1 // SPDX-License-Identifier: GPL-2.0 2 /* OpenVPN data channel accelerator 3 * 4 * Copyright (C) 2020-2025 OpenVPN, Inc. 5 * 6 * Author: Antonio Quartulli <antonio@openvpn.net> 7 */ 8 9 #include <stdint.h> 10 #include <stdio.h> 11 #include <inttypes.h> 12 #include <stdbool.h> 13 #include <string.h> 14 #include <errno.h> 15 #include <unistd.h> 16 #include <arpa/inet.h> 17 #include <net/if.h> 18 #include <netinet/in.h> 19 #include <time.h> 20 21 #include <linux/ovpn.h> 22 #include <linux/types.h> 23 #include <linux/netlink.h> 24 25 #include <netlink/socket.h> 26 #include <netlink/netlink.h> 27 #include <netlink/genl/genl.h> 28 #include <netlink/genl/family.h> 29 #include <netlink/genl/ctrl.h> 30 31 #include <mbedtls/base64.h> 32 #include <mbedtls/error.h> 33 34 #include <sys/socket.h> 35 36 #include "kselftest.h" 37 38 /* defines to make checkpatch happy */ 39 #define strscpy strncpy 40 41 /* libnl < 3.5.0 does not set the NLA_F_NESTED on its own, therefore we 42 * have to explicitly do it to prevent the kernel from failing upon 43 * parsing of the message 44 */ 45 #define nla_nest_start(_msg, _type) \ 46 nla_nest_start(_msg, (_type) | NLA_F_NESTED) 47 48 /* libnl < 3.11.0 does not implement nla_get_uint() */ 49 uint64_t ovpn_nla_get_uint(struct nlattr *attr) 50 { 51 if (nla_len(attr) == sizeof(uint32_t)) 52 return nla_get_u32(attr); 53 else 54 return nla_get_u64(attr); 55 } 56 57 typedef int (*ovpn_nl_cb)(struct nl_msg *msg, void *arg); 58 59 enum ovpn_key_direction { 60 KEY_DIR_IN = 0, 61 KEY_DIR_OUT, 62 }; 63 64 #define KEY_LEN (256 / 8) 65 #define NONCE_LEN 8 66 67 #define PEER_ID_UNDEF 0x00FFFFFF 68 #define MAX_PEERS 10 69 70 struct nl_ctx { 71 struct nl_sock *nl_sock; 72 struct nl_msg *nl_msg; 73 struct nl_cb *nl_cb; 74 75 int ovpn_dco_id; 76 }; 77 78 enum ovpn_cmd { 79 CMD_INVALID, 80 CMD_NEW_IFACE, 81 CMD_DEL_IFACE, 82 CMD_LISTEN, 83 CMD_CONNECT, 84 CMD_NEW_PEER, 85 CMD_NEW_MULTI_PEER, 86 CMD_SET_PEER, 87 CMD_DEL_PEER, 88 CMD_GET_PEER, 89 CMD_NEW_KEY, 90 CMD_DEL_KEY, 91 CMD_GET_KEY, 92 CMD_SWAP_KEYS, 93 CMD_LISTEN_MCAST, 94 }; 95 96 struct ovpn_ctx { 97 enum ovpn_cmd cmd; 98 99 __u8 key_enc[KEY_LEN]; 100 __u8 key_dec[KEY_LEN]; 101 __u8 nonce[NONCE_LEN]; 102 103 enum ovpn_cipher_alg cipher; 104 105 sa_family_t sa_family; 106 107 unsigned long peer_id, tx_id; 108 unsigned long lport; 109 110 union { 111 struct sockaddr_in in4; 112 struct sockaddr_in6 in6; 113 } remote; 114 115 union { 116 struct sockaddr_in in4; 117 struct sockaddr_in6 in6; 118 } peer_ip; 119 120 bool peer_ip_set; 121 122 unsigned int ifindex; 123 char ifname[IFNAMSIZ]; 124 enum ovpn_mode mode; 125 bool mode_set; 126 127 int socket; 128 int cli_sockets[MAX_PEERS]; 129 130 __u32 keepalive_interval; 131 __u32 keepalive_timeout; 132 133 enum ovpn_key_direction key_dir; 134 enum ovpn_key_slot key_slot; 135 int key_id; 136 137 uint32_t mark; 138 bool asymm_id; 139 140 const char *peers_file; 141 }; 142 143 static int ovpn_nl_recvmsgs(struct nl_ctx *ctx) 144 { 145 int ret; 146 147 ret = nl_recvmsgs(ctx->nl_sock, ctx->nl_cb); 148 149 switch (ret) { 150 case -NLE_INTR: 151 fprintf(stderr, 152 "netlink received interrupt due to signal - ignoring\n"); 153 break; 154 case -NLE_NOMEM: 155 fprintf(stderr, "netlink out of memory error\n"); 156 break; 157 case -NLE_AGAIN: 158 fprintf(stderr, 159 "netlink reports blocking read - aborting wait\n"); 160 break; 161 default: 162 if (ret) 163 fprintf(stderr, "netlink reports error (%d): %s\n", 164 ret, nl_geterror(-ret)); 165 break; 166 } 167 168 return ret; 169 } 170 171 static struct nl_ctx *nl_ctx_alloc_flags(struct ovpn_ctx *ovpn, int cmd, 172 int flags) 173 { 174 struct nl_ctx *ctx; 175 int err, ret; 176 177 ctx = calloc(1, sizeof(*ctx)); 178 if (!ctx) 179 return NULL; 180 181 ctx->nl_sock = nl_socket_alloc(); 182 if (!ctx->nl_sock) { 183 fprintf(stderr, "cannot allocate netlink socket\n"); 184 goto err_free; 185 } 186 187 nl_socket_set_buffer_size(ctx->nl_sock, 8192, 8192); 188 189 ret = genl_connect(ctx->nl_sock); 190 if (ret) { 191 fprintf(stderr, "cannot connect to generic netlink: %s\n", 192 nl_geterror(ret)); 193 goto err_sock; 194 } 195 196 /* enable Extended ACK for detailed error reporting */ 197 err = 1; 198 setsockopt(nl_socket_get_fd(ctx->nl_sock), SOL_NETLINK, NETLINK_EXT_ACK, 199 &err, sizeof(err)); 200 201 ctx->ovpn_dco_id = genl_ctrl_resolve(ctx->nl_sock, OVPN_FAMILY_NAME); 202 if (ctx->ovpn_dco_id < 0) { 203 fprintf(stderr, "cannot find ovpn_dco netlink component: %d\n", 204 ctx->ovpn_dco_id); 205 goto err_free; 206 } 207 208 ctx->nl_msg = nlmsg_alloc(); 209 if (!ctx->nl_msg) { 210 fprintf(stderr, "cannot allocate netlink message\n"); 211 goto err_sock; 212 } 213 214 ctx->nl_cb = nl_cb_alloc(NL_CB_DEFAULT); 215 if (!ctx->nl_cb) { 216 fprintf(stderr, "failed to allocate netlink callback\n"); 217 goto err_msg; 218 } 219 220 nl_socket_set_cb(ctx->nl_sock, ctx->nl_cb); 221 222 genlmsg_put(ctx->nl_msg, 0, 0, ctx->ovpn_dco_id, 0, flags, cmd, 0); 223 224 if (ovpn->ifindex > 0) 225 NLA_PUT_U32(ctx->nl_msg, OVPN_A_IFINDEX, ovpn->ifindex); 226 227 return ctx; 228 nla_put_failure: 229 err_msg: 230 nlmsg_free(ctx->nl_msg); 231 err_sock: 232 nl_socket_free(ctx->nl_sock); 233 err_free: 234 free(ctx); 235 return NULL; 236 } 237 238 static struct nl_ctx *nl_ctx_alloc(struct ovpn_ctx *ovpn, int cmd) 239 { 240 return nl_ctx_alloc_flags(ovpn, cmd, 0); 241 } 242 243 static void nl_ctx_free(struct nl_ctx *ctx) 244 { 245 if (!ctx) 246 return; 247 248 nl_socket_free(ctx->nl_sock); 249 nlmsg_free(ctx->nl_msg); 250 nl_cb_put(ctx->nl_cb); 251 free(ctx); 252 } 253 254 static int ovpn_nl_cb_error(struct sockaddr_nl (*nla)__always_unused, 255 struct nlmsgerr *err, void *arg) 256 { 257 struct nlmsghdr *nlh = (struct nlmsghdr *)err - 1; 258 struct nlattr *tb_msg[NLMSGERR_ATTR_MAX + 1]; 259 int len = nlh->nlmsg_len; 260 struct nlattr *attrs; 261 int *ret = arg; 262 int ack_len = sizeof(*nlh) + sizeof(int) + sizeof(*nlh); 263 264 *ret = err->error; 265 266 if (!(nlh->nlmsg_flags & NLM_F_ACK_TLVS)) 267 return NL_STOP; 268 269 if (!(nlh->nlmsg_flags & NLM_F_CAPPED)) 270 ack_len += err->msg.nlmsg_len - sizeof(*nlh); 271 272 if (len <= ack_len) 273 return NL_STOP; 274 275 attrs = (void *)((uint8_t *)nlh + ack_len); 276 len -= ack_len; 277 278 nla_parse(tb_msg, NLMSGERR_ATTR_MAX, attrs, len, NULL); 279 if (tb_msg[NLMSGERR_ATTR_MSG]) { 280 len = strnlen((char *)nla_data(tb_msg[NLMSGERR_ATTR_MSG]), 281 nla_len(tb_msg[NLMSGERR_ATTR_MSG])); 282 fprintf(stderr, "kernel error: %*s\n", len, 283 (char *)nla_data(tb_msg[NLMSGERR_ATTR_MSG])); 284 } 285 286 if (tb_msg[NLMSGERR_ATTR_MISS_NEST]) { 287 fprintf(stderr, "missing required nesting type %u\n", 288 nla_get_u32(tb_msg[NLMSGERR_ATTR_MISS_NEST])); 289 } 290 291 if (tb_msg[NLMSGERR_ATTR_MISS_TYPE]) { 292 fprintf(stderr, "missing required attribute type %u\n", 293 nla_get_u32(tb_msg[NLMSGERR_ATTR_MISS_TYPE])); 294 } 295 296 return NL_STOP; 297 } 298 299 static int ovpn_nl_cb_finish(struct nl_msg (*msg)__always_unused, 300 void *arg) 301 { 302 int *status = arg; 303 304 *status = 0; 305 return NL_SKIP; 306 } 307 308 static int ovpn_nl_cb_ack(struct nl_msg (*msg)__always_unused, 309 void *arg) 310 { 311 int *status = arg; 312 313 *status = 0; 314 return NL_STOP; 315 } 316 317 static int ovpn_nl_msg_send(struct nl_ctx *ctx, ovpn_nl_cb cb) 318 { 319 int status = 1; 320 321 nl_cb_err(ctx->nl_cb, NL_CB_CUSTOM, ovpn_nl_cb_error, &status); 322 nl_cb_set(ctx->nl_cb, NL_CB_FINISH, NL_CB_CUSTOM, ovpn_nl_cb_finish, 323 &status); 324 nl_cb_set(ctx->nl_cb, NL_CB_ACK, NL_CB_CUSTOM, ovpn_nl_cb_ack, &status); 325 326 if (cb) 327 nl_cb_set(ctx->nl_cb, NL_CB_VALID, NL_CB_CUSTOM, cb, ctx); 328 329 