn_nvlist_to_sockaddr(const nvlist_t * nvl,struct sockaddr_storage * sa)393 ovpn_nvlist_to_sockaddr(const nvlist_t *nvl, struct sockaddr_storage *sa)
394 {
395 	int af;
396 
397 	memset(sa, 0, sizeof(*sa));
398 
399 	if (! nvlist_exists_number(nvl, "af"))
400 		return (EINVAL);
401 	if (! nvlist_exists_binary(nvl, "address"))
402 		return (EINVAL);
403 	if (! nvlist_exists_number(nvl, "port"))
404 		return (EINVAL);
405 
406 	af = nvlist_get_number(nvl, "af");
407 	switch (af) {
408 #ifdef INET
409 	case AF_INET: {
410 		struct sockaddr_in *in = (struct sockaddr_in *)sa;
411 		size_t len;
412 		const void *addr = nvlist_get_binary(nvl, "address", &len);
413 
414 		memset(in, 0, sizeof(*in));
415 		in->sin_family = af;
416 		in->sin_len = sizeof(*in);
417 		if (len != sizeof(in->sin_addr))
418 			return (EINVAL);
419 
420 		memcpy(&in->sin_addr, addr, sizeof(in->sin_addr));
421 		in->sin_port = nvlist_get_number(nvl, "port");
422 		break;
423 	}
424 #endif
425 #ifdef INET6
426 	case AF_INET6: {
427 		struct sockaddr_in6 *in6 = (struct sockaddr_in6 *)sa;
428 		size_t len;
429 		const void *addr = nvlist_get_binary(nvl, "address", &len);
430 
431 		memset(in6, 0, sizeof(*in6));
432 		in6->sin6_family = af;
433 		in6->sin6_len = sizeof(*in6);
434 		if (len != sizeof(in6->sin6_addr))
435 			return (EINVAL);
436 
437 		memcpy(&in6->sin6_addr, addr, sizeof(in6->sin6_addr));
438 		in6->sin6_port = nvlist_get_number(nvl, "port");
439 
440 		if (nvlist_exists_number(nvl, "scopeid"))
441 			in6->sin6_scope_id = nvlist_get_number(nvl, "scopeid");
442 
443 		break;
444 	}
445 #endif
446 	default:
447 		return (EINVAL);
448 	}
449 
450 	return (0);
451 }
452 
453 static int
ovpn_add_sockaddr(nvlist_t * parent,const char * name,const struct sockaddr * s)454 ovpn_add_sockaddr(nvlist_t *parent, const char *name, const struct sockaddr *s)
455 {
456 	nvlist_t *nvl;
457 
458 	nvl = nvlist_create(0);
459 	if (nvl == NULL)
460 		return (ENOMEM);
461 
462 	nvlist_add_number(nvl, "af", s->sa_family);
463 
464 	switch (s->sa_family) {
465 	case AF_INET: {
466 		const struct sockaddr_in *s4 = (const struct sockaddr_in *)s;
467 
468 		nvlist_add_number(nvl, "port", s4->sin_port);
469 		nvlist_add_binary(nvl, "address", &s4->sin_addr,
470 		    sizeof(s4->sin_addr));
471 		break;
472 	}
473 	case AF_INET6: {
474 		const struct sockaddr_in6 *s6 = (const struct sockaddr_in6 *)s;
475 
476 		nvlist_add_number(nvl, "port", s6->sin6_port);
477 		nvlist_add_binary(nvl, "address", &s6->sin6_addr,
478 		    sizeof(s6->sin6_addr));
479 		nvlist_add_number(nvl, "scopeid", s6->sin6_scope_id);
480 		break;
481 	}
482 	default:
483 		nvlist_destroy(nvl);
484 		return (EINVAL);
485 	}
486 
487 	nvlist_move_nvlist(parent, name, nvl);
488 
489 	return (0);
490 }
491 
492 static void
ovpn_notify_del_peer(struct ovpn_softc * sc,struct ovpn_kpeer * peer)493 ovpn_notify_del_peer(struct ovpn_softc *sc, struct ovpn_kpeer *peer)
494 {
495 	struct ovpn_notification *n;
496 
497 	OVPN_WASSERT(sc);
498 
499 	n = malloc(sizeof(*n), M_OVPN, M_NOWAIT);
500 	if (n == NULL)
501 		return;
502 
503 	n->peerid = peer->peerid;
504 	n->type = OVPN_NOTIF_DEL_PEER;
505 	n->del_reason = peer->del_reason;
506 
507 	n->counters.pkt_in = counter_u64_fetch(OVPN_PEER_COUNTER(peer, pkt_in));
508 	n->counters.pkt_out = counter_u64_fetch(OVPN_PEER_COUNTER(peer, pkt_out));
509 	n->counters.bytes_in = counter_u64_fetch(OVPN_PEER_COUNTER(peer, bytes_in));
510 	n->counters.bytes_out = counter_u64_fetch(OVPN_PEER_COUNTER(peer, bytes_out));
511 
512 	if (buf_ring_enqueue(sc->notifring, n) != 0) {
513 		free(n, M_OVPN);
514 	} else if (sc->so != NULL) {
515 		/* Wake up userspace */
516 		sc->so->so_error = EAGAIN;
517 		sorwakeup(sc->so);
518 		sowwakeup(sc->so);
519 	}
520 }
521 
522 static void
ovpn_notify_key_rotation(struct ovpn_softc * sc,struct ovpn_kpeer * peer)523 ovpn_notify_key_rotation(struct ovpn_softc *sc, struct ovpn_kpeer *peer)
524 {
525 	struct ovpn_notification *n;
526 
527 	n = malloc(sizeof(*n), M_OVPN, M_NOWAIT | M_ZERO);
528 	if (n == NULL)
529 		return;
530 
531 	n->peerid = peer->peerid;
532 	n->type = OVPN_NOTIF_ROTATE_KEY;
533 
534 	if (buf_ring_enqueue(sc->notifring, n) != 0) {
535 		free(n, M_OVPN);
536 	} else if (sc->so != NULL) {
537 		/* Wake up userspace */
538 		sc->so->so_error = EAGAIN;
539 		sorwakeup(sc->so);
540 		sowwakeup(sc->so);
541 	}
542 }
543 
544 static int
ovpn_notify_float(struct ovpn_softc * sc,uint32_t peerid,const struct sockaddr_storage * remote)545 ovpn_notify_float(struct ovpn_softc *sc, uint32_t peerid,
546     const struct sockaddr_storage *remote)
547 {
548 	struct ovpn_notification *n;
549 
550 	n = malloc(sizeof(*n), M_OVPN, M_NOWAIT | M_ZERO);
551 	if (n == NULL)
552 		return (ENOMEM);
553 
554 	n->peerid = peerid;
555 	n->type = OVPN_NOTIF_FLOAT;
556 	memcpy(&n->address, remote, sizeof(n->address));
557 
558 	if (buf_ring_enqueue(sc->notifring, n) != 0) {
559 		free(n, M_OVPN);
560 		return (ENOMEM);
561 	} else if (sc->so != NULL) {
562 		/* Wake up userspace */
563 		sc->so->so_error = EAGAIN;
564 		sorwakeup(sc->so);
565 		sowwakeup(sc->so);
566 	}
567 
568 	return (0);
569 }
570 
571 static void
ovpn_peer_release_ref(struct ovpn_kpeer * peer,bool locked)572 ovpn_peer_release_ref(struct ovpn_kpeer *peer, bool locked)
573 {
574 	struct ovpn_softc *sc;
575 
576 	CURVNET_ASSERT_SET();
577 
578 	atomic_add_int(&peer->refcount, -1);
579 
580 	if (atomic_load_int(&peer->refcount) > 0)
581 		return;
582 
583 	sc = peer->sc;
584 
585 	if (! locked) {
586 		OVPN_WLOCK(sc);
587 
588 		/* Might have changed before we acquired the lock. */
589 		if (atomic_load_int(&peer->refcount) > 0) {
590 			OVPN_WUNLOCK(sc);
591 			return;
592 		}
593 	}
594 
595 	OVPN_ASSERT(sc);
596 
597 	/* The peer should have been removed from the list already. */
598 	MPASS(ovpn_find_peer(sc, peer->peerid) == NULL);
599 
600 	ovpn_notify_del_peer(sc, peer);
601 
602 	for (int i = 0; i < 2; i++) {
603 		ovpn_free_kkey_dir(peer->keys[i].encrypt);
604 		ovpn_free_kkey_dir(peer->keys[i].decrypt);
605 	}
606 
607 	callout_stop(&peer->ping_send);
608 	callout_stop(&peer->ping_rcv);
609 	uma_zfree_pcpu(pcpu_zone_4, peer->last_active);
610 	free(peer, M_OVPN);
611 
612 	if (! locked)
613 		OVPN_WUNLOCK(sc);
614 }
615 
616 static int
ovpn_new_peer(struct ifnet * ifp,const nvlist_t * nvl)617 ovpn_new_peer(struct ifnet *ifp, const nvlist_t *nvl)
618 {
619 #ifdef INET6
620 	struct epoch_tracker et;
621 #endif
622 	struct sockaddr_storage local, remote;
623 	struct ovpn_kpeer *peer = NULL;
624 	struct file *fp = NULL;
625 	struct ovpn_softc *sc = ifp->if_softc;
626 	struct thread *td = curthread;
627 	struct socket *so = NULL;
628 	int fd;
629 	uint32_t peerid;
630 	int ret = 0;
631 	bool setcb = false;
632 
633 	if (nvl == NULL)
634 		return (EINVAL);
635 
636 	if (! nvlist_exists_number(nvl, "peerid"))
637 		return (EINVAL);
638 
639 	if (! nvlist_exists_number(nvl, "fd"))
640 		return (EINVAL);
641 
642 	if (! nvlist_exists_nvlist(nvl, "remote"))
643 		return (EINVAL);
644 
645 	peerid = nvlist_get_number(nvl, "peerid");
646 
647 	ret = ovpn_nvlist_to_sockaddr(nvlist_get_nvlist(nvl, "remote"),
648 	    &remote);
649 	if (ret != 0)
650 		return (ret);
651 
652 	fd = nvlist_get_number(nvl, "fd");
653 
654 	/* Look up the userspace process and use the fd to find the socket. */
655 	ret = getsock(td, fd, &cap_connect_rights, &fp);
656 	if (ret != 0)
657 		return (ret);
658 
659 	so = fp->f_data;
660 
661 	peer = malloc(sizeof(*peer), M_OVPN, M_WAITOK | M_ZERO);
662 	peer->peerid = peerid;
663 	peer->sc = sc;
664 	peer->refcount = 1;
665 	peer->last_active = uma_zalloc_pcpu(pcpu_zone_4, M_WAITOK | M_ZERO);
666 	COUNTER_ARRAY_ALLOC(peer->counters, OVPN_PEER_COUNTER_SIZE, M_WAITOK);
667 
668 	if (nvlist_exists_binary(nvl, "vpn_ipv4")) {
669 		size_t len;
670 		const void *addr = nvlist_get_binary(nvl, "vpn_ipv4", &len);
671 		if (len != sizeof(peer->vpn4)) {
672 			ret = EINVAL;
673 			goto error;
674 		}
675 		memcpy(&peer->vpn4, addr, len);
676 	}
677 
678 	if (nvlist_exists_binary(nvl, "vpn_ipv6")) {
679 		size_t len;
680 		const void *addr = nvlist_get_binary(nvl, "vpn_ipv6", &len);
681 		if (len != sizeof(peer->vpn6)) {
682 			ret = EINVAL;
683 			goto error;
684 		}
685 		memcpy(&peer->vpn6, addr, len);
686 	}
687 
688 	callout_init_rm(&peer->ping_send, &sc->lock, CALLOUT_SHAREDLOCK);
689 	callout_init_rm(&peer->ping_rcv, &sc->lock, 0);
690 
691 	memset(&local, 0, sizeof(local));
692 	local.ss_len = sizeof(local);
693 	ret = sosockaddr(so, (struct sockaddr *)&local);
694 	if (ret != 0)
695 		goto error;
696 	if (nvlist_exists_nvlist(nvl, "local")) {
697 		struct sockaddr_storage local1;
698 
699 		ret = ovpn_nvlist_to_sockaddr(nvlist_get_nvlist(nvl, "local"),
700 		    &local1);
701 		if (ret != 0)
702 			goto error;
703 
704 		/*
705 		 * openvpn doesn't provide a port here when in multihome mode,
706 		 * just steal the one the socket is bound to.
707 		 */
708 		if (ovpn_get_port(&local1) == 0)
709 			ovpn_set_port(&local1, ovpn_get_port(&local));
710 		memcpy(&local, &local1, sizeof(local1));
711 	}
712 	if (ovpn_get_port(&local) == 0) {
713 		ret = EINVAL;
714 		goto error;
715 	}
716 	if (local.ss_family != remote.ss_family) {
717 		ret = EINVAL;
718 		goto error;
719 	}
720 
721 	memcpy(&peer->local, &local, sizeof(local));
722 	memcpy(&peer->remote, &remote, sizeof(remote));
723 
724 #ifdef INET6
725 	if (peer->local.ss_family == AF_INET6 &&
726 	    IN6_IS_ADDR_V4MAPPED(&TO_IN6(&peer->remote)->sin6_addr)) {
727 		/* V4 mapped address, so treat this as v4, not v6. */
728 		in6_sin6_2_sin_in_sock((struct sockaddr *)&peer->local);
729 		in6_sin6_2_sin_in_sock((struct sockaddr *)&peer->remote);
730 	}
731 
732 	if (peer->local.ss_family == AF_INET6 &&
733 	    IN6_IS_ADDR_UNSPECIFIED(&TO_IN6(&peer->local)->sin6_addr)) {
734 		NET_EPOCH_ENTER(et);
735 		ret = in6_selectsrc_addr(curthread->td_proc->p_fibnum,
736 		    &TO_IN6(&peer->remote)->sin6_addr,
737 		    TO_IN6(&peer->remote)->sin6_scope_id, NULL,
738 		    &TO_IN6(&peer->local)->sin6_addr, NULL);
739 		NET_EPOCH_EXIT(et);
740 		if (ret != 0) {
741 			goto error;
742 		}
743 	}
744 #endif
745 	OVPN_WLOCK(sc);
746 
747 	/* Disallow peer id re-use. */
748 	if (ovpn_find_peer(sc, peerid) != NULL) {
749 		ret = EEXIST;
750 		goto error_locked;
751 	}
752 
753 	/* Make sure this is really a UDP socket. */
754 	if (so->so_type != SOCK_DGRAM || so->so_proto->pr_type != SOCK_DGRAM) {
755 		ret = EPROTOTYPE;
756 		goto error_locked;
757 	}
758 
759 	/* Must be the same socket as for other peers on this interface. */
760 	if (sc->so != NULL && so != sc->so) {
761 		if (! RB_EMPTY(&sc->peers)) {
762 			ret = EBUSY;
763 			goto error_locked;
764 		}
765 
766 		/*
767 		 * If we have no peers we can safely release the socket and accept
768 		 * a new one.
769 		 */
770 		ret = udp_set_kernel_tunneling(sc->so, NULL, NULL, NULL);
771 		MPASS(ret == 0);
772 		sorele(sc->so);
773 		sc->so = NULL;
774 	}
775 
776 	if (sc->so == NULL) {
777 		sc->so = so;
778 		/*
779 		 * Maintain one extra ref so the socket doesn't go away until
780 		 * we're destroying the ifp.
781 		 */
782 		soref(sc->so);
783 		setcb = true;
784 	}
785 
786 	/* Insert the peer into the list. */
787 	RB_INSERT(ovpn_kpeers, &sc->peers, peer);
788 	sc->peercount++;
789 
790 	OVPN_WUNLOCK(sc);
791 
792 	if (setcb) {
793 		ret = udp_set_kernel_tunneling(sc->so, ovpn_udp_input, NULL, sc);
794 		MPASS(ret == 0);
795 	}
796 
797 	goto done;
798 
799 error_locked:
800 	OVPN_WUNLOCK(sc);
801 error:
802 	COUNTER_ARRAY_FREE(peer->counters, OVPN_PEER_COUNTER_SIZE);
803 	uma_zfree_pcpu(pcpu_zone_4, peer->last_active);
804 	free(peer, M_OVPN);
805 done:
806 	if (fp != NULL)
807 		fdrop(fp, td);
808 
809 	return (ret);
810 }
811 
812 static int
_ovpn_del_peer(struct ovpn_softc * sc,struct ovpn_kpeer * peer)813 _ovpn_del_peer(struct ovpn_softc *sc, struct ovpn_kpeer *peer)
814 {
815 	struct ovpn_kpeer *tmp __diagused;
816 
817 	OVPN_WASSERT(sc);
818 	CURVNET_ASSERT_SET();
819 
820 	MPASS(RB_FIND(ovpn_kpeers, &sc->peers, peer) == peer);
821 
822 	tmp = RB_REMOVE(ovpn_kpeers, &sc->peers, peer);
823 	MPASS(tmp != NULL);
824 
825 	sc->peercount--;
826 
827 	ovpn_peer_release_ref(peer, true);
828 
829 	return (0);
830 }
831 
832 static int
ovpn_del_peer(struct ifnet * ifp,nvlist_t * nvl)833 ovpn_del_peer(struct ifnet *ifp, nvlist_t *nvl)
834 {
835 	struct ovpn_softc *sc = ifp->if_softc;
836 	struct ovpn_kpeer *peer;
837 	uint32_t peerid;
838 	int ret;
839 
840 	OVPN_WASSERT(sc);
841 
842 	if (nvl == NULL)
843 		return (EINVAL);
844 
845 	if (! nvlist_exists_number(nvl, "peerid"))
846 		return (EINVAL);
847 
848 	peerid = nvlist_get_number(nvl, "peerid");
849 
850 	peer = ovpn_find_peer(sc, peerid);
851 	if (peer == NULL)
852 		return (ENOENT);
853 
854 	peer->del_reason = OVPN_DEL_REASON_REQUESTED;
855 	ret = _ovpn_del_peer(sc, peer);
856 
857 	return (ret);
858 }
859 
860 static int
ovpn_create_kkey_dir(struct ovpn_kkey_dir ** kdirp,const nvlist_t * nvl)861 ovpn_create_kkey_dir(struct ovpn_kkey_dir **kdirp,
862     const nvlist_t *nvl)
863 {
864 	struct crypto_session_params csp;
865 	struct ovpn_kkey_dir *kdir;
866 	const char *ciphername;
867 	enum ovpn_key_cipher cipher;
868 	const void *key, *iv;
869 	size_t keylen = 0, ivlen = 0;
870 	int error;
871 
872 	if (! nvlist_exists_string(nvl, "cipher"))
873 		return (EINVAL);
874 	ciphername = nvlist_get_string(nvl, "cipher");
875 
876 	if (strcmp(ciphername, "none") == 0)
877 		cipher = OVPN_CIPHER_ALG_NONE;
878 	else if (strcmp(ciphername, "AES-256-GCM") == 0 ||
879 	    strcmp(ciphername, "AES-192-GCM") == 0 ||
880 	    strcmp(ciphername, "AES-128-GCM") == 0)
881 		cipher = OVPN_CIPHER_ALG_AES_GCM;
882 	else if (strcmp(ciphername, "CHACHA20-POLY1305") == 0)
883 		cipher = OVPN_CIPHER_ALG_CHACHA20_POLY1305;
884 	else
885 		return (EINVAL);
886 
887 	if (cipher != OVPN_CIPHER_ALG_NONE) {
888 		if (! nvlist_exists_binary(nvl, "key"))
889 			return (EINVAL);
890 		key = nvlist_get_binary(nvl, "key", &keylen);
891 		if (keylen > sizeof(kdir->key))
892 			return (E2BIG);
893 
894 		if (! nvlist_exists_binary(nvl, "iv"))
895 			return (EINVAL);
896 		iv = nvlist_get_binary(nvl, "iv", &ivlen);
897 		if (ivlen != 8)
898 			return (E2BIG);
899 	}
900 
901 	kdir = malloc(sizeof(struct ovpn_kkey_dir), M_OVPN,
902 	    M_WAITOK | M_ZERO);
903 
904 	kdir->cipher = cipher;
905 	kdir->keylen = keylen;
906 	kdir->tx_seq = 1;
907 	if (keylen != 0)
908 		memcpy(kdir->key, key, keylen);
909 	kdir->noncelen = ivlen;
910 	if (ivlen != 0)
911 		memcpy(kdir->nonce, iv, ivlen);
912 
913 	if (kdir->cipher != OVPN_CIPHER_ALG_NONE) {
914 		/* Crypto init */
915 		bzero(&csp, sizeof(csp));
916 		csp.csp_mode = CSP_MODE_AEAD;
917 
918 		if (kdir->cipher == OVPN_CIPHER_ALG_CHACHA20_POLY1305)
919 			csp.csp_cipher_alg = CRYPTO_CHACHA20_POLY1305;
920 		else
921 			csp.csp_cipher_alg = CRYPTO_AES_NIST_GCM_16;
922 
923 		csp.csp_flags |= CSP_F_SEPARATE_AAD;
924 
925 		csp.csp_cipher_klen = kdir->keylen;
926 		csp.csp_cipher_key = kdir->key;
927 		csp.csp_ivlen = 96 / 8;
928 
929 		error = crypto_newsession(&kdir->cryptoid, &csp,
930 		    CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE);
931 		if (error) {
932 			free(kdir, M_OVPN);
933 			return (error);
934 		}
935 	}
936 
937 	mtx_init(&kdir->replay_mtx, "if_ovpn rx replay", NULL, MTX_DEF);
938 	*kdirp = kdir;
939 
940 	return (0);
941 }
942 
943 static void
ovpn_free_kkey_dir(struct ovpn_kkey_dir * kdir)944 ovpn_free_kkey_dir(struct ovpn_kkey_dir *kdir)
945 {
946 	if (kdir == NULL)
947 		return;
948 
949 	mtx_destroy(&kdir->replay_mtx);
950 
951 	crypto_freesession(kdir->cryptoid);
952 	free(kdir, M_OVPN);
953 }
954 
955 static int
ovpn_set_key(struct ifnet * ifp,const nvlist_t * nvl)956 ovpn_set_key(struct ifnet *ifp, const nvlist_t *nvl)
957 {
958 	struct ovpn_softc *sc = ifp->if_softc;
959 	struct ovpn_kkey_dir *enc, *dec;
960 	struct ovpn_kpeer *peer;
961 	int slot, keyid, peerid;
962 	int error;
963 
964 	if (nvl == NULL)
965 		return (EINVAL);
966 
967 	if (! nvlist_exists_number(nvl, "slot"))
968 		return (EINVAL);
969 	slot = nvlist_get_number(nvl, "slot");
970 
971 	if (! nvlist_exists_number(nvl, "keyid"))
972 		return (EINVAL);
973 	keyid = nvlist_get_number(nvl, "keyid");
974 
975 	if (! nvlist_exists_number(nvl, "peerid"))
976 		return (EINVAL);
977 	peerid = nvlist_get_number(nvl, "peerid");
978 
979 	if (slot != OVPN_KEY_SLOT_PRIMARY &&
980 	    slot != OVPN_KEY_SLOT_SECONDARY)
981 		return (EINVAL);
982 
983 	if (! nvlist_exists_nvlist(nvl, "encrypt") ||
984 	    ! nvlist_exists_nvlist(nvl, "decrypt"))
985 		return (EINVAL);
986 
987 	error = ovpn_create_kkey_dir(&enc, nvlist_get_nvlist(nvl, "encrypt"));
988 	if (error)
989 		return (error);
990 
991 	error = ovpn_create_kkey_dir(&dec, nvlist_get_nvlist(nvl, "decrypt"));
992 	if (error) {
993 		ovpn_free_kkey_dir(enc);
994 		return (error);
995 	}
996 
997 	OVPN_WLOCK(sc);
998 
999 	peer = ovpn_find_peer(sc, peerid);
1000 	if (peer == NULL) {
1001 		ovpn_free_kkey_dir(dec);
1002 		ovpn_free_kkey_dir(enc);
1003 		OVPN_WUNLOCK(sc);
1004 		return (ENOENT);
1005 	}
1006 
1007 	ovpn_free_kkey_dir(peer->keys[slot].encrypt);
1008 	ovpn_free_kkey_dir(peer->keys[slot].decrypt);
1009 
1010 	peer->keys[slot].encrypt = enc;
1011 	peer->keys[slot].decrypt = dec;
1012 
1013 	peer->keys[slot].keyid = keyid;
1014 	peer->keys[slot].peerid = peerid;
1015 
1016 	OVPN_WUNLOCK(sc);
1017 
1018 	return (0);
1019 }
1020 
1021 static int
ovpn_check_key(struct ovpn_softc * sc,struct ovpn_kpeer * peer,enum ovpn_key_slot slot)1022 ovpn_check_key(struct ovpn_softc *sc, struct ovpn_kpeer *peer, enum ovpn_key_slot slot)
1023 {
1024 	OVPN_ASSERT(sc);
1025 
1026 	if (peer->keys[slot].encrypt == NULL)
1027 		return (ENOLINK);
1028 
1029 	if (peer->keys[slot].decrypt == NULL)
1030 		return (ENOLINK);
1031 
1032 	return (0);
1033 }
1034 
1035 static int
ovpn_start(struct ifnet * ifp)1036 ovpn_start(struct ifnet *ifp)
1037 {
1038 	struct ovpn_softc *sc = ifp->if_softc;
1039 
1040 	OVPN_WLOCK(sc);