nl_send_auto_complete(ctx->nl_sock, ctx->nl_msg); 330 331 while (status == 1) 332 ovpn_nl_recvmsgs(ctx); 333 334 if (status < 0) 335 fprintf(stderr, "failed to send netlink message: %s (%d)\n", 336 strerror(-status), status); 337 338 return status; 339 } 340 341 static int ovpn_parse_key(const char *file, struct ovpn_ctx *ctx) 342 { 343 int idx_enc, idx_dec, ret = -1; 344 unsigned char *ckey = NULL; 345 __u8 *bkey = NULL; 346 size_t olen = 0; 347 long ckey_len; 348 FILE *fp; 349 350 fp = fopen(file, "r"); 351 if (!fp) { 352 fprintf(stderr, "cannot open: %s\n", file); 353 return -1; 354 } 355 356 /* get file size */ 357 fseek(fp, 0L, SEEK_END); 358 ckey_len = ftell(fp); 359 rewind(fp); 360 361 /* if the file is longer, let's just read a portion */ 362 if (ckey_len > 256) 363 ckey_len = 256; 364 365 ckey = malloc(ckey_len); 366 if (!ckey) 367 goto err; 368 369 ret = fread(ckey, 1, ckey_len, fp); 370 if (ret != ckey_len) { 371 fprintf(stderr, 372 "couldn't read enough data from key file: %dbytes read\n", 373 ret); 374 goto err; 375 } 376 377 olen = 0; 378 ret = mbedtls_base64_decode(NULL, 0, &olen, ckey, ckey_len); 379 if (ret != MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL) { 380 char buf[256]; 381 382 mbedtls_strerror(ret, buf, sizeof(buf)); 383 fprintf(stderr, "unexpected base64 error1: %s (%d)\n", buf, 384 ret); 385 386 goto err; 387 } 388 389 bkey = malloc(olen); 390 if (!bkey) { 391 fprintf(stderr, "cannot allocate binary key buffer\n"); 392 goto err; 393 } 394 395 ret = mbedtls_base64_decode(bkey, olen, &olen, ckey, ckey_len); 396 if (ret) { 397 char buf[256]; 398 399 mbedtls_strerror(ret, buf, sizeof(buf)); 400 fprintf(stderr, "unexpected base64 error2: %s (%d)\n", buf, 401 ret); 402 403 goto err; 404 } 405 406 if (olen < 2 * KEY_LEN + NONCE_LEN) { 407 fprintf(stderr, 408 "not enough data in key file, found %zdB but needs %dB\n", 409 olen, 2 * KEY_LEN + NONCE_LEN); 410 goto err; 411 } 412 413 switch (ctx->key_dir) { 414 case KEY_DIR_IN: 415 idx_enc = 0; 416 idx_dec = 1; 417 break; 418 case KEY_DIR_OUT: 419 idx_enc = 1; 420 idx_dec = 0; 421 break; 422 default: 423 goto err; 424 } 425 426 memcpy(ctx->key_enc, bkey + KEY_LEN * idx_enc, KEY_LEN); 427 memcpy(ctx->key_dec, bkey + KEY_LEN * idx_dec, KEY_LEN); 428 memcpy(ctx->nonce, bkey + 2 * KEY_LEN, NONCE_LEN); 429 430 ret = 0; 431 432 err: 433 fclose(fp); 434 free(bkey); 435 free(ckey); 436 437 return ret; 438 } 439 440 static int ovpn_parse_cipher(const char *cipher, struct ovpn_ctx *ctx) 441 { 442 if (strcmp(cipher, "aes") == 0) 443 ctx->cipher = OVPN_CIPHER_ALG_AES_GCM; 444 else if (strcmp(cipher, "chachapoly") == 0) 445 ctx->cipher = OVPN_CIPHER_ALG_CHACHA20_POLY1305; 446 else if (strcmp(cipher, "none") == 0) 447 ctx->cipher = OVPN_CIPHER_ALG_NONE; 448 else 449 return -ENOTSUP; 450 451 return 0; 452 } 453 454 static int ovpn_parse_key_direction(const char *dir, struct ovpn_ctx *ctx) 455 { 456 int in_dir; 457 458 in_dir = strtoll(dir, NULL, 10); 459 switch (in_dir) { 460 case KEY_DIR_IN: 461 case KEY_DIR_OUT: 462 ctx->key_dir = in_dir; 463 break; 464 default: 465 fprintf(stderr, 466 "invalid key direction provided. Can be 0 or 1 only\n"); 467 return -1; 468 } 469 470 return 0; 471 } 472 473 static int ovpn_socket(struct ovpn_ctx *ctx, sa_family_t family, int proto) 474 { 475 struct sockaddr_storage local_sock = { 0 }; 476 struct sockaddr_in6 *in6; 477 struct sockaddr_in *in; 478 int ret, s, sock_type; 479 size_t sock_len; 480 481 if (proto == IPPROTO_UDP) 482 sock_type = SOCK_DGRAM; 483 else if (proto == IPPROTO_TCP) 484 sock_type = SOCK_STREAM; 485 else 486 return -EINVAL; 487 488 s = socket(family, sock_type, 0); 489 if (s < 0) { 490 perror("cannot create socket"); 491 return -1; 492 } 493 494 switch (family) { 495 case AF_INET: 496 in = (struct sockaddr_in *)&local_sock; 497 in->sin_family = family; 498 in->sin_port = htons(ctx->lport); 499 in->sin_addr.s_addr = htonl(INADDR_ANY); 500 sock_len = sizeof(*in); 501 break; 502 case AF_INET6: 503 in6 = (struct sockaddr_in6 *)&local_sock; 504 in6->sin6_family = family; 505 in6->sin6_port = htons(ctx->lport); 506 in6->sin6_addr = in6addr_any; 507 sock_len = sizeof(*in6); 508 break; 509 default: 510 return -1; 511 } 512 513 int opt = 1; 514 515 ret = setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt)); 516 517 if (ret < 0) { 518 perror("setsockopt for SO_REUSEADDR"); 519 return ret; 520 } 521 522 ret = setsockopt(s, SOL_SOCKET, SO_REUSEPORT, &opt, sizeof(opt)); 523 if (ret < 0) { 524 perror("setsockopt for SO_REUSEPORT"); 525 return ret; 526 } 527 528 if (ctx->mark != 0) { 529 ret = setsockopt(s, SOL_SOCKET, SO_MARK, (void *)&ctx->mark, 530 sizeof(ctx->mark)); 531 if (ret < 0) { 532 perror("setsockopt for SO_MARK"); 533 return ret; 534 } 535 } 536 537 if (family == AF_INET6) { 538 opt = 0; 539 if (setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, &opt, 540 sizeof(opt))) { 541 perror("failed to set IPV6_V6ONLY"); 542 return -1; 543 } 544 } 545 546 ret = bind(s, (struct sockaddr *)&local_sock, sock_len); 547 if (ret < 0) { 548 perror("cannot bind socket"); 549 goto err_socket; 550 } 551 552 ctx->socket = s; 553 ctx->sa_family = family; 554 return 0; 555 556 err_socket: 557 close(s); 558 return -1; 559 } 560 561 static int ovpn_udp_socket(struct ovpn_ctx *ctx, sa_family_t family) 562 { 563 return ovpn_socket(ctx, family, IPPROTO_UDP); 564 } 565 566 static int ovpn_listen(struct ovpn_ctx *ctx, sa_family_t family) 567 { 568 int ret; 569 570 ret = ovpn_socket(ctx, family, IPPROTO_TCP); 571 if (ret < 0) 572 return ret; 573 574 ret = listen(ctx->socket, 10); 575 if (ret < 0) { 576 perror("listen"); 577 close(ctx->socket); 578 return -1; 579 } 580 581 return 0; 582 } 583 584 static int ovpn_accept(struct ovpn_ctx *ctx) 585 { 586 socklen_t socklen; 587 int ret; 588 589 socklen = sizeof(ctx->remote); 590 ret = accept(ctx->socket, (struct sockaddr *)&ctx->remote, &socklen); 591 if (ret < 0) { 592 perror("accept"); 593 goto err; 594 } 595 596 fprintf(stderr, "Connection received!\n"); 597 598 switch (socklen) { 599 case sizeof(struct sockaddr_in): 600 case sizeof(struct sockaddr_in6): 601 break; 602 default: 603 fprintf(stderr, "error: expecting IPv4 or IPv6 connection\n"); 604 close(ret); 605 ret = -EINVAL; 606 goto err; 607 } 608 609 return ret; 610 err: 611 close(ctx->socket); 612 return ret; 613 } 614 615 static int ovpn_connect(struct ovpn_ctx *ovpn) 616 { 617 socklen_t socklen; 618 int s, ret; 619 620 s = socket(ovpn->remote.in4.sin_family, SOCK_STREAM, 0); 621 if (s < 0) { 622 perror("cannot create socket"); 623 return -1; 624 } 625 626 switch (ovpn->remote.in4.sin_family) { 627 case AF_INET: 628 socklen = sizeof(struct sockaddr_in); 629 break; 630 case AF_INET6: 631 socklen = sizeof(struct sockaddr_in6); 632 break; 633 default: 634 return -EOPNOTSUPP; 635 } 636 637 ret = connect(s, (struct sockaddr *)&ovpn->remote, socklen); 638 if (ret < 0) { 639 perror("connect"); 640 goto err; 641 } 642 643 fprintf(stderr, "connected\n"); 644 645 ovpn->socket = s; 646 647 return 0; 648 err: 649 close(s); 650 return ret; 651 } 652 653 static int ovpn_nl_put_vpn_addr(struct nl_msg *msg, 654 const struct ovpn_ctx *ovpn) 655 { 656 if (!ovpn->peer_ip_set) 657 return 0; 658 659 switch (ovpn->peer_ip.in4.sin_family) { 660 case AF_INET: 661 return nla_put_u32(msg, OVPN_A_PEER_VPN_IPV4, 662 ovpn->peer_ip.in4.sin_addr.s_addr); 663 case AF_INET6: 664 return nla_put(msg, OVPN_A_PEER_VPN_IPV6, 665 sizeof(struct in6_addr), 666 &ovpn->peer_ip.in6.sin6_addr); 667 default: 668 fprintf(stderr, "Invalid family for peer address\n"); 669 return -EAFNOSUPPORT; 670 } 671 } 672 673 static int ovpn_new_peer(struct ovpn_ctx *ovpn, bool is_tcp) 674 { 675 