1041 
1042 	ifp->if_flags |= IFF_UP;
1043 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
1044 	if_link_state_change(ifp, LINK_STATE_UP);
1045 
1046 	OVPN_WUNLOCK(sc);
1047 
1048 	return (0);
1049 }
1050 
1051 static int
ovpn_swap_keys(struct ifnet * ifp,nvlist_t * nvl)1052 ovpn_swap_keys(struct ifnet *ifp, nvlist_t *nvl)
1053 {
1054 	struct ovpn_softc *sc = ifp->if_softc;
1055 	struct ovpn_kpeer *peer;
1056 	struct ovpn_kkey tmpkey;
1057 	int error;
1058 
1059 	if (nvl == NULL)
1060 		return (EINVAL);
1061 
1062 	if (! nvlist_exists_number(nvl, "peerid"))
1063 		return (EINVAL);
1064 
1065 	OVPN_WLOCK(sc);
1066 
1067 	peer = ovpn_find_peer(sc, nvlist_get_number(nvl, "peerid"));
1068 	if (peer == NULL) {
1069 		OVPN_WUNLOCK(sc);
1070 		return (ENOENT);
1071 	}
1072 
1073 	/* Check that we have a second key to swap to. */
1074 	error = ovpn_check_key(sc, peer, OVPN_KEY_SLOT_SECONDARY);
1075 	if (error) {
1076 		OVPN_WUNLOCK(sc);
1077 		return (error);
1078 	}
1079 
1080 	tmpkey = peer->keys[0];
1081 	peer->keys[0] = peer->keys[1];
1082 	peer->keys[1] = tmpkey;
1083 
1084 	OVPN_WUNLOCK(sc);
1085 
1086 	return (0);
1087 }
1088 
1089 static int
ovpn_del_key(struct ifnet * ifp,const nvlist_t * nvl)1090 ovpn_del_key(struct ifnet *ifp, const nvlist_t *nvl)
1091 {
1092 	enum ovpn_key_slot slot;
1093 	struct ovpn_kpeer *peer;
1094 	struct ovpn_softc *sc = ifp->if_softc;
1095 
1096 	if (nvl == NULL)
1097 		return (EINVAL);
1098 
1099 	if (! nvlist_exists_number(nvl, "peerid"))
1100 		return (EINVAL);
1101 
1102 	if (! nvlist_exists_number(nvl, "slot"))
1103 		return (EINVAL);
1104 	slot = nvlist_get_number(nvl, "slot");
1105 
1106 	if (slot != OVPN_KEY_SLOT_PRIMARY &&
1107 	    slot != OVPN_KEY_SLOT_SECONDARY)
1108 		return (EINVAL);
1109 
1110 	OVPN_WLOCK(sc);
1111 
1112 	peer = ovpn_find_peer(sc, nvlist_get_number(nvl, "peerid"));
1113 	if (peer == NULL) {
1114 		OVPN_WUNLOCK(sc);
1115 		return (ENOENT);
1116 	}
1117 
1118 	ovpn_free_kkey_dir(peer->keys[slot].encrypt);
1119 	ovpn_free_kkey_dir(peer->keys[slot].decrypt);
1120 
1121 	peer->keys[slot].encrypt = NULL;
1122 	peer->keys[slot].decrypt = NULL;
1123 
1124 	peer->keys[slot].keyid = 0;
1125 	peer->keys[slot].peerid = 0;
1126 
1127 	OVPN_WUNLOCK(sc);
1128 
1129 	return (0);
1130 }
1131 
1132 static void
ovpn_send_ping(void * arg)1133 ovpn_send_ping(void *arg)
1134 {
1135 	static const uint8_t ping_str[] = {
1136 		0x2a, 0x18, 0x7b, 0xf3, 0x64, 0x1e, 0xb4, 0xcb,
1137 		0x07, 0xed, 0x2d, 0x0a, 0x98, 0x1f, 0xc7, 0x48
1138 	};
1139 
1140 	struct epoch_tracker et;
1141 	struct ovpn_kpeer *peer = arg;
1142 	struct ovpn_softc *sc = peer->sc;
1143 	struct mbuf *m;
1144 
1145 	OVPN_RASSERT(sc);
1146 
1147 	/* Ensure we repeat! */
1148 	callout_reset(&peer->ping_send, peer->keepalive.interval * hz,
1149 	    ovpn_send_ping, peer);
1150 
1151 	m = m_get2(sizeof(ping_str), M_NOWAIT, MT_DATA, M_PKTHDR);
1152 	if (m == NULL)
1153 		return;
1154 
1155 	m_copyback(m, 0, sizeof(ping_str), ping_str);
1156 	m->m_len = m->m_pkthdr.len = sizeof(ping_str);
1157 
1158 	CURVNET_SET(sc->ifp->if_vnet);
1159 	NET_EPOCH_ENTER(et);
1160 	(void)ovpn_transmit_to_peer(sc->ifp, m, peer, NULL);
1161 	NET_EPOCH_EXIT(et);
1162 	CURVNET_RESTORE();
1163 }
1164 
1165 static void
ovpn_timeout(void * arg)1166 ovpn_timeout(void *arg)
1167 {
1168 	struct ovpn_kpeer *peer = arg;
1169 	struct ovpn_softc *sc = peer->sc;
1170 	uint32_t last, _last_active;
1171 	int ret __diagused;
1172 	int cpu;
1173 
1174 	OVPN_WASSERT(sc);
1175 
1176 	last = 0;
1177 	CPU_FOREACH(cpu) {
1178 		_last_active = *zpcpu_get_cpu(peer->last_active, cpu);
1179 		if (_last_active > last)
1180 			last = _last_active;
1181 	}
1182 
1183 	if (last + peer->keepalive.timeout > time_uptime) {
1184 		callout_reset(&peer->ping_rcv,
1185 		    (peer->keepalive.timeout - (time_uptime - last)) * hz,
1186 		    ovpn_timeout, peer);
1187 		return;
1188 	}
1189 
1190 	CURVNET_SET(sc->ifp->if_vnet);
1191 	peer->del_reason = OVPN_DEL_REASON_TIMEOUT;
1192 	ret = _ovpn_del_peer(sc, peer);
1193 	MPASS(ret == 0);
1194 	CURVNET_RESTORE();
1195 }
1196 
1197 static int
ovpn_set_peer(struct ifnet * ifp,const nvlist_t * nvl)1198 ovpn_set_peer(struct ifnet *ifp, const nvlist_t *nvl)
1199 {
1200 	struct ovpn_softc *sc = ifp->if_softc;
1201 	struct ovpn_kpeer *peer;
1202 
1203 	if (nvl == NULL)
1204 		return (EINVAL);
1205 
1206 	if (! nvlist_exists_number(nvl, "interval") ||
1207 	    ! nvlist_exists_number(nvl, "timeout") ||
1208 	    ! nvlist_exists_number(nvl, "peerid"))
1209 		return (EINVAL);
1210 
1211 	OVPN_WLOCK(sc);
1212 
1213 	peer = ovpn_find_peer(sc, nvlist_get_number(nvl, "peerid"));
1214 	if (peer == NULL) {
1215 		OVPN_WUNLOCK(sc);
1216 		return (ENOENT);
1217 	}
1218 
1219 	peer->keepalive.interval = nvlist_get_number(nvl, "interval");
1220 	peer->keepalive.timeout = nvlist_get_number(nvl, "timeout");
1221 
1222 	if (peer->keepalive.interval > 0)
1223 		callout_reset(&peer->ping_send, peer->keepalive.interval * hz,
1224 		    ovpn_send_ping, peer);
1225 	if (peer->keepalive.timeout > 0)
1226 		callout_reset(&peer->ping_rcv, peer->keepalive.timeout * hz,
1227 		    ovpn_timeout, peer);
1228 
1229 	OVPN_WUNLOCK(sc);
1230 
1231 	return (0);
1232 }
1233 
1234 static int
ovpn_set_ifmode(struct ifnet * ifp,const nvlist_t * nvl)1235 ovpn_set_ifmode(struct ifnet *ifp, const nvlist_t *nvl)
1236 {
1237 	struct ovpn_softc *sc = ifp->if_softc;
1238 	int ifmode;
1239 
1240 	if (nvl == NULL)
1241 		return (EINVAL);
1242 
1243 	if (! nvlist_exists_number(nvl, "ifmode") )
1244 		return (EINVAL);
1245 
1246 	ifmode = nvlist_get_number(nvl, "ifmode");
1247 
1248 	OVPN_WLOCK(sc);
1249 
1250 	/* deny this if UP */
1251 	if (ifp->if_flags & IFF_UP) {
1252 		OVPN_WUNLOCK(sc);
1253 		return (EBUSY);
1254 	}
1255 
1256 	switch (ifmode & ~IFF_MULTICAST) {
1257 	case IFF_POINTOPOINT:
1258 	case IFF_BROADCAST:
1259 		ifp->if_flags &=
1260 		    ~(IFF_BROADCAST|IFF_POINTOPOINT|IFF_MULTICAST);
1261 		ifp->if_flags |= ifmode;
1262 		break;
1263 	default:
1264 		OVPN_WUNLOCK(sc);
1265 		return (EINVAL);
1266 	}
1267 
1268 	OVPN_WUNLOCK(sc);
1269 
1270 	return (0);
1271 }
1272 
1273 static int
ovpn_ioctl_set(struct ifnet * ifp,struct ifdrv * ifd)1274 ovpn_ioctl_set(struct ifnet *ifp, struct ifdrv *ifd)
1275 {
1276 	struct ovpn_softc *sc = ifp->if_softc;
1277 	uint8_t *buf = NULL;
1278 	nvlist_t *nvl = NULL;
1279 	int ret;
1280 
1281 	if (ifd->ifd_len != 0) {
1282 		if (ifd->ifd_len > OVPN_MAX_REQUEST_SIZE)
1283 			return (E2BIG);
1284 
1285 		buf = malloc(ifd->ifd_len, M_OVPN, M_WAITOK);
1286 
1287 		ret = copyin(ifd->ifd_data, buf, ifd->ifd_len);
1288 		if (ret != 0) {
1289 			free(buf, M_OVPN);
1290 			return (ret);
1291 		}
1292 
1293 		nvl = nvlist_unpack(buf, ifd->ifd_len, 0);
1294 		free(buf, M_OVPN);
1295 		if (nvl == NULL) {
1296 			return (EINVAL);
1297 		}
1298 	}
1299 
1300 	switch (ifd->ifd_cmd) {
1301 	case OVPN_NEW_PEER:
1302 		ret = ovpn_new_peer(ifp, nvl);
1303 		break;
1304 	case OVPN_DEL_PEER:
1305 		OVPN_WLOCK(sc);
1306 		ret = ovpn_del_peer(ifp, nvl);
1307 		OVPN_WUNLOCK(sc);
1308 		break;
1309 	case OVPN_NEW_KEY:
1310 		ret = ovpn_set_key(ifp, nvl);
1311 		break;
1312 	case OVPN_START_VPN:
1313 		ret = ovpn_start(ifp);
1314 		break;
1315 	case OVPN_SWAP_KEYS:
1316 		ret = ovpn_swap_keys(ifp, nvl);
1317 		break;
1318 	case OVPN_DEL_KEY:
1319 		ret = ovpn_del_key(ifp, nvl);
1320 		break;
1321 	case OVPN_SET_PEER:
1322 		ret = ovpn_set_peer(ifp, nvl);
1323 		break;
1324 	case OVPN_SET_IFMODE:
1325 		ret = ovpn_set_ifmode(ifp, nvl);
1326 		break;
1327 	default:
1328 		ret = ENOTSUP;
1329 	}
1330 
1331 	nvlist_destroy(nvl);
1332 	return (ret);
1333 }
1334 
1335 static int
ovpn_add_counters(nvlist_t * parent,const char * name,counter_u64_t in,counter_u64_t out)1336 ovpn_add_counters(nvlist_t *parent, const char *name, counter_u64_t in,
1337     counter_u64_t out)
1338 {
1339 	nvlist_t *nvl;
1340 
1341 	nvl = nvlist_create(0);
1342 	if (nvl == NULL)
1343 		return (ENOMEM);
1344 
1345 	nvlist_add_number(nvl, "in", counter_u64_fetch(in));
1346 	nvlist_add_number(nvl, "out", counter_u64_fetch(out));
1347 
1348 	nvlist_add_nvlist(parent, name, nvl);
1349 
1350 	nvlist_destroy(nvl);
1351 
1352 	return (0);
1353 }
1354 
1355 static int
ovpn_get_stats(struct ovpn_softc * sc,nvlist_t ** onvl)1356 ovpn_get_stats(struct ovpn_softc *sc, nvlist_t **onvl)
1357 {
1358 	nvlist_t *nvl;
1359 	int ret;
1360 
1361 	nvl = nvlist_create(0);
1362 	if (nvl == NULL)
1363 		return (ENOMEM);
1364 
1365 #define OVPN_COUNTER_OUT(name, in, out) \
1366 	do { \
1367 		ret = ovpn_add_counters(nvl, name, OVPN_COUNTER(sc, in), \
1368 		    OVPN_COUNTER(sc, out)); \
1369 		if (ret != 0) \
1370 			goto error; \
1371 	} while(0)
1372 
1373 	OVPN_COUNTER_OUT("lost_ctrl", lost_ctrl_pkts_in, lost_ctrl_pkts_out);
1374 	OVPN_COUNTER_OUT("lost_data", lost_data_pkts_in, lost_data_pkts_out);
1375 	OVPN_COUNTER_OUT("nomem_data", nomem_data_pkts_in,
1376 	    nomem_data_pkts_out);
1377 	OVPN_COUNTER_OUT("data", received_data_pkts, sent_data_pkts);
1378 	OVPN_COUNTER_OUT("ctrl", received_ctrl_pkts, sent_ctrl_pkts);
1379 	OVPN_COUNTER_OUT("tunnel", tunnel_bytes_received,
1380 	    tunnel_bytes_received);
1381 	OVPN_COUNTER_OUT("transport", transport_bytes_received,
1382 	    transport_bytes_received);
1383 #undef OVPN_COUNTER_OUT
1384 
1385 	*onvl = nvl;
1386 
1387 	return (0);
1388 
1389 error:
1390 	nvlist_destroy(nvl);
1391 	return (ret);
1392 }
1393 
1394 static int
ovpn_get_peer_stats(struct ovpn_softc * sc,nvlist_t ** nvl)1395 ovpn_get_peer_stats(struct ovpn_softc *sc, nvlist_t **nvl)
1396 {
1397 	struct ovpn_kpeer *peer;
1398 	nvlist_t *nvpeer = NULL;
1399 	int ret;
1400 
1401 	OVPN_RLOCK_TRACKER;
1402 
1403 	*nvl = nvlist_create(0);
1404 	if (*nvl == NULL)
1405 		return (ENOMEM);
1406 
1407 #define OVPN_PEER_COUNTER_OUT(name, in, out) \
1408 	do { \
1409 		ret = ovpn_add_counters(nvpeer, name, \
1410 		    OVPN_PEER_COUNTER(peer, in), OVPN_PEER_COUNTER(peer, out)); \
1411 		if (ret != 0) \
1412 			goto error; \
1413 	} while(0)
1414 
1415 	OVPN_RLOCK(sc);
1416 	RB_FOREACH(peer, ovpn_kpeers, &sc->peers) {
1417 		nvpeer = nvlist_create(0);
1418 		if (nvpeer == NULL) {
1419 			OVPN_RUNLOCK(sc);
1420 			nvlist_destroy(*nvl);
1421 			*nvl = NULL;
1422 			return (ENOMEM);
1423 		}
1424 
1425 		nvlist_add_number(nvpeer, "peerid", peer->peerid);
1426 
1427 		OVPN_PEER_COUNTER_OUT("packets", pkt_in, pkt_out);
1428 		OVPN_PEER_COUNTER_OUT("bytes", bytes_in, bytes_out);
1429 
1430 		nvlist_append_nvlist_array(*nvl, "peers", nvpeer);
1431 		nvlist_destroy(nvpeer);
1432 	}
1433 #undef OVPN_PEER_COUNTER_OUT
1434 	OVPN_RUNLOCK(sc);
1435 
1436 	return (0);
1437 
1438 error:
1439 	nvlist_destroy(nvpeer);
1440 	nvlist_destroy(*nvl);
1441 	*nvl = NULL;
1442 	return (ret);
1443 }
1444 
1445 static int
ovpn_poll_pkt(struct ovpn_softc * sc,nvlist_t ** onvl)1446 ovpn_poll_pkt(struct ovpn_softc *sc, nvlist_t **onvl)
1447 {
1448 	nvlist_t *nvl;
1449 
1450 	nvl = nvlist_create(0);
1451 	if (nvl == NULL)
1452 		return (ENOMEM);
1453 
1454 	nvlist_add_number(nvl, "pending", buf_ring_count(sc->notifring));
1455 
1456 	*onvl = nvl;
1457 
1458 	return (0);
1459 }
1460 
1461 static void
ovpn_notif_add_counters(nvlist_t * parent,struct ovpn_notification * n)1462 ovpn_notif_add_counters(nvlist_t *parent, struct ovpn_notification *n)
1463 {
1464 	nvlist_t *nvl;
1465 
1466 	nvl = nvlist_create(0);
1467 	if (nvl == NULL)
1468 		return;
1469 
1470 	nvlist_add_number(nvl, "in", n->counters.pkt_in);
1471 	nvlist_add_number(nvl, "out", n->counters.pkt_out);
1472 
1473 	nvlist_add_nvlist(parent, "packets", nvl);
1474 	nvlist_destroy(nvl);
1475 
1476 	nvl = nvlist_create(0);
1477 	if (nvl == NULL)
1478 		return;
1479 
1480 	nvlist_add_number(nvl, "in", n->counters.bytes_in);
1481 	nvlist_add_number(nvl, "out", n->counters.bytes_out);
1482 
1483 	nvlist_add_nvlist(parent, "bytes", nvl);
1484 	nvlist_destroy(nvl);
1485 }
1486 
1487 static int
opvn_get_pkt(struct ovpn_softc * sc,nvlist_t ** onvl)1488 opvn_get_pkt(struct ovpn_softc *sc, nvlist_t **onvl)
1489 {
1490 	struct ovpn_notification *n;
1491 	nvlist_t *nvl;
1492 
1493 	/* Check if we have notifications pending. */
1494 	n = buf_ring_dequeue_mc(sc->notifring);
1495 	if (n == NULL)
1496 		return (ENOENT);
1497 
1498 	nvl = nvlist_create(0);
1499 	if (nvl == NULL) {
1500 		free(n, M_OVPN);
1501 		return (ENOMEM);
1502 	}
1503 	nvlist_add_number(nvl, "peerid", n->peerid);
1504 	nvlist_add_number(nvl, "notification", n->type);
1505 	switch (n->type) {
1506 	case OVPN_NOTIF_DEL_PEER: {
1507 		nvlist_add_number(nvl, "del_reason", n->del_reason);
1508 
1509 		/* No error handling, because we want to send the notification
1510 		 * even if we can't attach the counters. */
1511 		ovpn_notif_add_counters(nvl, n);
1512 		break;
1513 	}
1514 	case OVPN_NOTIF_FLOAT: {
1515 		int ret;
1516 
1517 		ret = ovpn_add_sockaddr(nvl, "address",
1518 		    (struct sockaddr *)&n->address);
1519 
1520 		if (ret) {
1521 			/*
1522 			 * Try to re-enqueue the notification. Maybe we'll
1523 			 * have better luck next time. No error handling,
1524 			 * because if we fail to re-enqueue there's nothing we can do.
1525 			 */
1526 			(void)ovpn_notify_float(sc, n->peerid, &n->address);
1527 			nvlist_destroy(nvl);
1528 			free(n, M_OVPN);
1529 			return (ret);
1530 		}
1531 		break;
1532 	}
1533 	default:
1534 		break;
1535 	}
1536 	free(n, M_OVPN);
1537 
1538 	*onvl = nvl;
1539 
1540 	return (0);
1541 }
1542 
1543 static int
ovpn_ioctl_get(struct ifnet * ifp,struct ifdrv * ifd)1544 ovpn_ioctl_get(struct ifnet *ifp, struct ifdrv *ifd)
1545 {
1546 	struct ovpn_softc *sc = ifp->if_softc;
1547 	nvlist_t *nvl = NULL;
1548 	int error;
1549 
1550 	switch (ifd->ifd_cmd) {
1551 	case OVPN_GET_STATS:
1552 		error = ovpn_get_stats(sc, &nvl);
1553 		break;
1554 	case OVPN_GET_PEER_STATS:
1555 		error = ovpn_get_peer_stats(sc, &nvl);
1556 		break;
1557 	case OVPN_POLL_PKT:
1558 		error = ovpn_poll_pkt(sc, &nvl);
1559 		break;
1560 	case OVPN_GET_PKT:
1561 		error = opvn_get_pkt(sc, &nvl);
1562 		break;
1563 	default:
1564 		error = ENOTSUP;
1565 		break;
1566 	}
1567 
1568 	if (error == 0) {
1569 		void *packed = NULL;
1570 		size_t len;
1571 
1572 		MPASS(nvl != NULL);
1573 
1574 		packed = nvlist_pack(nvl, &len);
1575 		if (! packed) {
1576 			nvlist_destroy(nvl);
1577 			return (ENOMEM);
1578 		}
1579 
1580 		if (len > ifd->ifd_len) {
1581 			free(packed, M_NVLIST);
1582 			nvlist_destroy(nvl);
1583 			return (ENOSPC);
1584 		}
1585 
1586 		error = copyout(packed, ifd->ifd_data, len);
1587 		ifd->ifd_len = len;
1588 
1589 		free(packed, M_NVLIST);
1590 		nvlist_destroy(nvl);
1591 	}
1592 
1593 	return (error);
1594 }
1595 
1596 static int
ovpn_ioctl(struct ifnet * ifp,u_long cmd,caddr_t data)1597 ovpn_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1598 {
1599 	struct ifdrv *ifd;
1600 	int error;
1601 
1602 	CURVNET_ASSERT_SET();
1603 
1604 	switch (cmd) {
1605 	case SIOCSDRVSPEC:
1606 	case SIOCGDRVSPEC:
1607 		error = priv_check(curthread, PRIV_NET_OVPN);
1608 		if (error)
1609 			return (error);
1610 		break;
1611 	}
1612 
1613 	switch (cmd) {
1614 	case SIOCSDRVSPEC:
1615 		ifd = (struct ifdrv *)data;
1616 		error = ovpn_ioctl_set(ifp, ifd);
1617 		break;
1618 	case SIOCGDRVSPEC:
1619 		ifd = (struct ifdrv *)data;
1620 		error = ovpn_ioctl_get(ifp, ifd);
1621 		break;
1622 	case SIOCSIFMTU: {
1623 		struct ifreq *ifr = (struct ifreq *)data;
1624 		if (ifr->ifr_mtu < OVPN_MTU_MIN || ifr->ifr_mtu > OVPN_MTU_MAX)
1625 			return (EINVAL);
1626 
1627 		ifp->if_mtu = ifr->ifr_mtu;
1628 		return (0);
1629 	}
1630 	case SIOCSIFADDR:
1631 	case SIOCADDMULTI:
1632 	case SIOCDELMULTI:
1633 	case SIOCGIFMTU:
1634 	case SIOCSIFFLAGS:
1635 		return (0);
1636 	default:
1637 		error = EINVAL;
1638 	}
1639 
1640 	return (error);
1641 }
1642 
1643 static int
ovpn_encrypt_tx_cb(struct cryptop * crp)1644 ovpn_encrypt_tx_cb(struct cryptop *crp)
1645 {
1646 	struct epoch_tracker et;
1647 	struct ovpn_kpeer *peer = crp->crp_opaque;
1648 	struct ovpn_softc *sc = peer->sc;
1649 	struct mbuf *m = crp->crp_buf.cb_mbuf;
1650 	int tunnel_len;
1651 	int ret;
1652 
1653 	CURVNET_SET(sc->ifp->if_vnet);
1654 	NET_EPOCH_ENTER(et);
1655 
1656 	if (crp->crp_etype != 0) {
1657 		crypto_freereq(crp);
1658 		ovpn_peer_release_ref(peer, false);
1659 		NET_EPOCH_EXIT(et);
1660 		CURVNET_RESTORE();
1661 		OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1);
1662 		m_freem(m);
1663 		return (0);
1664 	}
1665 
1666 	MPASS(crp->crp_buf.cb_type == CRYPTO_BUF_MBUF);
1667 
1668 	tunnel_len = m->m_pkthdr.len - sizeof(struct ovpn_wire_header);
1669 	ret = ovpn_encap(sc, peer->peerid, m);
1670 	if (ret == 0) {
1671 		OVPN_COUNTER_ADD(sc, sent_data_pkts, 1);
1672 		OVPN_COUNTER_ADD(sc, tunnel_bytes_sent, tunnel_len);
1673 	}
1674 
1675 	crypto_freereq(crp);
1676 	ovpn_peer_release_ref(peer, false);
1677 
1678 	NET_EPOCH_EXIT(et);
1679 	CURVNET_RESTORE();
1680 
1681 	return (0);
1682 }
1683 
1684 static void
ovpn_finish_rx(struct ovpn_softc * sc,struct mbuf * m,struct ovpn_kpeer * peer,struct ovpn_kkey * key,uint32_t seq,struct rm_priotracker * _ovpn_lock_trackerp)1685 ovpn_finish_rx(struct ovpn_softc *sc, struct mbuf *m,
1686     struct ovpn_kpeer *peer, struct ovpn_kkey *key, uint32_t seq,
1687     struct rm_priotracker *_ovpn_lock_trackerp)
1688 {
1689 	uint32_t af;
1690 	struct m_tag *mtag;
1691 
1692 	OVPN_RASSERT(sc);
1693 	NET_EPOCH_ASSERT();
1694 
1695 	/* Replay protection. */
1696 	if (V_replay_protection && ! ovpn_check_replay(key->decrypt, seq)) {
1697 		OVPN_RUNLOCK(sc);
1698 		OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1);
1699 		m_freem(m);
1700 		return;
1701 	}
1702 
1703 	critical_enter();
1704 	*zpcpu_get(peer->last_active) = time_uptime;
1705 	critical_exit();
1706 
1707 	OVPN_RUNLOCK(sc);
1708 
1709 	/* Check if the peer changed to a new source address. */
1710 	mtag = m_tag_find(m, PACKET_TAG_OVPN, NULL);
1711 	if (mtag != NULL) {
1712 		struct ovpn_mtag *ot = (struct ovpn_mtag *)(mtag + 1);
1713 
1714 		OVPN_WLOCK(sc);
1715 
1716 		/*
1717 		 * Check the address against the peer's remote again, because we may race
1718 		 * against ourselves (i.e. we may have tagged multiple packets to indicate we
1719 		 * floated).