struct nlattr *attr; 676 struct nl_ctx *ctx; 677 int ret = -1; 678 679 ctx = nl_ctx_alloc(ovpn, OVPN_CMD_PEER_NEW); 680 if (!ctx) 681 return -ENOMEM; 682 683 attr = nla_nest_start(ctx->nl_msg, OVPN_A_PEER); 684 NLA_PUT_U32(ctx->nl_msg, OVPN_A_PEER_ID, ovpn->peer_id); 685 if (ovpn->asymm_id) 686 NLA_PUT_U32(ctx->nl_msg, OVPN_A_PEER_TX_ID, ovpn->tx_id); 687 NLA_PUT_U32(ctx->nl_msg, OVPN_A_PEER_SOCKET, ovpn->socket); 688 689 if (!is_tcp) { 690 switch (ovpn->remote.in4.sin_family) { 691 case AF_INET: 692 NLA_PUT_U32(ctx->nl_msg, OVPN_A_PEER_REMOTE_IPV4, 693 ovpn->remote.in4.sin_addr.s_addr); 694 NLA_PUT_U16(ctx->nl_msg, OVPN_A_PEER_REMOTE_PORT, 695 ovpn->remote.in4.sin_port); 696 break; 697 case AF_INET6: 698 NLA_PUT(ctx->nl_msg, OVPN_A_PEER_REMOTE_IPV6, 699 sizeof(ovpn->remote.in6.sin6_addr), 700 &ovpn->remote.in6.sin6_addr); 701 NLA_PUT_U32(ctx->nl_msg, 702 OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID, 703 ovpn->remote.in6.sin6_scope_id); 704 NLA_PUT_U16(ctx->nl_msg, OVPN_A_PEER_REMOTE_PORT, 705 ovpn->remote.in6.sin6_port); 706 break; 707 default: 708 fprintf(stderr, 709 "Invalid family for remote socket address\n"); 710 goto nla_put_failure; 711 } 712 } 713 714 ret = ovpn_nl_put_vpn_addr(ctx->nl_msg, ovpn); 715 if (ret) 716 goto nla_put_failure; 717 718 nla_nest_end(ctx->nl_msg, attr); 719 720 ret = ovpn_nl_msg_send(ctx, NULL); 721 nla_put_failure: 722 nl_ctx_free(ctx); 723 return ret; 724 } 725 726 static int ovpn_set_peer(struct ovpn_ctx *ovpn) 727 { 728 struct nlattr *attr; 729 struct nl_ctx *ctx; 730 int ret = -1; 731 732 ctx = nl_ctx_alloc(ovpn, OVPN_CMD_PEER_SET); 733 if (!ctx) 734 return -ENOMEM; 735 736 attr = nla_nest_start(ctx->nl_msg, OVPN_A_PEER); 737 NLA_PUT_U32(ctx->nl_msg, OVPN_A_PEER_ID, ovpn->peer_id); 738 NLA_PUT_U32(ctx->nl_msg, OVPN_A_PEER_KEEPALIVE_INTERVAL, 739 ovpn->keepalive_interval); 740 NLA_PUT_U32(ctx->nl_msg, OVPN_A_PEER_KEEPALIVE_TIMEOUT, 741 ovpn->keepalive_timeout); 742 743 ret = ovpn_nl_put_vpn_addr(ctx->nl_msg, ovpn); 744 if (ret) 745 goto nla_put_failure; 746 nla_nest_end(ctx->nl_msg, attr); 747 748 ret = ovpn_nl_msg_send(ctx, NULL); 749 nla_put_failure: 750 nl_ctx_free(ctx); 751 return ret; 752 } 753 754 static int ovpn_del_peer(struct ovpn_ctx *ovpn) 755 { 756 struct nlattr *attr; 757 struct nl_ctx *ctx; 758 int ret = -1; 759 760 ctx = nl_ctx_alloc(ovpn, OVPN_CMD_PEER_DEL); 761 if (!ctx) 762 return -ENOMEM; 763 764 attr = nla_nest_start(ctx->nl_msg, OVPN_A_PEER); 765 NLA_PUT_U32(ctx->nl_msg, OVPN_A_PEER_ID, ovpn->peer_id); 766 nla_nest_end(ctx->nl_msg, attr); 767 768 ret = ovpn_nl_msg_send(ctx, NULL); 769 nla_put_failure: 770 nl_ctx_free(ctx); 771 return ret; 772 } 773 774 static int ovpn_handle_peer(struct nl_msg *msg, void (*arg)__always_unused) 775 { 776 struct nlattr *pattrs[OVPN_A_PEER_MAX + 1]; 777 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); 778 struct nlattr *attrs[OVPN_A_MAX + 1]; 779 __u16 rport = 0, lport = 0; 780 781 nla_parse(attrs, OVPN_A_MAX, genlmsg_attrdata(gnlh, 0), 782 genlmsg_attrlen(gnlh, 0), NULL); 783 784 if (!attrs[OVPN_A_PEER]) { 785 fprintf(stderr, "no packet content in netlink message\n"); 786 return NL_SKIP; 787 } 788 789 nla_parse(pattrs, OVPN_A_PEER_MAX, nla_data(attrs[OVPN_A_PEER]), 790 nla_len(attrs[OVPN_A_PEER]), NULL); 791 792 if (pattrs[OVPN_A_PEER_ID]) 793 fprintf(stderr, "* Peer %u\n", 794 nla_get_u32(pattrs[OVPN_A_PEER_ID])); 795 796 if (pattrs[OVPN_A_PEER_TX_ID]) 797 fprintf(stderr, "\tTX peer ID %u\n", 798 nla_get_u32(pattrs[OVPN_A_PEER_TX_ID])); 799 800 if (pattrs[OVPN_A_PEER_SOCKET_NETNSID]) 801 fprintf(stderr, "\tsocket NetNS ID: %d\n", 802 nla_get_s32(pattrs[OVPN_A_PEER_SOCKET_NETNSID])); 803 804 if (pattrs[OVPN_A_PEER_VPN_IPV4]) { 805 char buf[INET_ADDRSTRLEN]; 806 807 inet_ntop(AF_INET, nla_data(pattrs[OVPN_A_PEER_VPN_IPV4]), 808 buf, sizeof(buf)); 809 fprintf(stderr, "\tVPN IPv4: %s\n", buf); 810 } 811 812 if (pattrs[OVPN_A_PEER_VPN_IPV6]) { 813 char buf[INET6_ADDRSTRLEN]; 814 815 inet_ntop(AF_INET6, nla_data(pattrs[OVPN_A_PEER_VPN_IPV6]), 816 buf, sizeof(buf)); 817 fprintf(stderr, "\tVPN IPv6: %s\n", buf); 818 } 819 820 if (pattrs[OVPN_A_PEER_LOCAL_PORT]) 821 lport = ntohs(nla_get_u16(pattrs[OVPN_A_PEER_LOCAL_PORT])); 822 823 if (pattrs[OVPN_A_PEER_REMOTE_PORT]) 824 rport = ntohs(nla_get_u16(pattrs[OVPN_A_PEER_REMOTE_PORT])); 825 826 if (pattrs[OVPN_A_PEER_REMOTE_IPV6]) { 827 void *ip = pattrs[OVPN_A_PEER_REMOTE_IPV6]; 828 char buf[INET6_ADDRSTRLEN]; 829 int scope_id = -1; 830 831 if (pattrs[OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID]) { 832 void *p = pattrs[OVPN_A_PEER_REMOTE_IPV6_SCOPE_ID]; 833 834 scope_id = nla_get_u32(p); 835 } 836 837 inet_ntop(AF_INET6, nla_data(ip), buf, sizeof(buf)); 838 fprintf(stderr, "\tRemote: %s:%hu (scope-id: %u)\n", buf, rport, 839 scope_id); 840 841 if (pattrs[OVPN_A_PEER_LOCAL_IPV6]) { 842 void *ip = pattrs[OVPN_A_PEER_LOCAL_IPV6]; 843 844 inet_ntop(AF_INET6, nla_data(ip), buf, sizeof(buf)); 845 fprintf(stderr, "\tLocal: %s:%hu\n", buf, lport); 846 } 847 } 848 849 if (pattrs[OVPN_A_PEER_REMOTE_IPV4]) { 850 void *ip = pattrs[OVPN_A_PEER_REMOTE_IPV4]; 851 char buf[INET_ADDRSTRLEN]; 852 853 inet_ntop(AF_INET, nla_data(ip), buf, sizeof(buf)); 854 fprintf(stderr, "\tRemote: %s:%hu\n", buf, rport); 855 856 if (pattrs[OVPN_A_PEER_LOCAL_IPV4]) { 857 void *p = pattrs[OVPN_A_PEER_LOCAL_IPV4]; 858 859 inet_ntop(AF_INET, nla_data(p), buf, sizeof(buf)); 860 fprintf(stderr, "\tLocal: %s:%hu\n", buf, lport); 861 } 862 } 863 864 if (pattrs[OVPN_A_PEER_KEEPALIVE_INTERVAL]) { 865 void *p = pattrs[OVPN_A_PEER_KEEPALIVE_INTERVAL]; 866 867 fprintf(stderr, "\tKeepalive interval: %u sec\n", 868 nla_get_u32(p)); 869 } 870 871 if (pattrs[OVPN_A_PEER_KEEPALIVE_TIMEOUT]) 872 fprintf(stderr, "\tKeepalive timeout: %u sec\n", 873 nla_get_u32(pattrs[OVPN_A_PEER_KEEPALIVE_TIMEOUT])); 874 875 if (pattrs[OVPN_A_PEER_VPN_RX_BYTES]) 876 fprintf(stderr, "\tVPN RX bytes: %" PRIu64 "\n", 877 ovpn_nla_get_uint(pattrs[OVPN_A_PEER_VPN_RX_BYTES])); 878 879 if (pattrs[OVPN_A_PEER_VPN_TX_BYTES]) 880 fprintf(stderr, "\tVPN TX bytes: %" PRIu64 "\n", 881 ovpn_nla_get_uint(pattrs[OVPN_A_PEER_VPN_TX_BYTES])); 882 883 if (pattrs[OVPN_A_PEER_VPN_RX_PACKETS]) 884 fprintf(stderr, "\tVPN RX packets: %" PRIu64 "\n", 885 ovpn_nla_get_uint(pattrs[OVPN_A_PEER_VPN_RX_PACKETS])); 886 887 if (pattrs[OVPN_A_PEER_VPN_TX_PACKETS]) 888 fprintf(stderr, "\tVPN TX packets: %" PRIu64 "\n", 889 ovpn_nla_get_uint(pattrs[OVPN_A_PEER_VPN_TX_PACKETS])); 890 891 if (pattrs[OVPN_A_PEER_LINK_RX_BYTES]) 892 fprintf(stderr, "\tLINK RX bytes: %" PRIu64 "\n", 893 ovpn_nla_get_uint(pattrs[OVPN_A_PEER_LINK_RX_BYTES])); 894 895 if (pattrs[OVPN_A_PEER_LINK_TX_BYTES]) 896 fprintf(stderr, "\tLINK TX bytes: %" PRIu64 "\n", 897 ovpn_nla_get_uint(pattrs[OVPN_A_PEER_LINK_TX_BYTES])); 898 899 if (pattrs[OVPN_A_PEER_LINK_RX_PACKETS]) 900 fprintf(stderr, "\tLINK RX packets: %" PRIu64 "\n", 901 ovpn_nla_get_uint(pattrs[OVPN_A_PEER_LINK_RX_PACKETS])); 902 903 if (pattrs[OVPN_A_PEER_LINK_TX_PACKETS]) 904 fprintf(stderr, "\tLINK TX packets: %" PRIu64 "\n", 905 ovpn_nla_get_uint(pattrs[OVPN_A_PEER_LINK_TX_PACKETS])); 906 907 return NL_SKIP; 908 } 909 910 static int ovpn_get_peer(struct ovpn_ctx *ovpn) 911 { 912 int flags = 0, ret = -1; 913 struct nlattr *attr; 914 struct nl_ctx *ctx; 915 916 if (ovpn->peer_id == PEER_ID_UNDEF) 917 flags = NLM_F_DUMP; 918 919 ctx = nl_ctx_alloc_flags(ovpn, OVPN_CMD_PEER_GET, flags); 920 if (!ctx) 921 return -ENOMEM; 922 923 if (ovpn->peer_id != PEER_ID_UNDEF) { 924 attr = nla_nest_start(ctx->nl_msg, OVPN_A_PEER); 925 NLA_PUT_U32(ctx->nl_msg, OVPN_A_PEER_ID, ovpn->peer_id); 926 nla_nest_end(ctx->nl_msg, attr); 927 } 928 929 ret = ovpn_nl_msg_send(ctx, ovpn_handle_peer); 930 nla_put_failure: 931 nl_ctx_free(ctx); 932 return ret; 933 } 934 935 static int ovpn_new_key(struct ovpn_ctx *ovpn) 936 { 937 struct nlattr *keyconf, *key_dir; 938 struct nl_ctx *ctx; 939 int ret = -1; 940 941 ctx = nl_ctx_alloc(ovpn, OVPN_CMD_KEY_NEW); 942 if (!ctx) 943 return -ENOMEM; 944 945 keyconf = nla_nest_start(ctx->nl_msg, OVPN_A_KEYCONF); 946 NLA_PUT_U32(ctx->nl_msg, OVPN_A_KEYCONF_PEER_ID, ovpn->peer_id); 947 NLA_PUT_U32(ctx->nl_msg, OVPN_A_KEYCONF_SLOT, ovpn->key_slot); 948 NLA_PUT_U32(ctx->nl_msg, OVPN_A_KEYCONF_KEY_ID, ovpn->key_id); 949 NLA_PUT_U32(ctx->nl_msg, OVPN_A_KEYCONF_CIPHER_ALG, ovpn->cipher); 950 951 key_dir = nla_nest_start(ctx->nl_msg, OVPN_A_KEYCONF_ENCRYPT_DIR); 952 NLA_PUT(ctx->nl_msg, OVPN_A_KEYDIR_CIPHER_KEY, KEY_LEN, ovpn->key_enc); 953 NLA_PUT(ctx->nl_msg, OVPN_A_KEYDIR_NONCE_TAIL, NONCE_LEN, ovpn->nonce); 954 nla_nest_end(ctx->nl_msg, key_dir); 955 956 key_dir = nla_nest_start(ctx->nl_msg, OVPN_A_KEYCONF_DECRYPT_DIR); 957 NLA_PUT(ctx->nl_msg, OVPN_A_KEYDIR_CIPHER_KEY, KEY_LEN, ovpn->key_dec); 958 NLA_PUT(ctx->nl_msg, OVPN_A_KEYDIR_NONCE_TAIL, NONCE_LEN, ovpn->nonce); 959 nla_nest_end(ctx->nl_msg, key_dir); 960 961 nla_nest_end(ctx->nl_msg, keyconf); 962 963 ret = ovpn_nl_msg_send(ctx, NULL); 964 nla_put_failure: 965 nl_ctx_free(ctx); 966 return ret; 967 } 968 969 static int ovpn_del_key(struct ovpn_ctx *ovpn) 970 { 971 struct nlattr *keyconf; 972 struct nl_ctx *ctx; 973 int ret = -1; 974 975 ctx = nl_ctx_alloc(ovpn, OVPN_CMD_KEY_DEL); 976 if (!ctx) 977 return -ENOMEM; 978 979 keyconf = nla_nest_start(ctx->nl_msg, OVPN_A_KEYCONF); 980 NLA_PUT_U32(ctx->nl_msg, OVPN_A_KEYCONF_PEER_ID, ovpn->peer_id); 981 NLA_PUT_U32(ctx->nl_msg, OVPN_A_KEYCONF_SLOT, ovpn->key_slot); 982 nla_nest_end(ctx->nl_msg, keyconf); 983 984 ret = ovpn_nl_msg_send(ctx, NULL); 985 nla_put_failure: 986 nl_ctx_free(ctx); 987 return ret; 988 } 989 990 static int ovpn_handle_key(struct nl_msg *msg, void (*arg)__always_unused) 991 { 992 struct nlattr *kattrs[OVPN_A_KEYCONF_MAX + 1]; 993 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); 994 struct nlattr *attrs[OVPN_A_MAX + 1]; 995 996 nla_parse(attrs, OVPN_A_MAX, genlmsg_attrdata(gnlh, 0), 997 genlmsg_attrlen(gnlh, 0), NULL); 998 999 if (!attrs[OVPN_A_KEYCONF]) { 1000 fprintf(stderr, "no packet content in netlink message\n"); 1001 return NL_SKIP; 1002 } 1003 1004 nla_parse(kattrs, OVPN_A_KEYCONF_MAX, nla_data(attrs[OVPN_A_KEYCONF]), 1005 nla_len(attrs[OVPN_A_KEYCONF]), NULL); 1006 1007 if (kattrs[OVPN_A_KEYCONF_PEER_ID]) 1008 fprintf(stderr, "* Peer %u\n", 1009 nla_get_u32(kattrs[OVPN_A_KEYCONF_PEER_ID])); 1010 if (kattrs[OVPN_A_KEYCONF_SLOT]) { 1011 fprintf(stderr, "\t- Slot: "); 1012 switch (nla_get_u32(kattrs[OVPN_A_KEYCONF_SLOT])) { 1013 case OVPN_KEY_SLOT_PRIMARY: 1014 fprintf(stderr, "primary\n"); 1015 break; 1016 case OVPN_KEY_SLOT_SECONDARY: 1017 fprintf(stderr, "secondary\n"); 1018 break; 1019 default: 1020 fprintf(stderr, "invalid (%u)\n", 1021 nla_get_u32(kattrs[OVPN_A_KEYCONF_SLOT])); 1022 break; 1023 } 1024 } 1025 if (kattrs[OVPN_A_KEYCONF_KEY_ID]) 1026 fprintf(stderr, "\t- Key ID: %u\n", 1027 nla_get_u32(kattrs[OVPN_A_KEYCONF_KEY_ID])); 1028 if (kattrs[OVPN_A_KEYCONF_CIPHER_ALG]) { 1029 fprintf(stderr, "\t- Cipher: "); 1030 switch (nla_get_u32(kattrs[OVPN_A_KEYCONF_CIPHER_ALG])) { 1031 case OVPN_CIPHER_ALG_NONE: 1032 fprintf(stderr, "none\n"); 1033 break; 1034 case OVPN_CIPHER_ALG_AES_GCM: 1035 fprintf(stderr, "aes-gcm\n"); 1036 break; 1037 case OVPN_CIPHER_ALG_CHACHA20_POLY1305: 1038 fprintf(stderr, "chacha20poly1305\n"); 1039 break; 1040 default: 1041 fprintf(stderr, "invalid (%u)\n", 1042 nla_get_u32(kattrs[OVPN_A_KEYCONF_CIPHER_ALG])); 1043 break; 1044 } 1045 } 1046 1047 return NL_SKIP; 1048 } 1049 1050 static int ovpn_get_key(struct ovpn_ctx *ovpn) 1051 { 1052 struct nlattr *keyconf; 1053 struct nl_ctx *ctx; 1054 int ret = -1; 1055 1056 ctx = nl_ctx_alloc(ovpn, OVPN_CMD_KEY_GET); 1057 if (!ctx) 1058 return -ENOMEM; 1059 1060 keyconf = nla_nest_start(ctx->nl_msg, OVPN_A_KEYCONF); 1061 NLA_PUT_U32(ctx->nl_msg, OVPN_A_KEYCONF_PEER_ID, ovpn->peer_id); 1062 NLA_PUT_U32(ctx->nl_msg, OVPN_A_KEYCONF_SLOT, ovpn->key_slot); 1063 nla_nest_end(ctx->nl_msg, keyconf); 1064 1065 ret = ovpn_nl_msg_send(ctx, ovpn_handle_key); 1066 nla_put_failure: 1067 nl_ctx_free(ctx); 1068 return ret; 1069 } 1070 1071 static int ovpn_swap_keys(struct ovpn_ctx *ovpn) 1072 { 1073 struct nl_ctx *ctx; 1074 struct nlattr *kc; 1075 int ret = -1; 1076 1077 ctx = nl_ctx_alloc(ovpn, OVPN_CMD_KEY_SWAP); 1078 if (!ctx) 1079 return -ENOMEM; 1080 1081 kc = nla_nest_start(ctx->nl_msg, OVPN_A_KEYCONF); 1082 NLA_PUT_U32(ctx->nl_msg, OVPN_A_KEYCONF_PEER_ID, ovpn->peer_id); 1083 nla_nest_end(ctx->nl_msg, kc); 1084 1085 ret = ovpn_nl_msg_send(ctx, NULL); 1086 nla_put_failure: 1087 nl_ctx_free(ctx); 1088 return ret; 1089 } 1090 1091 /* Helper function used to easily add attributes to a rtnl message */ 1092 static int ovpn_addattr(struct nlmsghdr *n, int maxlen, int type, 1093 const void *data, int alen) 1094 { 1095 int len = RTA_LENGTH(alen); 1096 struct rtattr *rta; 1097 1098 if ((int)(NLMSG_ALIGN(n->nlmsg_len) + RTA_ALIGN(len)) > maxlen) { 1099 fprintf(stderr, "%s: rtnl: message exceeded bound of %d\n", 1100 __func__, maxlen); 1101 return -EMSGSIZE; 1102 } 1103 1104 rta = nlmsg_tail(n); 1105 rta->rta_type = type; 1106 rta->rta_len = len; 1107 1108 if (!data) 1109 memset(RTA_DATA(rta), 0, alen); 1110 else 1111 memcpy(RTA_DATA(rta), data, alen); 1112 1113 n->nlmsg_len = NLMSG_ALIGN(n->nlmsg_len) + RTA_ALIGN(len); 1114 1115 return 0; 1116 } 1117 1118 static struct rtattr *ovpn_nest_start(struct nlmsghdr *msg, size_t max_size, 1119 int attr) 1120 { 1121 struct rtattr *nest = nlmsg_tail(msg); 1122 1123 if (ovpn_addattr(msg, max_size, attr, NULL, 0) < 0) 1124 return NULL; 1125 1126 return nest; 1127 } 1128 1129 static void ovpn_nest_end(struct nlmsghdr *msg, struct rtattr *nest) 1130 { 1131 nest->rta_len = (uint8_t *)nlmsg_tail(msg) - (uint8_t *)nest; 1132 } 1133 1134 #define RT_SNDBUF_SIZE (1024 * 2) 1135 #define RT_RCVBUF_SIZE (1024 * 4) 1136 1137 /* Open RTNL socket */ 1138 static int ovpn_rt_socket(void) 1139 { 1140 int sndbuf = RT_SNDBUF_SIZE, rcvbuf = RT_RCVBUF_SIZE, fd; 1141 1142 fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); 1143 if (fd < 0) { 1144 fprintf(stderr, "%s: cannot open netlink socket\n", __func__); 1145 return fd; 1146 } 1147 1148 if (setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &sndbuf, 1149 sizeof(sndbuf)) < 0) { 1150 fprintf(stderr, "%s: SO_SNDBUF\n", __func__); 1151 close(fd); 1152 return -1; 1153 } 1154 1155 if (setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &rcvbuf, 1156 sizeof(rcvbuf)) < 0) { 1157 fprintf(stderr, "%s: SO_RCVBUF\n", __func__); 1158 close(fd); 1159 return -1; 1160 } 1161 1162 return fd; 1163 } 1164 1165 /* Bind socket to Netlink subsystem */ 1166 static int ovpn_rt_bind(int fd, uint32_t groups) 1167 { 1168 struct sockaddr_nl local = { 0 }; 1169 socklen_t addr_len; 1170 1171 local.nl_family = AF_NETLINK; 1172 local.nl_groups = groups; 1173 1174 if (bind(fd, (struct sockaddr *)&local, sizeof(local)) < 0) { 1175 fprintf(stderr, "%s: cannot bind netlink socket: %d\n", 1176 __func__, errno); 1177 return -errno; 1178 } 1179 1180 addr_len = sizeof(local); 1181 if (getsockname(fd, (struct sockaddr *)&local, &addr_len) < 0) { 1182 fprintf(stderr, "%s: cannot getsockname: %d\n", __func__, 1183 errno); 1184 return -errno; 1185 } 1186 1187 if (addr_len != sizeof(local)) { 1188 fprintf(stderr, "%s: wrong address length %d\n", __func__, 1189 addr_len); 1190 return -EINVAL; 1191 } 1192 1193 if (local.nl_family != AF_NETLINK) { 1194 fprintf(stderr, "%s: wrong address family %d\n", __func__, 1195 local.nl_family); 1196 return -EINVAL; 1197 } 1198 1199 return 0; 1200 } 1201 1202 typedef int (*ovpn_parse_reply_cb)(struct nlmsghdr *msg, void *arg); 1203 1204 /* Send Netlink message and run callback on reply (if specified) */ 1205 static int ovpn_rt_send(struct nlmsghdr *payload, pid_t peer, 1206 unsigned int groups, ovpn_parse_reply_cb cb, 1207 void *arg_cb) 1208 { 1209 int len, rem_len, fd, ret, rcv_len; 1210 struct sockaddr_nl nladdr = { 0 }; 1211 struct nlmsgerr *err; 1212 struct nlmsghdr *h; 1213 char buf[1024 * 16]; 1214 struct iovec iov = { 1215 .iov_base = payload, 1216 .iov_len = payload->nlmsg_len, 1217 }; 1218 struct msghdr nlmsg = { 1219 .msg_name = &nladdr, 1220 .msg_namelen = sizeof(nladdr), 1221 .msg_iov = &iov, 1222 .msg_iovlen = 1, 1223 }; 1224 1225 nladdr.nl_family = AF_NETLINK; 1226 nladdr.nl_pid = peer; 1227 nladdr.nl_groups = groups; 1228 1229 payload->nlmsg_seq = time(NULL); 1230 1231 /* no need to send reply */ 1232 if (!cb) 1233 payload->nlmsg_flags |= NLM_F_ACK; 1234 1235 fd = ovpn_rt_socket(); 1236 if (fd < 0) { 1237 fprintf(stderr, "%s: can't open rtnl socket\n", __func__); 1238 return -errno; 1239 } 1240 1241 ret = ovpn_rt_bind(fd, 0); 1242 if (ret < 0) { 1243 fprintf(stderr, "%s: can't bind rtnl socket\n", __func__); 1244 ret = -errno; 1245 goto out; 1246 } 1247 1248 ret = sendmsg(fd, &nlmsg, 0); 1249 if (ret < 0) { 1250 fprintf(stderr, "%s: rtnl: error on sendmsg()\n", __func__); 1251 ret = -errno; 1252 goto out; 1253 } 1254 1255 /* prepare buffer to store RTNL replies */ 1256 memset(buf, 0, sizeof(buf)); 1257 iov.iov_base = buf; 1258 1259 while (1) { 1260 /* 1261 * iov_len is modified by recvmsg(), therefore has to be initialized before 1262 * using it again 1263 */ 1264 iov.iov_len = sizeof(buf); 1265 rcv_len = recvmsg(fd, &nlmsg, 0); 1266 if (rcv_len < 0) { 1267 if (errno == EINTR || errno == EAGAIN) { 1268 fprintf(stderr, "%s: interrupted call\n", 1269 __func__); 1270 continue; 1271 } 1272 fprintf(stderr, "%s: rtnl: error on recvmsg()\n", 1273 __func__); 1274 ret = -errno; 1275 goto out; 1276 } 1277 1278 if (rcv_len == 0) { 1279 fprintf(stderr, 1280 "%s: rtnl: socket reached unexpected EOF\n", 1281 __func__); 1282 ret = -EIO; 1283 goto out; 1284 } 1285 1286 if (nlmsg.msg_namelen != sizeof(nladdr)) { 1287 fprintf(stderr, 1288 "%s: sender address length: %u (expected %zu)\n", 1289 __func__, nlmsg.msg_namelen, sizeof(nladdr)); 1290 ret = -EIO; 1291 goto out; 1292 } 1293 1294 h = (struct nlmsghdr *)buf; 1295 while (rcv_len >= (int)sizeof(*h)) { 1296 len = h->nlmsg_len; 1297 rem_len = len - sizeof(*h); 1298 1299 if (rem_len < 0 || len > rcv_len) { 1300 if (nlmsg.msg_flags & MSG_TRUNC) { 1301 fprintf(stderr, "%s: truncated message\n", 1302 __func__); 1303 ret = -EIO; 1304 goto out; 1305 } 1306 fprintf(stderr, "%s: malformed message: len=%d\n", 1307 __func__, len); 1308 ret = -EIO; 1309 goto out; 1310 } 1311 1312 if (h->nlmsg_type == NLMSG_DONE) { 1313 ret = 0; 1314 goto out; 1315 } 1316 1317 if (h->nlmsg_type == NLMSG_ERROR) { 1318 err = (struct nlmsgerr *)NLMSG_DATA(h); 1319 if (rem_len < (int)sizeof(struct nlmsgerr)) { 1320 fprintf(stderr, "%s: ERROR truncated\n", 1321 __func__); 1322 ret = -EIO; 1323 goto out; 1324 } 1325 1326 if (err->error) { 1327 fprintf(stderr, "%s: (%d) %s\n", 1328 __func__, err->error, 1329 strerror(-err->error)); 1330 ret = err->error; 1331 goto out; 1332 } 1333 1334 ret = 0; 1335 if (cb) { 1336 int r = cb(h, arg_cb); 1337 1338 if (r <= 0) 1339 ret = r; 1340 } 1341 goto out; 1342 } 1343 1344 if (cb) { 1345 int r = cb(h, arg_cb); 1346 1347 if (r <= 0) { 1348 ret = r; 1349 goto out; 1350 } 1351 } else { 1352 fprintf(stderr, "%s: RTNL: unexpected reply\n", 1353 __func__); 1354 } 1355 1356 rcv_len -= NLMSG_ALIGN(len); 1357 h = (struct nlmsghdr *)((uint8_t *)h + 1358 NLMSG_ALIGN(len)); 1359 } 1360 1361 if (nlmsg.msg_flags & MSG_TRUNC) { 1362 fprintf(stderr, "%s: message truncated\n", __func__); 1363 continue; 1364 } 1365 1366 if (rcv_len) { 1367 fprintf(stderr, "%s: rtnl: %d not parsed bytes\n", 1368 __func__, rcv_len); 1369 ret = -1; 1370 goto out; 1371 } 1372 } 1373 out: 1374 close(fd); 1375 1376 return ret; 1377 } 1378 1379 struct ovpn_link_req { 1380 struct nlmsghdr n; 1381 struct ifinfomsg i; 1382 char buf[256]; 1383 }; 1384 1385 static int ovpn_new_iface(struct ovpn_ctx *ovpn) 1386 { 1387 struct rtattr *linkinfo, *data; 1388 struct ovpn_link_req req = { 0 }; 1389 int ret = -1; 1390 1391 fprintf(stdout, "Creating interface %s with mode %u\n", ovpn->ifname, 1392 ovpn->mode); 1393 1394 req.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.i)); 1395 req.n.nlmsg_flags = NLM_F_REQUEST | NLM_F_CREATE | NLM_F_EXCL; 1396 req.n.nlmsg_type = RTM_NEWLINK; 1397 1398 if (ovpn_addattr(&req.n, sizeof(req), IFLA_IFNAME, ovpn->ifname, 1399 strlen(ovpn->ifname) + 1) < 0) 1400 goto err; 1401 1402 linkinfo = ovpn_nest_start(&req.n, sizeof(req), IFLA_LINKINFO); 1403 if (!linkinfo) 1404 goto err; 1405 1406 if (ovpn_addattr(&req.n, sizeof(req), IFLA_INFO_KIND, OVPN_FAMILY_NAME, 1407 strlen(OVPN_FAMILY_NAME) + 1) < 0) 1408 goto err; 1409 1410 if (ovpn->mode_set) { 1411 data = ovpn_nest_start(&req.n, sizeof(req), IFLA_INFO_DATA); 1412 if (!data) 1413 goto err; 1414 1415 if (ovpn_addattr(&req.n, sizeof(req), IFLA_OVPN_MODE, 1416 &ovpn->mode, sizeof(uint8_t)) < 0) 1417 goto err; 1418 1419 ovpn_nest_end(&req.n, data); 1420 } 1421 1422 ovpn_nest_end(&req.n, linkinfo); 1423 1424 req.i.ifi_family = AF_PACKET; 1425 1426 ret = ovpn_rt_send(&req.n, 0, 0, NULL, NULL); 1427 err: 1428 return ret; 1429 } 1430 1431 static int ovpn_del_iface(struct ovpn_ctx *ovpn) 1432 { 1433 struct ovpn_link_req req = { 0 }; 1434 1435 fprintf(stdout, "Deleting interface %s ifindex %u\n", ovpn->ifname, 1436 ovpn->ifindex); 1437 1438 req.n.nlmsg_len = NLMSG_LENGTH(sizeof(req.i)); 1439 req.n.nlmsg_flags = NLM_F_REQUEST; 1440 req.n.nlmsg_type = RTM_DELLINK; 1441 1442 req.i.ifi_family = AF_PACKET; 1443 req.i.ifi_index = ovpn->ifindex; 1444 1445 return ovpn_rt_send(&req.n, 0, 0, NULL, NULL); 1446 } 1447 1448 static int nl_seq_check(struct nl_msg (*msg)__always_unused, 1449 void (*arg)__always_unused) 1450 { 1451 return NL_OK; 1452 } 1453 1454 struct mcast_handler_args { 1455 const char *group; 1456 int id; 1457 }; 1458 1459 static int mcast_family_handler(struct nl_msg *msg, void *arg) 1460 { 1461 struct mcast_handler_args *grp = arg; 1462 struct nlattr *tb[CTRL_ATTR_MAX + 1]; 1463 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); 1464 struct nlattr *mcgrp; 1465 int rem_mcgrp; 1466 1467 nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0), 1468 genlmsg_attrlen(gnlh, 0), NULL); 1469 1470 if (!tb[CTRL_ATTR_MCAST_GROUPS]) 1471 return NL_SKIP; 1472 1473 nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], rem_mcgrp) { 1474 struct nlattr *tb_mcgrp[CTRL_ATTR_MCAST_GRP_MAX + 1]; 1475 1476 nla_parse(tb_mcgrp, CTRL_ATTR_MCAST_GRP_MAX, 1477 nla_data(mcgrp), nla_len(mcgrp), NULL); 1478 1479 if (!tb_mcgrp[CTRL_ATTR_MCAST_GRP_NAME] || 1480 !tb_mcgrp[CTRL_ATTR_MCAST_GRP_ID]) 1481 continue; 1482 if (strncmp(nla_data(tb_mcgrp[CTRL_ATTR_MCAST_GRP_NAME]), 1483 grp->group, nla_len(tb_mcgrp[CTRL_ATTR_MCAST_GRP_NAME]))) 1484 continue; 1485 grp->id = nla_get_u32(tb_mcgrp[CTRL_ATTR_MCAST_GRP_ID]); 1486 break; 1487 } 1488 1489 return NL_SKIP; 1490 } 1491 1492 static int mcast_error_handler(struct sockaddr_nl (*nla)__always_unused, 1493 struct nlmsgerr *err, void *arg) 1494 { 1495 int *ret = arg; 1496 1497 *ret = err->error; 1498 return NL_STOP; 1499 } 1500 1501 static int mcast_ack_handler(struct nl_msg (*msg)__always_unused, void *arg) 1502 { 1503 