1720 		 */
1721 		if (ovpn_sockaddr_compare((struct sockaddr *)&ot->addr,
1722 		    (struct sockaddr *)&peer->remote)) {
1723 			OVPN_WUNLOCK(sc);
1724 			goto skip_float;
1725 		}
1726 
1727 		/* And notify userspace. */
1728 		if (ovpn_notify_float(sc, peer->peerid, &ot->addr) == 0) {
1729 			/*
1730 			 * Update the 'remote' for this peer, but only if
1731 			 * we've actually enqueued the notification.
1732 			 * Otherwise we can try again later.
1733 			 */
1734 			memcpy(&peer->remote, &ot->addr, sizeof(peer->remote));
1735 		}
1736 
1737 		OVPN_WUNLOCK(sc);
1738 	}
1739 
1740 skip_float:
1741 	OVPN_COUNTER_ADD(sc, received_data_pkts, 1);
1742 	OVPN_COUNTER_ADD(sc, tunnel_bytes_received, m->m_pkthdr.len);
1743 	OVPN_PEER_COUNTER_ADD(peer, pkt_in, 1);
1744 	OVPN_PEER_COUNTER_ADD(peer, bytes_in, m->m_pkthdr.len);
1745 
1746 	/* Receive the packet on our interface. */
1747 	m->m_pkthdr.rcvif = sc->ifp;
1748 
1749 	/* Clear checksum flags in case the real hardware set them. */
1750 	m->m_pkthdr.csum_flags = 0;
1751 
1752 	/* Clear mbuf tags & flags */
1753 	m_tag_delete_nonpersistent(m);
1754 	m_clrprotoflags(m);
1755 
1756 	/* Ensure we can read the first byte. */
1757 	m = m_pullup(m, 1);
1758 	if (m == NULL) {
1759 		OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1);
1760 		return;
1761 	}
1762 
1763 	/*
1764 	 * Check for address family, and disregard any control packets (e.g.
1765 	 * keepalive).
1766 	 */
1767 	af = ovpn_get_af(m);
1768 	if (af != 0) {
1769 		BPF_MTAP2(sc->ifp, &af, sizeof(af), m);
1770 		if (V_async_netisr_queue)
1771 			netisr_queue(af == AF_INET ? NETISR_IP : NETISR_IPV6, m);
1772 		else
1773 			netisr_dispatch(af == AF_INET ? NETISR_IP : NETISR_IPV6, m);
1774 	} else {
1775 		OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1);
1776 		m_freem(m);
1777 	}
1778 }
1779 
1780 static struct ovpn_kkey *
ovpn_find_key(struct ovpn_softc * sc,struct ovpn_kpeer * peer,const struct ovpn_wire_header * ohdr)1781 ovpn_find_key(struct ovpn_softc *sc, struct ovpn_kpeer *peer,
1782     const struct ovpn_wire_header *ohdr)
1783 {
1784 	struct ovpn_kkey *key = NULL;
1785 	uint8_t keyid;
1786 
1787 	OVPN_RASSERT(sc);
1788 
1789 	keyid = (ntohl(ohdr->opcode) >> 24) & 0x07;
1790 
1791 	if (peer->keys[0].keyid == keyid)
1792 		key = &peer->keys[0];
1793 	else if (peer->keys[1].keyid == keyid)
1794 		key = &peer->keys[1];
1795 
1796 	return (key);
1797 }
1798 
1799 static int
ovpn_decrypt_rx_cb(struct cryptop * crp)1800 ovpn_decrypt_rx_cb(struct cryptop *crp)
1801 {
1802 	struct epoch_tracker et;
1803 	struct ovpn_softc *sc = crp->crp_opaque;
1804 	struct mbuf *m = crp->crp_buf.cb_mbuf;
1805 	struct ovpn_kkey *key;
1806 	struct ovpn_kpeer *peer;
1807 	struct ovpn_wire_header *ohdr;
1808 	uint32_t peerid;
1809 
1810 	OVPN_RLOCK_TRACKER;
1811 
1812 	OVPN_RLOCK(sc);
1813 
1814 	MPASS(crp->crp_buf.cb_type == CRYPTO_BUF_MBUF);
1815 
1816 	if (crp->crp_etype != 0) {
1817 		crypto_freereq(crp);
1818 		atomic_add_int(&sc->refcount, -1);
1819 		OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1);
1820 		OVPN_RUNLOCK(sc);
1821 		m_freem(m);
1822 		return (0);
1823 	}
1824 
1825 	CURVNET_SET(sc->ifp->if_vnet);
1826 
1827 	ohdr = mtodo(m, sizeof(struct udphdr));
1828 
1829 	peerid = ntohl(ohdr->opcode) & 0x00ffffff;
1830 	peer = ovpn_find_peer(sc, peerid);
1831 	if (peer == NULL) {
1832 		/* No such peer. Drop packet. */
1833 		crypto_freereq(crp);
1834 		atomic_add_int(&sc->refcount, -1);
1835 		OVPN_RUNLOCK(sc);
1836 		OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1);
1837 		m_freem(m);
1838 		CURVNET_RESTORE();
1839 		return (0);
1840 	}
1841 
1842 	key = ovpn_find_key(sc, peer, ohdr);
1843 	if (key == NULL) {
1844 		crypto_freereq(crp);
1845 		atomic_add_int(&sc->refcount, -1);
1846 		/*
1847 		 * Has this key been removed between us starting the decrypt
1848 		 * and finishing it?
1849 		 */
1850 		OVPN_RUNLOCK(sc);
1851 		OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1);
1852 		m_freem(m);
1853 		CURVNET_RESTORE();
1854 		return (0);
1855 	}
1856 
1857 	/* Now remove the outer headers */
1858 	m_adj_decap(m, sizeof(struct udphdr) +
1859 	    sizeof(struct ovpn_wire_header));
1860 
1861 	NET_EPOCH_ENTER(et);
1862 	ovpn_finish_rx(sc, m, peer, key, ntohl(ohdr->seq), _ovpn_lock_trackerp);
1863 	NET_EPOCH_EXIT(et);
1864 	OVPN_UNLOCK_ASSERT(sc);
1865 
1866 	CURVNET_RESTORE();
1867 
1868 	crypto_freereq(crp);
1869 	atomic_add_int(&sc->refcount, -1);
1870 
1871 	return (0);
1872 }
1873 
1874 static int
ovpn_get_af(struct mbuf * m)1875 ovpn_get_af(struct mbuf *m)
1876 {
1877 	struct ip *ip;
1878 	struct ip6_hdr *ip6;
1879 
1880 	/*
1881 	 * We should pullup, but we're only interested in the first byte, so
1882 	 * that'll always be contiguous.
1883 	 */
1884 	ip = mtod(m, struct ip *);
1885 	if (ip->ip_v == IPVERSION)
1886 		return (AF_INET);
1887 
1888 	ip6 = mtod(m, struct ip6_hdr *);
1889 	if ((ip6->ip6_vfc & IPV6_VERSION_MASK) == IPV6_VERSION)
1890 		return (AF_INET6);
1891 
1892 	return (0);
1893 }
1894 
1895 #ifdef INET
1896 static struct ovpn_kpeer *
ovpn_find_peer_by_ip(struct ovpn_softc * sc,const struct in_addr addr)1897 ovpn_find_peer_by_ip(struct ovpn_softc *sc, const struct in_addr addr)
1898 {
1899 	struct ovpn_kpeer *peer = NULL;
1900 
1901 	OVPN_ASSERT(sc);
1902 
1903 	/* TODO: Add a second RB so we can look up by IP. */
1904 	RB_FOREACH(peer, ovpn_kpeers, &sc->peers) {
1905 		if (addr.s_addr == peer->vpn4.s_addr)
1906 			return (peer);
1907 	}
1908 
1909 	return (peer);
1910 }
1911 #endif
1912 
1913 #ifdef INET6
1914 static struct ovpn_kpeer *
ovpn_find_peer_by_ip6(struct ovpn_softc * sc,const struct in6_addr * addr)1915 ovpn_find_peer_by_ip6(struct ovpn_softc *sc, const struct in6_addr *addr)
1916 {
1917 	struct ovpn_kpeer *peer = NULL;
1918 
1919 	OVPN_ASSERT(sc);
1920 
1921 	/* TODO: Add a third RB so we can look up by IPv6 address. */
1922 	RB_FOREACH(peer, ovpn_kpeers, &sc->peers) {
1923 		if (memcmp(addr, &peer->vpn6, sizeof(*addr)) == 0)
1924 			return (peer);
1925 	}
1926 
1927 	return (peer);
1928 }
1929 #endif
1930 
1931 static struct ovpn_kpeer *
ovpn_route_peer(struct ovpn_softc * sc,struct mbuf ** m0,const struct sockaddr * dst)1932 ovpn_route_peer(struct ovpn_softc *sc, struct mbuf **m0,
1933     const struct sockaddr *dst)
1934 {
1935 	struct ovpn_kpeer *peer = NULL;
1936 	int af;
1937 
1938 	NET_EPOCH_ASSERT();
1939 	OVPN_ASSERT(sc);
1940 
1941 	/* Shortcut if we're a client (or are a server and have only one client). */
1942 	if (sc->peercount == 1)
1943 		return (ovpn_find_only_peer(sc));
1944 
1945 	if (dst != NULL)
1946 		af = dst->sa_family;
1947 	else
1948 		af = ovpn_get_af(*m0);
1949 
1950 	switch (af) {
1951 #ifdef INET
1952 	case AF_INET: {
1953 		const struct sockaddr_in *sa = (const struct sockaddr_in *)dst;
1954 		struct nhop_object *nh;
1955 		const struct in_addr *ip_dst;
1956 
1957 		if (sa != NULL) {
1958 			ip_dst = &sa->sin_addr;
1959 		} else {
1960 			struct ip *ip;
1961 
1962 			*m0 = m_pullup(*m0, sizeof(struct ip));
1963 			if (*m0 == NULL)
1964 				return (NULL);
1965 			ip = mtod(*m0, struct ip *);
1966 			ip_dst = &ip->ip_dst;
1967 		}
1968 
1969 		peer = ovpn_find_peer_by_ip(sc, *ip_dst);
1970 		SDT_PROBE2(if_ovpn, tx, route, ip4, ip_dst, peer);
1971 		if (peer == NULL) {
1972 			nh = fib4_lookup(M_GETFIB(*m0), *ip_dst, 0,
1973 			    NHR_NONE, 0);
1974 			if (nh && (nh->nh_flags & NHF_GATEWAY)) {
1975 				peer = ovpn_find_peer_by_ip(sc,
1976 				    nh->gw4_sa.sin_addr);
1977 				SDT_PROBE2(if_ovpn, tx, route, ip4,
1978 				    &nh->gw4_sa.sin_addr, peer);
1979 			}
1980 		}
1981 		break;
1982 	}
1983 #endif
1984 #ifdef INET6
1985 	case AF_INET6: {
1986 		const struct sockaddr_in6 *sa6 =
1987 		    (const struct sockaddr_in6 *)dst;
1988 		struct nhop_object *nh;
1989 		const struct in6_addr *ip6_dst;
1990 
1991 		if (sa6 != NULL) {
1992 			ip6_dst = &sa6->sin6_addr;
1993 		} else {
1994 			struct ip6_hdr *ip6;
1995 
1996 			*m0 = m_pullup(*m0, sizeof(struct ip6_hdr));
1997 			if (*m0 == NULL)
1998 				return (NULL);
1999 			ip6 = mtod(*m0, struct ip6_hdr *);
2000 			ip6_dst = &ip6->ip6_dst;
2001 		}
2002 
2003 		peer = ovpn_find_peer_by_ip6(sc, ip6_dst);
2004 		SDT_PROBE2(if_ovpn, tx, route, ip6, ip6_dst, peer);
2005 		if (peer == NULL) {
2006 			nh = fib6_lookup(M_GETFIB(*m0), ip6_dst, 0,
2007 			    NHR_NONE, 0);
2008 			if (nh && (nh->nh_flags & NHF_GATEWAY)) {
2009 				peer = ovpn_find_peer_by_ip6(sc,
2010 				    &nh->gw6_sa.sin6_addr);
2011 				SDT_PROBE2(if_ovpn, tx, route, ip6,
2012 				    &nh->gw6_sa.sin6_addr, peer);
2013 			}
2014 		}
2015 		break;
2016 	}
2017 #endif
2018 	}
2019 
2020 	return (peer);
2021 }
2022 
2023 static int
ovpn_transmit(struct ifnet * ifp,struct mbuf * m)2024 ovpn_transmit(struct ifnet *ifp, struct mbuf *m)
2025 {
2026 	return (ifp->if_output(ifp, m, NULL, NULL));
2027 }
2028 
2029 static int
ovpn_transmit_to_peer(struct ifnet * ifp,struct mbuf * m,struct ovpn_kpeer * peer,struct rm_priotracker * _ovpn_lock_trackerp)2030 ovpn_transmit_to_peer(struct ifnet *ifp, struct mbuf *m,
2031     struct ovpn_kpeer *peer, struct rm_priotracker *_ovpn_lock_trackerp)
2032 {
2033 	struct ovpn_wire_header *ohdr;
2034 	struct ovpn_kkey *key;
2035 	struct ovpn_softc *sc;
2036 	struct cryptop *crp;
2037 	uint32_t af, seq;
2038 	uint64_t seq64;
2039 	size_t len, ovpn_hdr_len;
2040 	int tunnel_len;
2041 	int ret;
2042 
2043 	sc = ifp->if_softc;
2044 
2045 	OVPN_RASSERT(sc);
2046 
2047 	tunnel_len = m->m_pkthdr.len;
2048 
2049 	key = &peer->keys[OVPN_KEY_SLOT_PRIMARY];
2050 	if (key->encrypt == NULL) {
2051 		if (_ovpn_lock_trackerp != NULL)
2052 			OVPN_RUNLOCK(sc);
2053 		m_freem(m);
2054 		return (ENOLINK);
2055 	}
2056 
2057 	af = ovpn_get_af(m);
2058 	/* Don't capture control packets. */
2059 	if (af != 0)
2060 		BPF_MTAP2(ifp, &af, sizeof(af), m);
2061 
2062 	if (__predict_false(if_tunnel_check_nesting(ifp, m, MTAG_OVPN_LOOP, 3))) {
2063 		if (_ovpn_lock_trackerp != NULL)
2064 			OVPN_RUNLOCK(sc);
2065 		OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1);
2066 		m_freem(m);
2067 		return (ELOOP);
2068 	}
2069 
2070 	len = m->m_pkthdr.len;
2071 	MPASS(len <= ifp->if_mtu);
2072 
2073 	ovpn_hdr_len = sizeof(struct ovpn_wire_header);
2074 	if (key->encrypt->cipher == OVPN_CIPHER_ALG_NONE)
2075 		ovpn_hdr_len -= 16; /* No auth tag. */
2076 
2077 	M_PREPEND(m, ovpn_hdr_len, M_NOWAIT);
2078 	if (m == NULL) {
2079 		if (_ovpn_lock_trackerp != NULL)
2080 			OVPN_RUNLOCK(sc);
2081 		OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1);
2082 		return (ENOBUFS);
2083 	}
2084 	ohdr = mtod(m, struct ovpn_wire_header *);
2085 	ohdr->opcode = (OVPN_OP_DATA_V2 << OVPN_OP_SHIFT) | key->keyid;
2086 	ohdr->opcode <<= 24;
2087 	ohdr->opcode |= key->peerid;
2088 	ohdr->opcode = htonl(ohdr->opcode);
2089 
2090 	seq64 = atomic_fetchadd_64(&peer->keys[OVPN_KEY_SLOT_PRIMARY].encrypt->tx_seq, 1);
2091 	if (seq64 == OVPN_SEQ_ROTATE) {
2092 		ovpn_notify_key_rotation(sc, peer);
2093 	} else if (seq64 > UINT32_MAX) {
2094 		/* We've wrapped, give up on this packet. */
2095 		if (_ovpn_lock_trackerp != NULL)
2096 			OVPN_RUNLOCK(sc);
2097 		OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1);
2098 
2099 		/* Let's avoid (very unlikely, but still) wraparounds of the
2100 		 * 64-bit counter taking us back to 0. */
2101 		atomic_store_64(&peer->keys[OVPN_KEY_SLOT_PRIMARY].encrypt->tx_seq,
2102 		    UINT32_MAX);
2103 
2104 		return (ENOBUFS);
2105 	}
2106 
2107 	seq = htonl(seq64 & UINT32_MAX);
2108 	ohdr->seq = seq;
2109 
2110 	OVPN_PEER_COUNTER_ADD(peer, pkt_out, 1);
2111 	OVPN_PEER_COUNTER_ADD(peer, bytes_out, len);
2112 
2113 	if (key->encrypt->cipher == OVPN_CIPHER_ALG_NONE) {
2114 		ret = ovpn_encap(sc, peer->peerid, m);
2115 		if (_ovpn_lock_trackerp != NULL)
2116 			OVPN_RUNLOCK(sc);
2117 		if (ret == 0) {
2118 			OVPN_COUNTER_ADD(sc, sent_data_pkts, 1);
2119 			OVPN_COUNTER_ADD(sc, tunnel_bytes_sent, tunnel_len);
2120 		}
2121 		return (ret);
2122 	}
2123 
2124 	crp = crypto_getreq(key->encrypt->cryptoid, M_NOWAIT);
2125 	if (crp == NULL) {
2126 		if (_ovpn_lock_trackerp != NULL)
2127 			OVPN_RUNLOCK(sc);
2128 		OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1);
2129 		m_freem(m);
2130 		return (ENOBUFS);
2131 	}
2132 
2133 	/* Encryption covers only the payload, not the header. */
2134 	crp->crp_payload_start = sizeof(*ohdr);
2135 	crp->crp_payload_length = len;
2136 	crp->crp_op = CRYPTO_OP_ENCRYPT;
2137 
2138 	/*
2139 	 * AAD data covers the ovpn_wire_header minus the auth
2140 	 * tag.
2141 	 */
2142 	crp->crp_aad_length = sizeof(*ohdr) - sizeof(ohdr->auth_tag);
2143 	crp->crp_aad = ohdr;
2144 	crp->crp_aad_start = 0;
2145 	crp->crp_op |= CRYPTO_OP_COMPUTE_DIGEST;
2146 	crp->crp_digest_start = offsetof(struct ovpn_wire_header, auth_tag);
2147 
2148 	crp->crp_flags |= CRYPTO_F_IV_SEPARATE;
2149 	memcpy(crp->crp_iv, &seq, sizeof(seq));
2150 	memcpy(crp->crp_iv + sizeof(seq), key->encrypt->nonce,
2151 	    key->encrypt->noncelen);
2152 
2153 	crypto_use_mbuf(crp, m);
2154 	crp->crp_flags |= CRYPTO_F_CBIFSYNC;
2155 	crp->crp_callback = ovpn_encrypt_tx_cb;
2156 	crp->crp_opaque = peer;
2157 
2158 	atomic_add_int(&peer->refcount, 1);
2159 	if (_ovpn_lock_trackerp != NULL)
2160 		OVPN_RUNLOCK(sc);
2161 	if (V_async_crypto)
2162 		ret = crypto_dispatch_async(crp, CRYPTO_ASYNC_ORDERED);
2163 	else
2164 		ret = crypto_dispatch(crp);
2165 	if (ret) {
2166 		OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1);
2167 	}
2168 
2169 	return (ret);
2170 }
2171 
2172 /*
2173  * Note: Expects to hold the read lock on entry, and will release it itself.
2174  */
2175 static int
ovpn_encap(struct ovpn_softc * sc,uint32_t peerid,struct mbuf * m)2176 ovpn_encap(struct ovpn_softc *sc, uint32_t peerid, struct mbuf *m)
2177 {
2178 	struct udphdr *udp;
2179 	struct ovpn_kpeer *peer;
2180 	int len;
2181 
2182 	OVPN_RLOCK_TRACKER;
2183 
2184 	OVPN_RLOCK(sc);
2185 	NET_EPOCH_ASSERT();
2186 
2187 	peer = ovpn_find_peer(sc, peerid);
2188 	if (peer == NULL || sc->ifp->if_link_state != LINK_STATE_UP) {
2189 		OVPN_RUNLOCK(sc);
2190 		OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1);
2191 		m_freem(m);
2192 		return (ENETDOWN);
2193 	}
2194 
2195 	len = m->m_pkthdr.len;
2196 
2197 	M_PREPEND(m, sizeof(struct udphdr), M_NOWAIT);
2198 	if (m == NULL) {
2199 		OVPN_RUNLOCK(sc);
2200 		OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1);
2201 		m_freem(m);
2202 		return (ENOBUFS);
2203 	}
2204 	udp = mtod(m, struct udphdr *);
2205 
2206 	MPASS(peer->local.ss_family == peer->remote.ss_family);
2207 
2208 	udp->uh_sport = ovpn_get_port(&peer->local);
2209 	udp->uh_dport = ovpn_get_port(&peer->remote);
2210 	udp->uh_ulen = htons(sizeof(struct udphdr) + len);
2211 
2212 	switch (peer->remote.ss_family) {
2213 #ifdef INET
2214 	case AF_INET: {
2215 		struct sockaddr_in *in_local = TO_IN(&peer->local);
2216 		struct sockaddr_in *in_remote = TO_IN(&peer->remote);
2217 		struct ip *ip;
2218 
2219 		/*
2220 		 * This requires knowing the source IP, which we don't. Happily
2221 		 * we're allowed to keep this at 0, and the checksum won't do
2222 		 * anything the crypto won't already do.