int *ret = arg; 1504 1505 *ret = 0; 1506 return NL_STOP; 1507 } 1508 1509 static int ovpn_handle_msg(struct nl_msg *msg, void *arg) 1510 { 1511 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); 1512 struct nlattr *attrs[OVPN_A_MAX + 1]; 1513 struct nlmsghdr *nlh = nlmsg_hdr(msg); 1514 char ifname[IF_NAMESIZE]; 1515 int *ret = arg; 1516 __u32 ifindex; 1517 1518 fprintf(stderr, "received message from ovpn-dco\n"); 1519 1520 *ret = -1; 1521 1522 if (!genlmsg_valid_hdr(nlh, 0)) { 1523 fprintf(stderr, "invalid header\n"); 1524 return NL_STOP; 1525 } 1526 1527 if (nla_parse(attrs, OVPN_A_MAX, genlmsg_attrdata(gnlh, 0), 1528 genlmsg_attrlen(gnlh, 0), NULL)) { 1529 fprintf(stderr, "received bogus data from ovpn-dco\n"); 1530 return NL_STOP; 1531 } 1532 1533 if (!attrs[OVPN_A_IFINDEX]) { 1534 fprintf(stderr, "no ifindex in this message\n"); 1535 return NL_STOP; 1536 } 1537 1538 ifindex = nla_get_u32(attrs[OVPN_A_IFINDEX]); 1539 if (!if_indextoname(ifindex, ifname)) { 1540 fprintf(stderr, "cannot resolve ifname for ifindex: %u\n", 1541 ifindex); 1542 return NL_STOP; 1543 } 1544 1545 switch (gnlh->cmd) { 1546 case OVPN_CMD_PEER_DEL_NTF: 1547 fprintf(stdout, "received CMD_PEER_DEL_NTF\n"); 1548 break; 1549 case OVPN_CMD_PEER_FLOAT_NTF: 1550 fprintf(stdout, "received CMD_PEER_FLOAT_NTF\n"); 1551 break; 1552 case OVPN_CMD_KEY_SWAP_NTF: 1553 fprintf(stdout, "received CMD_KEY_SWAP_NTF\n"); 1554 break; 1555 default: 1556 fprintf(stderr, "received unknown command: %d\n", gnlh->cmd); 1557 return NL_STOP; 1558 } 1559 1560 *ret = 0; 1561 return NL_OK; 1562 } 1563 1564 static int ovpn_get_mcast_id(struct nl_sock *sock, const char *family, 1565 const char *group) 1566 { 1567 struct nl_msg *msg; 1568 struct nl_cb *cb; 1569 int ret, ctrlid; 1570 struct mcast_handler_args grp = { 1571 .group = group, 1572 .id = -ENOENT, 1573 }; 1574 1575 msg = nlmsg_alloc(); 1576 if (!msg) 1577 return -ENOMEM; 1578 1579 cb = nl_cb_alloc(NL_CB_DEFAULT); 1580 if (!cb) { 1581 ret = -ENOMEM; 1582 goto out_fail_cb; 1583 } 1584 1585 ctrlid = genl_ctrl_resolve(sock, "nlctrl"); 1586 1587 genlmsg_put(msg, 0, 0, ctrlid, 0, 0, CTRL_CMD_GETFAMILY, 0); 1588 1589 ret = -ENOBUFS; 1590 NLA_PUT_STRING(msg, CTRL_ATTR_FAMILY_NAME, family); 1591 1592 ret = nl_send_auto_complete(sock, msg); 1593 if (ret < 0) 1594 goto nla_put_failure; 1595 1596 ret = 1; 1597 1598 nl_cb_err(cb, NL_CB_CUSTOM, mcast_error_handler, &ret); 1599 nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, mcast_ack_handler, &ret); 1600 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, mcast_family_handler, &grp); 1601 1602 while (ret > 0) 1603 nl_recvmsgs(sock, cb); 1604 1605 if (ret == 0) 1606 ret = grp.id; 1607 nla_put_failure: 1608 nl_cb_put(cb); 1609 out_fail_cb: 1610 nlmsg_free(msg); 1611 return ret; 1612 } 1613 1614 static int ovpn_listen_mcast(void) 1615 { 1616 struct nl_sock *sock; 1617 struct nl_cb *cb; 1618 int mcid, ret; 1619 1620 sock = nl_socket_alloc(); 1621 if (!sock) { 1622 fprintf(stderr, "cannot allocate netlink socket\n"); 1623 ret = -ENOMEM; 1624 goto err_free; 1625 } 1626 1627 nl_socket_set_buffer_size(sock, 8192, 8192); 1628 1629 ret = genl_connect(sock); 1630 if (ret < 0) { 1631 fprintf(stderr, "cannot connect to generic netlink: %s\n", 1632 nl_geterror(ret)); 1633 goto err_free; 1634 } 1635 1636 mcid = ovpn_get_mcast_id(sock, OVPN_FAMILY_NAME, OVPN_MCGRP_PEERS); 1637 if (mcid < 0) { 1638 fprintf(stderr, "cannot get mcast group: %s\n", 1639 nl_geterror(mcid)); 1640 goto err_free; 1641 } 1642 1643 ret = nl_socket_add_membership(sock, mcid); 1644 if (ret) { 1645 fprintf(stderr, "failed to join mcast group: %d\n", ret); 1646 goto err_free; 1647 } 1648 1649 ret = 1; 1650 cb = nl_cb_alloc(NL_CB_DEFAULT); 1651 nl_cb_set(cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM, nl_seq_check, NULL); 1652 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, ovpn_handle_msg, &ret); 1653 nl_cb_err(cb, NL_CB_CUSTOM, ovpn_nl_cb_error, &ret); 1654 1655 while (ret == 1) { 1656 int err = nl_recvmsgs(sock, cb); 1657 1658 if (err < 0) { 1659 fprintf(stderr, 1660 "cannot receive netlink message: (%d) %s\n", 1661 err, nl_geterror(-err)); 1662 ret = -1; 1663 break; 1664 } 1665 } 1666 1667 nl_cb_put(cb); 1668 err_free: 1669 nl_socket_free(sock); 1670 return ret; 1671 } 1672 1673 static void usage(const char *cmd) 1674 { 1675 fprintf(stderr, 1676 "Usage %s <command> <iface> [arguments..]\n", 1677 cmd); 1678 fprintf(stderr, "where <command> can be one of the following\n\n"); 1679 1680 fprintf(stderr, "* new_iface <iface> [mode]: create new ovpn interface\n"); 1681 fprintf(stderr, "\tiface: ovpn interface name\n"); 1682 fprintf(stderr, "\tmode:\n"); 1683 fprintf(stderr, "\t\t- P2P for peer-to-peer mode (i.e. client)\n"); 1684 fprintf(stderr, "\t\t- MP for multi-peer mode (i.e. server)\n"); 1685 1686 fprintf(stderr, "* del_iface <iface>: delete ovpn interface\n"); 1687 fprintf(stderr, "\tiface: ovpn interface name\n"); 1688 1689 fprintf(stderr, 1690 "* listen <iface> <lport> <id_type> <peers_file> [ipv6]: listen for incoming peer TCP connections\n"); 1691 fprintf(stderr, "\tiface: ovpn interface name\n"); 1692 fprintf(stderr, "\tlport: TCP port to listen to\n"); 1693 fprintf(stderr, "\tid_type:\n"); 1694 fprintf(stderr, 1695 "\t\t- SYMM for ignoring the TX peer ID from the peers_file\n"); 1696 fprintf(stderr, 1697 "\t\t- ASYMM for using the TX peer ID from the peers_file\n"); 1698 fprintf(stderr, 1699 "\tpeers_file: file containing one peer per line: Line format:\n"); 1700 fprintf(stderr, "\t\t<peer_id> <tx_id> <vpnaddr>\n"); 1701 fprintf(stderr, 1702 "\tipv6: whether the socket should listen to the IPv6 wildcard address\n"); 1703 1704 fprintf(stderr, 1705 "* connect <iface> <peer_id> <tx_id> <raddr> <rport> [key_file]: start connecting peer of TCP-based VPN session\n"); 1706 fprintf(stderr, "\tiface: ovpn interface name\n"); 1707 fprintf(stderr, 1708 "\tpeer_id: peer ID found in data packets received from this peer\n"); 1709 fprintf(stderr, 1710 "\ttx_id: peer ID to be used when sending to this peer, 'none' for symmetric peer ID\n"); 1711 fprintf(stderr, "\traddr: peer IP address to connect to\n"); 1712 fprintf(stderr, "\trport: peer TCP port to connect to\n"); 1713 fprintf(stderr, 1714 "\tkey_file: file containing the symmetric key for encryption\n"); 1715 1716 fprintf(stderr, 1717 "* new_peer <iface> <peer_id> <tx_id> <lport> <raddr> <rport> [vpnaddr]: add new peer\n"); 1718 fprintf(stderr, "\tiface: ovpn interface name\n"); 1719 fprintf(stderr, 1720 "\tpeer_id: peer ID found in data packets received from this peer\n"); 1721 fprintf(stderr, 1722 "\ttx_id: peer ID to be used when sending to this peer, 'none' for symmetric peer ID\n"); 1723 fprintf(stderr, "\tlport: local UDP port to bind to\n"); 1724 fprintf(stderr, "\traddr: peer IP address\n"); 1725 fprintf(stderr, "\trport: peer UDP port\n"); 1726 fprintf(stderr, "\tvpnaddr: peer VPN IP\n"); 1727 1728 fprintf(stderr, 1729 "* new_multi_peer <iface> <lport> <id_type> <peers_file> [mark]: add multiple peers as listed in the file\n"); 1730 fprintf(stderr, "\tiface: ovpn interface name\n"); 1731 fprintf(stderr, "\tlport: local UDP port to bind to\n"); 1732 fprintf(stderr, "\tid_type:\n"); 1733 fprintf(stderr, 1734 "\t\t- SYMM for ignoring the TX peer ID from the peers_file\n"); 1735 fprintf(stderr, 1736 "\t\t- ASYMM for using the TX peer ID from the peers_file\n"); 1737 fprintf(stderr, 1738 "\tpeers_file: text file containing one peer per line. Line format:\n"); 1739 fprintf(stderr, 1740 "\t\t<peer_id> <tx_id> <raddr> <rport> <laddr> <lport> <vpnaddr>\n"); 1741 fprintf(stderr, "\tmark: socket FW mark value\n"); 1742 1743 fprintf(stderr, 1744 "* set_peer <iface> <peer_id> <keepalive_interval> <keepalive_timeout> [vpnaddr]: set peer attributes\n"); 1745 fprintf(stderr, "\tiface: ovpn interface name\n"); 1746 fprintf(stderr, "\tpeer_id: peer ID of the peer to modify\n"); 1747 fprintf(stderr, 1748 "\tkeepalive_interval: interval for sending ping messages\n"); 1749 fprintf(stderr, 1750 "\tkeepalive_timeout: time after which a peer is timed out\n"); 1751 fprintf(stderr, "\tvpnaddr: peer VPN IP\n"); 1752 1753 fprintf(stderr, "* del_peer <iface> <peer_id>: delete peer\n"); 1754 fprintf(stderr, "\tiface: ovpn interface name\n"); 1755 fprintf(stderr, "\tpeer_id: peer ID of the peer to delete\n"); 1756 1757 fprintf(stderr, "* get_peer <iface> [peer_id]: retrieve peer(s) status\n"); 1758 fprintf(stderr, "\tiface: ovpn interface name\n"); 1759 fprintf(stderr, 1760 "\tpeer_id: peer ID of the peer to query. All peers are returned if omitted\n"); 1761 1762 fprintf(stderr, 1763 "* new_key <iface> <peer_id> <slot> <key_id> <cipher> <key_dir> <key_file>: set data channel key\n"); 1764 fprintf(stderr, "\tiface: ovpn interface name\n"); 1765 fprintf(stderr, 1766 "\tpeer_id: peer ID of the peer to configure the key for\n"); 1767 fprintf(stderr, "\tslot: either 1 (primary) or 2 (secondary)\n"); 1768 fprintf(stderr, "\tkey_id: an ID from 0 to 7\n"); 1769 fprintf(stderr, 1770 "\tcipher: cipher to use, supported: aes (AES-GCM), chachapoly (CHACHA20POLY1305)\n"); 1771 fprintf(stderr, 1772 "\tkey_dir: key direction, must 0 on one host and 1 on the other\n"); 1773 fprintf(stderr, "\tkey_file: file containing the pre-shared key\n"); 1774 1775 fprintf(stderr, 1776 "* del_key <iface> <peer_id> [slot]: erase existing data channel key\n"); 1777 fprintf(stderr, "\tiface: ovpn interface name\n"); 1778 fprintf(stderr, "\tpeer_id: peer ID of the peer to modify\n"); 1779 fprintf(stderr, "\tslot: slot to erase. PRIMARY if omitted\n"); 1780 1781 fprintf(stderr, 1782 "* get_key <iface> <peer_id> <slot>: retrieve non sensible key data\n"); 1783 fprintf(stderr, "\tiface: ovpn interface name\n"); 1784 fprintf(stderr, "\tpeer_id: peer ID of the peer to query\n"); 1785 fprintf(stderr, "\tslot: either 1 (primary) or 2 (secondary)\n"); 1786 1787 fprintf(stderr, 1788 "* swap_keys <iface> <peer_id>: swap content of primary and secondary key slots\n"); 1789 fprintf(stderr, "\tiface: ovpn interface name\n"); 1790 fprintf(stderr, "\tpeer_id: peer ID of the peer to modify\n"); 1791 1792 fprintf(stderr, 1793 "* listen_mcast: listen to ovpn netlink multicast messages\n"); 1794 } 1795 1796 static int ovpn_parse_remote(struct ovpn_ctx *ovpn, const char *host, 1797 const char *service, const char *vpnip) 1798 { 1799 int ret; 1800 struct addrinfo *result = NULL; 1801 struct addrinfo hints = { 1802 .ai_family = ovpn->sa_family, 1803 .ai_socktype = SOCK_DGRAM, 1804 .ai_protocol = IPPROTO_UDP 1805 }; 1806 1807 if (host) { 1808 ret = getaddrinfo(host, service, &hints, &result); 1809 if (ret) { 1810 fprintf(stderr, "getaddrinfo on remote error: %s\n", 1811 gai_strerror(ret)); 1812 return -1; 1813 } 1814 1815 if (!(result->ai_family == AF_INET && 1816 result->ai_addrlen == sizeof(struct sockaddr_in)) && 1817 !(result->ai_family == AF_INET6 && 1818 result->ai_addrlen == sizeof(struct sockaddr_in6))) { 1819 ret = -EINVAL; 1820 goto out; 1821 } 1822 1823 memcpy(&ovpn->remote, result->ai_addr, result->ai_addrlen); 1824 freeaddrinfo(result); 1825 result = NULL; 1826 } 1827 1828 if (vpnip) { 1829 ret = getaddrinfo(vpnip, NULL, &hints, &result); 1830 if (ret) { 1831 fprintf(stderr, "getaddrinfo on vpnip error: %s\n", 1832 gai_strerror(ret)); 1833 return -1; 1834 } 1835 1836 if (!(result->ai_family == AF_INET && 1837 result->ai_addrlen == sizeof(struct sockaddr_in)) && 1838 !(result->ai_family == AF_INET6 && 1839 result->ai_addrlen == sizeof(struct sockaddr_in6))) { 1840 ret = -EINVAL; 1841 goto out; 1842 } 1843 1844 memcpy(&ovpn->peer_ip, result->ai_addr, result->ai_addrlen); 1845 ovpn->sa_family = result->ai_family; 1846 1847 ovpn->peer_ip_set = true; 1848 } 1849 1850 ret = 0; 1851 out: 1852 freeaddrinfo(result); 1853 return ret; 1854 } 1855 1856 static int ovpn_parse_new_peer(struct ovpn_ctx *ovpn, const char *peer_id, 1857 const char *tx_id, const char *raddr, 1858 const char *rport, const char *vpnip) 1859 { 1860 ovpn->peer_id = strtoul(peer_id, NULL, 10); 1861 if (errno == ERANGE || ovpn->peer_id > PEER_ID_UNDEF) { 1862 fprintf(stderr, "rx peer ID value out of range\n"); 1863 return -1; 1864 } 1865 1866 if (ovpn->asymm_id) { 1867 ovpn->tx_id = strtoul(tx_id, NULL, 10); 1868 if (errno == ERANGE || ovpn->tx_id > PEER_ID_UNDEF) { 1869 fprintf(stderr, "tx peer ID value out of range\n"); 1870 return -1; 1871 } 1872 } 1873 1874 return ovpn_parse_remote(ovpn, raddr, rport, vpnip); 1875 } 1876 1877 static int ovpn_parse_key_slot(const char *arg, struct ovpn_ctx *ovpn) 1878 { 1879 int slot = strtoul(arg, NULL, 10); 1880 1881 if (errno == ERANGE || slot < 1 || slot > 2) { 1882 fprintf(stderr, "key slot out of range\n"); 1883 return -1; 1884 } 1885 1886 switch (slot) { 1887 case 1: 1888 ovpn->key_slot = OVPN_KEY_SLOT_PRIMARY; 1889 break; 1890 case 2: 1891 ovpn->key_slot = OVPN_KEY_SLOT_SECONDARY; 1892 break; 1893 } 1894 1895 return 0; 1896 } 1897 1898 static int ovpn_send_tcp_data(int socket) 1899 { 1900 uint16_t len = htons(1000); 1901 uint8_t buf[1002]; 1902 int ret; 1903 1904 memcpy(buf, &len, sizeof(len)); 1905 memset(buf + sizeof(len), 0x86, sizeof(buf) - sizeof(len)); 1906 1907 ret = send(socket, buf, sizeof(buf), MSG_NOSIGNAL); 1908 1909 fprintf(stdout, "Sent %u bytes over TCP socket\n", ret); 1910 1911 return ret > 0 ? 0 : ret; 1912 } 1913 1914 static int ovpn_recv_tcp_data(int socket) 1915 { 1916 uint8_t buf[1002]; 1917 uint16_t len; 1918 int ret; 1919 1920 ret = recv(socket, buf, sizeof(buf), MSG_NOSIGNAL); 1921 1922 if (ret < 2) { 1923 fprintf(stderr, ">>>> Error while reading TCP data: %d\n", ret); 1924 return ret; 1925 } 1926 1927 memcpy(&len, buf, sizeof(len)); 1928 len = ntohs(len); 1929 1930 fprintf(stdout, ">>>> Received %u bytes over TCP socket, header: %u\n", 1931 ret, len); 1932 1933 return 0; 1934 } 1935 1936 static enum ovpn_cmd ovpn_parse_cmd(const char *cmd) 1937 { 1938 if (!strcmp(cmd, "new_iface")) 1939 return CMD_NEW_IFACE; 1940 1941 if (!strcmp(cmd, "del_iface")) 1942 return CMD_DEL_IFACE; 1943 1944 if (!strcmp(cmd, "listen")) 1945 return CMD_LISTEN; 1946 1947 if (!strcmp(cmd, "connect")) 1948 return CMD_CONNECT; 1949 1950 if (!strcmp(cmd, "new_peer")) 1951 return CMD_NEW_PEER; 1952 1953 if (!strcmp(cmd, "new_multi_peer")) 1954 return CMD_NEW_MULTI_PEER; 1955 1956 if (!strcmp(cmd, "set_peer")) 1957 return CMD_SET_PEER; 1958 1959 if (!strcmp(cmd, "del_peer")) 1960 return CMD_DEL_PEER; 1961 1962 if (!strcmp(cmd, "get_peer")) 1963 return CMD_GET_PEER; 1964 1965 if (!strcmp(cmd, "new_key")) 1966 return CMD_NEW_KEY; 1967 1968 if (!strcmp(cmd, "del_key")) 1969 return CMD_DEL_KEY; 1970 1971 if (!strcmp(cmd, "get_key")) 1972 return CMD_GET_KEY; 1973 1974 if (!strcmp(cmd, "swap_keys")) 1975 return CMD_SWAP_KEYS; 1976 1977 if (!strcmp(cmd, "listen_mcast")) 1978 return CMD_LISTEN_MCAST; 1979 1980 return CMD_INVALID; 1981 } 1982 1983 /* Send process to background and waits for signal. 