2223 		 */
2224 		udp->uh_sum = 0;
2225 
2226 		/* Set the checksum flags so we recalculate checksums. */
2227 		m->m_pkthdr.csum_flags |= CSUM_IP;
2228 		m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
2229 
2230 		M_PREPEND(m, sizeof(struct ip), M_NOWAIT);
2231 		if (m == NULL) {
2232 			OVPN_RUNLOCK(sc);
2233 			OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1);
2234 			return (ENOBUFS);
2235 		}
2236 		ip = mtod(m, struct ip *);
2237 
2238 		ip->ip_tos = 0;
2239 		ip->ip_len = htons(sizeof(struct ip) + sizeof(struct udphdr) +
2240 		   len);
2241 		ip->ip_off = 0;
2242 		ip->ip_ttl = V_ip_defttl;
2243 		ip->ip_p = IPPROTO_UDP;
2244 		ip->ip_sum = 0;
2245 		if (in_local->sin_port != 0)
2246 			ip->ip_src = in_local->sin_addr;
2247 		else
2248 			ip->ip_src.s_addr = INADDR_ANY;
2249 		ip->ip_dst = in_remote->sin_addr;
2250 
2251 		OVPN_RUNLOCK(sc);
2252 		OVPN_COUNTER_ADD(sc, transport_bytes_sent, m->m_pkthdr.len);
2253 
2254 		return (ip_output(m, NULL, NULL, 0, NULL, NULL));
2255 	}
2256 #endif
2257 #ifdef INET6
2258 	case AF_INET6: {
2259 		struct sockaddr_in6 *in6_local = TO_IN6(&peer->local);
2260 		struct sockaddr_in6 *in6_remote = TO_IN6(&peer->remote);
2261 		struct ip6_hdr *ip6;
2262 
2263 		M_PREPEND(m, sizeof(struct ip6_hdr), M_NOWAIT);
2264 		if (m == NULL) {
2265 			OVPN_RUNLOCK(sc);
2266 			OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1);
2267 			return (ENOBUFS);
2268 		}
2269 		m = m_pullup(m, sizeof(*ip6) + sizeof(*udp));
2270 		if (m == NULL) {
2271 			OVPN_RUNLOCK(sc);
2272 			OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1);
2273 			return (ENOBUFS);
2274 		}
2275 
2276 		ip6 = mtod(m, struct ip6_hdr *);
2277 
2278 		ip6->ip6_vfc = IPV6_VERSION;
2279 		ip6->ip6_flow &= ~IPV6_FLOWINFO_MASK;
2280 		ip6->ip6_plen = htons(sizeof(*ip6) + sizeof(struct udphdr) +
2281 		    len);
2282 		ip6->ip6_nxt = IPPROTO_UDP;
2283 		ip6->ip6_hlim = V_ip6_defhlim;
2284 
2285 		memcpy(&ip6->ip6_src, &in6_local->sin6_addr,
2286 		    sizeof(ip6->ip6_src));
2287 		memcpy(&ip6->ip6_dst, &in6_remote->sin6_addr,
2288 		    sizeof(ip6->ip6_dst));
2289 
2290 		if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src)) {
2291 			/* Local and remote must have the same scope. */
2292 			ip6->ip6_src.__u6_addr.__u6_addr16[1] =
2293 			    htons(in6_remote->sin6_scope_id & 0xffff);
2294 		}
2295 		if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst))
2296 			ip6->ip6_dst.__u6_addr.__u6_addr16[1] =
2297 			    htons(in6_remote->sin6_scope_id & 0xffff);
2298 
2299 		udp = mtodo(m, sizeof(*ip6));
2300 		udp->uh_sum = in6_cksum_pseudo(ip6,
2301 		    m->m_pkthdr.len - sizeof(struct ip6_hdr),
2302 		    IPPROTO_UDP, 0);
2303 
2304 		m->m_pkthdr.csum_flags |= CSUM_UDP_IPV6;
2305 		m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
2306 
2307 		OVPN_RUNLOCK(sc);
2308 		OVPN_COUNTER_ADD(sc, transport_bytes_sent, m->m_pkthdr.len);
2309 
2310 		return (ip6_output(m, NULL, NULL, IPV6_UNSPECSRC, NULL, NULL,
2311 		    NULL));
2312 	}
2313 #endif
2314 	default:
2315 		panic("Unsupported address family %d",
2316 		    peer->remote.ss_family);
2317 	}
2318 }
2319 
2320 static int
ovpn_output(struct ifnet * ifp,struct mbuf * m,const struct sockaddr * dst,struct route * ro)2321 ovpn_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
2322 	struct route *ro)
2323 {
2324 	struct ovpn_softc *sc;
2325 	struct ovpn_kpeer *peer;
2326 
2327 	OVPN_RLOCK_TRACKER;
2328 
2329 	sc = ifp->if_softc;
2330 
2331 	m = m_unshare(m, M_NOWAIT);
2332 	if (m == NULL) {
2333 		OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1);
2334 		return (ENOBUFS);
2335 	}
2336 
2337 	OVPN_RLOCK(sc);
2338 
2339 	SDT_PROBE1(if_ovpn, tx, transmit, start, m);
2340 
2341 	if (__predict_false(ifp->if_link_state != LINK_STATE_UP)) {
2342 		OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1);
2343 		OVPN_RUNLOCK(sc);
2344 		m_freem(m);
2345 		return (ENETDOWN);
2346 	}
2347 
2348 	/**
2349 	 * Only obey 'dst' (i.e. the gateway) if no route is supplied.
2350 	 * That's our indication that we're being called through pf's route-to,
2351 	 * and we should route according to 'dst' instead. We can't do so
2352 	 * consistently, because the usual openvpn configuration sets the first
2353 	 * non-server IP in the subnet as the gateway. If we always use that
2354 	 * one we'd end up routing all traffic to the first client.
2355 	 * tl;dr: 'ro == NULL' tells us pf is doing a route-to, and then but
2356 	 * only then, we should treat 'dst' as the destination. */
2357 	peer = ovpn_route_peer(sc, &m, ro == NULL ? dst : NULL);
2358 	if (peer == NULL) {
2359 		/* No destination. */
2360 		OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1);
2361 		OVPN_RUNLOCK(sc);
2362 		m_freem(m);
2363 		return (ENETDOWN);
2364 	}
2365 
2366 	return (ovpn_transmit_to_peer(ifp, m, peer, _ovpn_lock_trackerp));
2367 }
2368 
2369 static bool
ovpn_check_replay(struct ovpn_kkey_dir * key,uint32_t seq)2370 ovpn_check_replay(struct ovpn_kkey_dir *key, uint32_t seq)
2371 {
2372 	uint32_t d;
2373 
2374 	mtx_lock(&key->replay_mtx);
2375 
2376 	/* Sequence number must be strictly greater than rx_seq */
2377 	if (seq <= key->rx_seq) {
2378 		mtx_unlock(&key->replay_mtx);
2379 		return (false);
2380 	}
2381 
2382 	/* Large jump. The packet authenticated okay, so just accept that. */
2383 	if (seq > (key->rx_seq + (sizeof(key->rx_window) * 8))) {
2384 		key->rx_seq = seq;
2385 		key->rx_window = 0;
2386 		mtx_unlock(&key->replay_mtx);
2387 		return (true);
2388 	}
2389 
2390 	/* Happy case. */
2391 	if ((seq == key->rx_seq + 1) && key->rx_window == 0) {
2392 		key->rx_seq++;
2393 		mtx_unlock(&key->replay_mtx);
2394 		return (true);
2395 	}
2396 
2397 	d = seq - key->rx_seq - 1;
2398 
2399 	if (key->rx_window & ((uint64_t)1 << d)) {
2400 		/* Dupe! */
2401 		mtx_unlock(&key->replay_mtx);
2402 		return (false);
2403 	}
2404 
2405 	key->rx_window |= (uint64_t)1 << d;
2406 
2407 	while (key->rx_window & 1) {
2408 		key->rx_seq++;
2409 		key->rx_window >>= 1;
2410 	}
2411 
2412 	mtx_unlock(&key->replay_mtx);
2413 
2414 	return (true);
2415 }
2416 
2417 static struct ovpn_kpeer *
ovpn_peer_from_mbuf(struct ovpn_softc * sc,struct mbuf * m,int off)2418 ovpn_peer_from_mbuf(struct ovpn_softc *sc, struct mbuf *m, int off)
2419 {
2420 	struct ovpn_wire_header ohdr;
2421 	uint32_t peerid;
2422 	const size_t hdrlen = sizeof(ohdr) - sizeof(ohdr.auth_tag);
2423 
2424 	OVPN_RASSERT(sc);
2425 
2426 	if (m_length(m, NULL) < (off + sizeof(struct udphdr) + hdrlen))
2427 		return (NULL);
2428 
2429 	m_copydata(m, off + sizeof(struct udphdr), hdrlen, (caddr_t)&ohdr);
2430 
2431 	peerid = ntohl(ohdr.opcode) & 0x00ffffff;
2432 
2433 	return (ovpn_find_peer(sc, peerid));
2434 }
2435 
2436 static bool
ovpn_udp_input(struct mbuf * m,int off,struct inpcb * inp,const struct sockaddr * sa,void * ctx)2437 ovpn_udp_input(struct mbuf *m, int off, struct inpcb *inp,
2438     const struct sockaddr *sa, void *ctx)
2439 {
2440 	struct ovpn_softc *sc = ctx;
2441 	struct ovpn_wire_header tmphdr;
2442 	struct ovpn_wire_header *ohdr;
2443 	struct udphdr *uhdr;
2444 	struct ovpn_kkey *key;
2445 	struct cryptop *crp;
2446 	struct ovpn_kpeer *peer;
2447 	size_t ohdrlen;
2448 	int ret;
2449 	uint8_t op;
2450 
2451 	OVPN_RLOCK_TRACKER;
2452 
2453 	M_ASSERTPKTHDR(m);
2454 
2455 	OVPN_COUNTER_ADD(sc, transport_bytes_received, m->m_pkthdr.len - off);
2456 
2457 	ohdrlen = sizeof(*ohdr) - sizeof(ohdr->auth_tag);
2458 
2459 	OVPN_RLOCK(sc);
2460 
2461 	peer = ovpn_peer_from_mbuf(sc, m, off);
2462 	if (peer == NULL) {
2463 		OVPN_RUNLOCK(sc);
2464 		return (false);
2465 	}
2466 
2467 	if (m_length(m, NULL) < (off + sizeof(*uhdr) + ohdrlen)) {
2468 		/* Short packet. */
2469 		OVPN_RUNLOCK(sc);
2470 		return (false);
2471 	}
2472 
2473 	m_copydata(m, off + sizeof(*uhdr), ohdrlen, (caddr_t)&tmphdr);
2474 
2475 	op = ntohl(tmphdr.opcode) >> 24 >> OVPN_OP_SHIFT;
2476 	if (op != OVPN_OP_DATA_V2) {
2477 		/* Control packet? */
2478 		OVPN_RUNLOCK(sc);
2479 		return (false);
2480 	}
2481 
2482 	m = m_unshare(m, M_NOWAIT);
2483 	if (m == NULL) {
2484 		OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1);
2485 		return (true);
2486 	}
2487 
2488 	m = m_pullup(m, off + sizeof(*uhdr) + ohdrlen);
2489 	if (m == NULL) {
2490 		OVPN_RUNLOCK(sc);
2491 		OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1);
2492 		return (true);
2493 	}
2494 
2495 	/*
2496 	 * Simplify things by getting rid of the preceding headers, we don't
2497 	 * care about them.
2498 	 */
2499 	m_adj_decap(m, off);
2500 
2501 	uhdr = mtodo(m, 0);
2502 	ohdr = mtodo(m, sizeof(*uhdr));
2503 
2504 	key = ovpn_find_key(sc, peer, ohdr);
2505 	if (key == NULL || key->decrypt == NULL) {
2506 		OVPN_RUNLOCK(sc);
2507 		OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1);
2508 		m_freem(m);
2509 		return (true);
2510 	}
2511 
2512 	/*
2513 	 * If we got this from a different address than we expected tag the packet.
2514 	 * We'll deal with notifiying userspace later, after we've decrypted and
2515 	 * verified.
2516 	 */
2517 	if (! ovpn_sockaddr_compare((struct sockaddr *)&peer->remote, sa)) {
2518 		struct m_tag *mt;
2519 		struct ovpn_mtag *ot;
2520 
2521 		MPASS(sa->sa_len <= sizeof(ot->addr));
2522 		mt = m_tag_get(PACKET_TAG_OVPN, sizeof(*ot), M_NOWAIT);
2523 		/*
2524 		 * If we fail to allocate here we'll just try again on the next
2525 		 * packet.
2526 		 */
2527 		if (mt != NULL) {
2528 			ot = (struct ovpn_mtag *)(mt + 1);
2529 			memcpy(&ot->addr, sa, sa->sa_len);
2530 
2531 			m_tag_prepend(m, mt);
2532 		}
2533 	}
2534 
2535 	if (key->decrypt->cipher == OVPN_CIPHER_ALG_NONE) {
2536 		/* Now remove the outer headers */
2537 		m_adj_decap(m, sizeof(struct udphdr) + ohdrlen);
2538 
2539 		ohdr = mtodo(m, sizeof(*uhdr));
2540 
2541 		ovpn_finish_rx(sc, m, peer, key, ntohl(ohdr->seq),
2542 		    _ovpn_lock_trackerp);
2543 		OVPN_UNLOCK_ASSERT(sc);
2544 		return (true);
2545 	}
2546 
2547 	ohdrlen += sizeof(ohdr->auth_tag);
2548 
2549 	m = m_pullup(m, sizeof(*uhdr) + ohdrlen);
2550 	if (m == NULL) {
2551 		OVPN_RUNLOCK(sc);
2552 		OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1);
2553 		return (true);
2554 	}
2555 	uhdr = mtodo(m, 0);
2556 	ohdr = mtodo(m, sizeof(*uhdr));
2557 
2558 	/* Decrypt */
2559 	crp = crypto_getreq(key->decrypt->cryptoid, M_NOWAIT);
2560 	if (crp == NULL) {
2561 		OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1);
2562 		OVPN_RUNLOCK(sc);
2563 		m_freem(m);
2564 		return (true);
2565 	}
2566 
2567 	crp->crp_payload_start = sizeof(struct udphdr) + sizeof(*ohdr);
2568 	crp->crp_payload_length = ntohs(uhdr->uh_ulen) -
2569 	    sizeof(*uhdr) - sizeof(*ohdr);
2570 	crp->crp_op = CRYPTO_OP_DECRYPT;
2571 
2572 	/* AAD validation. */
2573 	crp->crp_aad_length = sizeof(*ohdr) - sizeof(ohdr->auth_tag);
2574 	crp->crp_aad = ohdr;
2575 	crp->crp_aad_start = 0;
2576 	crp->crp_op |= CRYPTO_OP_VERIFY_DIGEST;
2577 	crp->crp_digest_start = sizeof(struct udphdr) +
2578 	    offsetof(struct ovpn_wire_header, auth_tag);
2579 
2580 	crp->crp_flags |= CRYPTO_F_IV_SEPARATE;
2581 	memcpy(crp->crp_iv, &ohdr->seq, sizeof(ohdr->seq));
2582 	memcpy(crp->crp_iv + sizeof(ohdr->seq), key->decrypt->nonce,
2583 	    key->decrypt->noncelen);
2584 
2585 	crypto_use_mbuf(crp, m);
2586 	crp->crp_flags |= CRYPTO_F_CBIFSYNC;
2587 	crp->crp_callback = ovpn_decrypt_rx_cb;
2588 	crp->crp_opaque = sc;
2589 
2590 	atomic_add_int(&sc->refcount, 1);
2591 	OVPN_RUNLOCK(sc);
2592 	if (V_async_crypto)
2593 		ret = crypto_dispatch_async(crp, CRYPTO_ASYNC_ORDERED);
2594 	else
2595 		ret = crypto_dispatch(crp);
2596 	if (ret != 0) {
2597 		OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1);
2598 	}
2599 
2600 	return (true);
2601 }
2602 
2603 static void
ovpn_qflush(struct ifnet * ifp __unused)2604 ovpn_qflush(struct ifnet *ifp __unused)
2605 {
2606 
2607 }
2608 
2609 static void
ovpn_flush_rxring(struct ovpn_softc * sc)2610 ovpn_flush_rxring(struct ovpn_softc *sc)
2611 {
2612 	struct ovpn_notification *n;
2613 
2614 	OVPN_WASSERT(sc);
2615 
2616 	while (! buf_ring_empty(sc->notifring)) {
2617 		n = buf_ring_dequeue_sc(sc->notifring);
2618 		free(n, M_OVPN);
2619 	}
2620 }
2621 
2622 #ifdef VIMAGE
2623 static void
ovpn_reassign(struct ifnet * ifp,struct vnet * new_vnet __unused,char * unused __unused)2624 ovpn_reassign(struct ifnet *ifp, struct vnet *new_vnet __unused,
2625     char *unused __unused)
2626 {
2627 	struct ovpn_softc *sc = ifp->if_softc;
2628 	struct ovpn_kpeer *peer, *tmppeer;
2629 	int ret __diagused;
2630 
2631 	OVPN_WLOCK(sc);
2632 
2633 	/* Flush keys & configuration. */
2634 	RB_FOREACH_SAFE(peer, ovpn_kpeers, &sc->peers, tmppeer) {
2635 		peer->del_reason = OVPN_DEL_REASON_REQUESTED;
2636 		ret = _ovpn_del_peer(sc, peer);
2637 		MPASS(ret == 0);
2638 	}
2639 
2640 	ovpn_flush_rxring(sc);
2641 
2642 	OVPN_WUNLOCK(sc);
2643 }
2644 #endif
2645 
2646 static int
ovpn_clone_match(struct if_clone * ifc,const char * name)2647 ovpn_clone_match(struct if_clone *ifc, const char *name)
2648 {
2649 	/*
2650 	 * Allow all names that start with 'ovpn', specifically because pfSense
2651 	 * uses ovpnc1 / ovpns2
2652 	 */
2653 	return (strncmp(ovpnname, name, strlen(ovpnname)) == 0);
2654 }
2655 
2656 static int
ovpn_clone_create(struct if_clone * ifc,char * name,size_t len,struct ifc_data * ifd,struct ifnet ** ifpp)2657 ovpn_clone_create(struct if_clone *ifc, char *name, size_t len,
2658     struct ifc_data *ifd, struct ifnet **ifpp)
2659 {
2660 	struct ovpn_softc *sc;
2661 	struct ifnet *ifp;
2662 	char *dp;
2663 	int error, unit, wildcard;
2664 
2665 	/* Try to see if a special unit was requested. */
2666 	error = ifc_name2unit(name, &unit);
2667 	if (error != 0)
2668 		return (error);
2669 	wildcard = (unit < 0);
2670 
2671 	error = ifc_alloc_unit(ifc, &unit);
2672 	if (error != 0)
2673 		return (error);
2674 
2675 	/*
2676 	 * If no unit had been given, we need to adjust the ifName.
2677 	 */
2678 	for (dp = name; *dp != '\0'; dp++);
2679 	if (wildcard) {
2680 		error = snprintf(dp, len - (dp - name), "%d", unit);
2681 		if (error > len - (dp - name)) {
2682 			/* ifName too long. */
2683 			ifc_free_unit(ifc, unit);
2684 			return (ENOSPC);
2685 		}
2686 		dp += error;
2687 	}
2688 
2689 	/* Make sure it doesn't already exist. */
2690 	if (ifunit(name) != NULL)
2691 		return (EEXIST);
2692 
2693 	sc = malloc(sizeof(struct ovpn_softc), M_OVPN, M_WAITOK | M_ZERO);
2694 	sc->ifp = if_alloc(IFT_ENC);
2695 	rm_init_flags(&sc->lock, "if_ovpn_lock", RM_RECURSE);
2696 	sc->refcount = 0;
2697 
2698 	sc->notifring = buf_ring_alloc(32, M_OVPN, M_WAITOK, NULL);
2699 
2700 	COUNTER_ARRAY_ALLOC(sc->counters, OVPN_COUNTER_SIZE, M_WAITOK);
2701 
2702 	ifp = sc->ifp;
2703 	ifp->if_softc = sc;
2704 	strlcpy(ifp->if_xname, name, IFNAMSIZ);
2705 	ifp->if_dname = ovpngroupname;
2706 	ifp->if_dunit = unit;
2707 
2708 	ifp->if_addrlen = 0;
2709 	ifp->if_mtu = 1428;
2710 	ifp->if_flags = IFF_POINTOPOINT | IFF_MULTICAST;
2711 	ifp->if_ioctl = ovpn_ioctl;
2712 	ifp->if_transmit = ovpn_transmit;
2713 	ifp->if_output = ovpn_output;
2714 	ifp->if_qflush = ovpn_qflush;
2715 #ifdef VIMAGE
2716 	ifp->if_reassign = ovpn_reassign;
2717 #endif
2718 	ifp->if_capabilities |= IFCAP_LINKSTATE;
2719 	ifp->if_capenable |= IFCAP_LINKSTATE;
2720 
2721 	if_attach(ifp);
2722 	bpfattach(ifp, DLT_NULL, sizeof(uint32_t));
2723 	*ifpp = ifp;
2724 
2725 	return (0);
2726 }
2727 
2728 static void
ovpn_clone_destroy_cb(struct epoch_context * ctx)2729 ovpn_clone_destroy_cb(struct epoch_context *ctx)
2730 {
2731 	struct ovpn_softc *sc;
2732 	int ret __diagused;
2733 
2734 	sc = __containerof(ctx, struct ovpn_softc, epoch_ctx);
2735 
2736 	MPASS(sc->peercount == 0);
2737 	MPASS(RB_EMPTY(&sc->peers));
2738 
2739 	if (sc->so != NULL) {
2740 		CURVNET_SET(sc->ifp->if_vnet);
2741 		ret = udp_set_kernel_tunneling(sc->so, NULL, NULL, NULL);
2742 		MPASS(ret == 0);
2743 		sorele(sc->so);
2744 		CURVNET_RESTORE();
2745 	}
2746 
2747 	COUNTER_ARRAY_FREE(sc->counters, OVPN_COUNTER_SIZE);
2748 
2749 	rm_destroy(&sc->lock);
2750 	if_free(sc->ifp);
2751 	free(sc, M_OVPN);
2752 }
2753 
2754 static int
ovpn_clone_destroy(struct if_clone * ifc,struct ifnet * ifp,uint32_t flags)2755 ovpn_clone_destroy(struct if_clone *ifc, struct ifnet *ifp, uint32_t flags)
2756 {
2757 	struct ovpn_softc *sc;
2758 	struct ovpn_kpeer *peer, *tmppeer;
2759 	int unit;
2760 	int ret __diagused;
2761 
2762 	sc = ifp->if_softc;
2763 	unit = ifp->if_dunit;
2764 
2765 	OVPN_WLOCK(sc);
2766 
2767 	if (atomic_load_int(&sc->refcount) > 0) {
2768 		OVPN_WUNLOCK(sc);
2769 		return (EBUSY);
2770 	}
2771 
2772 	RB_FOREACH_SAFE(peer, ovpn_kpeers, &sc->peers, tmppeer) {
2773 		peer->del_reason = OVPN_DEL_REASON_REQUESTED;
2774 		ret = _ovpn_del_peer(sc, peer);
2775 		MPASS(ret == 0);
2776 	}
2777 
2778 	ovpn_flush_rxring(sc);
2779 	buf_ring_free(sc->notifring, M_OVPN);
2780 
2781 	OVPN_WUNLOCK(sc);
2782 
2783 	bpfdetach(ifp);
2784 	if_detach(ifp);
2785 	ifp->if_softc = NULL;
2786 
2787 	NET_EPOCH_CALL(ovpn_clone_destroy_cb, &sc->epoch_ctx);
2788 
2789 	if (unit != IF_DUNIT_NONE)
2790 		ifc_free_unit(ifc, unit);
2791 
2792 	NET_EPOCH_DRAIN_CALLBACKS();
2793 
2794 	return (0);
2795 }
2796 
2797 static void
vnet_ovpn_init(const void * unused __unused)2798 vnet_ovpn_init(const void *unused __unused)
2799 {
2800 	struct if_clone_addreq req = {
2801 		.match_f = ovpn_clone_match,
2802 		.create_f = ovpn_clone_create,
2803 		.destroy_f = ovpn_clone_destroy,
2804 	};
2805 	V_ovpn_cloner = ifc_attach_cloner(ovpngroupname, &req);
2806 }
2807 VNET_SYSINIT(vnet_ovpn_init, SI_SUB_PSEUDO, SI_ORDER_ANY,
2808     vnet_ovpn_init, NULL);
2809 
2810 static int
ovpn_prison_remove(void * obj,void * data __unused)2811 ovpn_prison_remove(void *obj, void *data __unused)
2812 {
2813 #ifdef VIMAGE
2814 	struct prison *pr;
2815 
2816 	pr = obj;
2817 	if (prison_owns_vnet(pr)) {
2818 		CURVNET_SET(pr->pr_vnet);
2819 		if (V_ovpn_cloner != NULL) {
2820 			ifc_detach_cloner(V_ovpn_cloner);
2821 			V_ovpn_cloner = NULL;
2822 		}
2823 		CURVNET_RESTORE();
2824 	}
2825 #endif
2826 	return (0);
2827 }
2828 
2829 static int
ovpnmodevent(module_t mod,int type,void * data)2830 ovpnmodevent(module_t mod, int type, void *data)
2831 {
2832 	static int ovpn_osd_jail_slot;
2833 
2834 	switch (type) {
2835 	case MOD_LOAD: {
2836 		/*
2837 		 * Registration is handled in vnet_ovpn_init(), but cloned
2838 		 * interfaces must be destroyed via PR_METHOD_REMOVE since they
2839 		 * hold a reference to the prison via the UDP socket, which
2840 		 * prevents the prison from being destroyed.
2841 		 */
2842 		osd_method_t methods[PR_MAXMETHOD] = {
2843 			[PR_METHOD_REMOVE] = ovpn_prison_remove,
2844 		};
2845 		ovpn_osd_jail_slot = osd_jail_register(NULL, methods);
2846 		break;
2847 	}
2848 	case MOD_UNLOAD:
2849 		if (ovpn_osd_jail_slot != 0)
2850 			osd_jail_deregister(ovpn_osd_jail_slot);
2851 		CURVNET_SET(vnet0);
2852 		if (V_ovpn_cloner != NULL) {
2853 			ifc_detach_cloner(V_ovpn_cloner);
2854 			V_ovpn_cloner = NULL;
2855 		}
2856 		CURVNET_RESTORE();
2857 		break;
2858 	default:
2859 		return (EOPNOTSUPP);
2860 	}
2861 
2862 	return (0);
2863 }
2864 
2865 static moduledata_t ovpn_mod = {
2866 	"if_ovpn",
2867 	ovpnmodevent,
2868 	0
2869 };
2870 
2871 DECLARE_MODULE(if_ovpn, ovpn_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
2872 MODULE_VERSION(if_ovpn, 1);
2873 MODULE_DEPEND(if_ovpn, crypto, 1, 1, 1);
2874