1984 * 1985 * This helper is called at the end of commands 1986 * creating sockets, so that the latter stay alive 1987 * along with the process that created them. 1988 * 1989 * A signal is expected to be delivered in order to 1990 * terminate the waiting processes 1991 */ 1992 static void ovpn_waitbg(void) 1993 { 1994 daemon(1, 1); 1995 pause(); 1996 } 1997 1998 static int ovpn_run_cmd(struct ovpn_ctx *ovpn) 1999 { 2000 char peer_id[10], tx_id[10], vpnip[INET6_ADDRSTRLEN], laddr[128]; 2001 char lport[10], raddr[128], rport[10]; 2002 int n, ret; 2003 FILE *fp; 2004 2005 switch (ovpn->cmd) { 2006 case CMD_NEW_IFACE: 2007 ret = ovpn_new_iface(ovpn); 2008 break; 2009 case CMD_DEL_IFACE: 2010 ret = ovpn_del_iface(ovpn); 2011 break; 2012 case CMD_LISTEN: 2013 ret = ovpn_listen(ovpn, ovpn->sa_family); 2014 if (ret < 0) { 2015 fprintf(stderr, "cannot listen on TCP socket\n"); 2016 return ret; 2017 } 2018 2019 fp = fopen(ovpn->peers_file, "r"); 2020 if (!fp) { 2021 fprintf(stderr, "cannot open file: %s\n", 2022 ovpn->peers_file); 2023 return -1; 2024 } 2025 2026 int num_peers = 0; 2027 2028 while ((n = fscanf(fp, "%s %s %s\n", peer_id, tx_id, 2029 vpnip)) == 3) { 2030 struct ovpn_ctx peer_ctx = { 0 }; 2031 2032 if (num_peers == MAX_PEERS) { 2033 fprintf(stderr, "max peers reached!\n"); 2034 return -E2BIG; 2035 } 2036 2037 peer_ctx.ifindex = ovpn->ifindex; 2038 peer_ctx.sa_family = ovpn->sa_family; 2039 peer_ctx.asymm_id = ovpn->asymm_id; 2040 2041 peer_ctx.socket = ovpn_accept(ovpn); 2042 if (peer_ctx.socket < 0) { 2043 fprintf(stderr, "cannot accept connection!\n"); 2044 return -1; 2045 } 2046 2047 /* store peer sockets to test TCP I/O */ 2048 ovpn->cli_sockets[num_peers] = peer_ctx.socket; 2049 2050 ret = ovpn_parse_new_peer(&peer_ctx, peer_id, tx_id, 2051 NULL, NULL, vpnip); 2052 if (ret < 0) { 2053 fprintf(stderr, "error while parsing line\n"); 2054 return -1; 2055 } 2056 2057 ret = ovpn_new_peer(&peer_ctx, true); 2058 if (ret < 0) { 2059 fprintf(stderr, 2060 "cannot add peer to VPN: %s %s\n", 2061 peer_id, vpnip); 2062 return ret; 2063 } 2064 num_peers++; 2065 } 2066 2067 for (int i = 0; i < num_peers; i++) { 2068 ret = ovpn_recv_tcp_data(ovpn->cli_sockets[i]); 2069 if (ret < 0) 2070 break; 2071 } 2072 ovpn_waitbg(); 2073 break; 2074 case CMD_CONNECT: 2075 ret = ovpn_connect(ovpn); 2076 if (ret < 0) { 2077 fprintf(stderr, "cannot connect TCP socket\n"); 2078 return ret; 2079 } 2080 2081 ret = ovpn_new_peer(ovpn, true); 2082 if (ret < 0) { 2083 fprintf(stderr, "cannot add peer to VPN\n"); 2084 close(ovpn->socket); 2085 return ret; 2086 } 2087 2088 if (ovpn->cipher != OVPN_CIPHER_ALG_NONE) { 2089 ret = ovpn_new_key(ovpn); 2090 if (ret < 0) { 2091 fprintf(stderr, "cannot set key\n"); 2092 return ret; 2093 } 2094 } 2095 2096 ret = ovpn_send_tcp_data(ovpn->socket); 2097 ovpn_waitbg(); 2098 break; 2099 case CMD_NEW_PEER: 2100 ret = ovpn_udp_socket(ovpn, AF_INET6); 2101 if (ret < 0) 2102 return ret; 2103 2104 ret = ovpn_new_peer(ovpn, false); 2105 if (ret < 0) 2106 return ret; 2107 ovpn_waitbg(); 2108 break; 2109 case CMD_NEW_MULTI_PEER: 2110 ret = ovpn_udp_socket(ovpn, AF_INET6); 2111 if (ret < 0) 2112 return ret; 2113 2114 fp = fopen(ovpn->peers_file, "r"); 2115 if (!fp) { 2116 fprintf(stderr, "cannot open file: %s\n", 2117 ovpn->peers_file); 2118 return -1; 2119 } 2120 2121 while ((n = fscanf(fp, "%s %s %s %s %s %s %s\n", peer_id, tx_id, 2122 laddr, lport, raddr, rport, vpnip)) == 7) { 2123 struct ovpn_ctx peer_ctx = { 0 }; 2124 2125 peer_ctx.ifindex = ovpn->ifindex; 2126 peer_ctx.socket = ovpn->socket; 2127 peer_ctx.sa_family = AF_UNSPEC; 2128 peer_ctx.asymm_id = ovpn->asymm_id; 2129 2130 ret = ovpn_parse_new_peer(&peer_ctx, peer_id, tx_id, 2131 raddr, rport, vpnip); 2132 if (ret < 0) { 2133 fprintf(stderr, "error while parsing line\n"); 2134 return -1; 2135 } 2136 2137 ret = ovpn_new_peer(&peer_ctx, false); 2138 if (ret < 0) { 2139 fprintf(stderr, 2140 "cannot add peer to VPN: %s %s %s %s\n", 2141 peer_id, raddr, rport, vpnip); 2142 return ret; 2143 } 2144 } 2145 ovpn_waitbg(); 2146 break; 2147 case CMD_SET_PEER: 2148 ret = ovpn_set_peer(ovpn); 2149 break; 2150 case CMD_DEL_PEER: 2151 ret = ovpn_del_peer(ovpn); 2152 break; 2153 case CMD_GET_PEER: 2154 if (ovpn->peer_id == PEER_ID_UNDEF) 2155 fprintf(stderr, "List of peers connected to: %s\n", 2156 ovpn->ifname); 2157 2158 ret = ovpn_get_peer(ovpn); 2159 break; 2160 case CMD_NEW_KEY: 2161 ret = ovpn_new_key(ovpn); 2162 break; 2163 case CMD_DEL_KEY: 2164 ret = ovpn_del_key(ovpn); 2165 break; 2166 case CMD_GET_KEY: 2167 ret = ovpn_get_key(ovpn); 2168 break; 2169 case CMD_SWAP_KEYS: 2170 ret = ovpn_swap_keys(ovpn); 2171 break; 2172 case CMD_LISTEN_MCAST: 2173 ret = ovpn_listen_mcast(); 2174 break; 2175 case CMD_INVALID: 2176 ret = -EINVAL; 2177 break; 2178 } 2179 2180 return ret; 2181 } 2182 2183 static int ovpn_parse_cmd_args(struct ovpn_ctx *ovpn, int argc, char *argv[]) 2184 { 2185 int ret; 2186 2187 /* no args required for LISTEN_MCAST */ 2188 if (ovpn->cmd == CMD_LISTEN_MCAST) 2189 return 0; 2190 2191 /* all commands need an ifname */ 2192 if (argc < 3) 2193 return -EINVAL; 2194 2195 strscpy(ovpn->ifname, argv[2], IFNAMSIZ - 1); 2196 ovpn->ifname[IFNAMSIZ - 1] = '\0'; 2197 2198 /* all commands, except NEW_IFNAME, needs an ifindex */ 2199 if (ovpn->cmd != CMD_NEW_IFACE) { 2200 ovpn->ifindex = if_nametoindex(ovpn->ifname); 2201 if (!ovpn->ifindex) { 2202 fprintf(stderr, "cannot find interface: %s\n", 2203 strerror(errno)); 2204 return -1; 2205 } 2206 } 2207 2208 switch (ovpn->cmd) { 2209 case CMD_NEW_IFACE: 2210 if (argc < 4) 2211 break; 2212 2213 if (!strcmp(argv[3], "P2P")) { 2214 ovpn->mode = OVPN_MODE_P2P; 2215 } else if (!strcmp(argv[3], "MP")) { 2216 ovpn->mode = OVPN_MODE_MP; 2217 } else { 2218 fprintf(stderr, "Cannot parse iface mode: %s\n", 2219 argv[3]); 2220 return -1; 2221 } 2222 ovpn->mode_set = true; 2223 break; 2224 case CMD_DEL_IFACE: 2225 break; 2226 case CMD_LISTEN: 2227 if (argc < 6) 2228 return -EINVAL; 2229 2230 ovpn->lport = strtoul(argv[3], NULL, 10); 2231 if (errno == ERANGE || ovpn->lport > 65535) { 2232 fprintf(stderr, "lport value out of range\n"); 2233 return -1; 2234 } 2235 2236 if (strcmp(argv[4], "SYMM") == 0) { 2237 ovpn->asymm_id = false; 2238 } else if (strcmp(argv[4], "ASYMM") == 0) { 2239 ovpn->asymm_id = true; 2240 } else { 2241 fprintf(stderr, "Cannot parse id type: %s\n", argv[4]); 2242 return -1; 2243 } 2244 2245 ovpn->peers_file = argv[5]; 2246 2247 ovpn->sa_family = AF_INET; 2248 if (argc > 6 && !strcmp(argv[6], "ipv6")) 2249 ovpn->sa_family = AF_INET6; 2250 break; 2251 case CMD_CONNECT: 2252 if (argc < 7) 2253 return -EINVAL; 2254 2255 ovpn->sa_family = AF_INET; 2256 ovpn->asymm_id = strcmp(argv[4], "none"); 2257 2258 ret = ovpn_parse_new_peer(ovpn, argv[3], argv[4], argv[5], 2259 argv[6], NULL); 2260 if (ret < 0) { 2261 fprintf(stderr, "Cannot parse remote peer data\n"); 2262 return -1; 2263 } 2264 2265 if (argc > 7) { 2266 ovpn->key_slot = OVPN_KEY_SLOT_PRIMARY; 2267 ovpn->key_id = 0; 2268 ovpn->cipher = OVPN_CIPHER_ALG_AES_GCM; 2269 ovpn->key_dir = KEY_DIR_OUT; 2270 2271 ret = ovpn_parse_key(argv[7], ovpn); 2272 if (ret) 2273 return -1; 2274 } 2275 break; 2276 case CMD_NEW_PEER: 2277 if (argc < 8) 2278 return -EINVAL; 2279 2280 ovpn->asymm_id = strcmp(argv[4], "none"); 2281 2282 ovpn->lport = strtoul(argv[5], NULL, 10); 2283 if (errno == ERANGE || ovpn->lport > 65535) { 2284 fprintf(stderr, "lport value out of range\n"); 2285 return -1; 2286 } 2287 2288 const char *vpnip = (argc > 8) ? argv[8] : NULL; 2289 2290 ret = ovpn_parse_new_peer(ovpn, argv[3], argv[4], argv[6], 2291 argv[7], vpnip); 2292 if (ret < 0) 2293 return -1; 2294 break; 2295 case CMD_NEW_MULTI_PEER: 2296 if (argc < 6) 2297 return -EINVAL; 2298 2299 ovpn->lport = strtoul(argv[3], NULL, 10); 2300 if (errno == ERANGE || ovpn->lport > 65535) { 2301 fprintf(stderr, "lport value out of range\n"); 2302 return -1; 2303 } 2304 2305 if (!strcmp(argv[4], "SYMM")) { 2306 ovpn->asymm_id = false; 2307 } else if (!strcmp(argv[4], "ASYMM")) { 2308 ovpn->asymm_id = true; 2309 } else { 2310 fprintf(stderr, "Cannot parse id type: %s\n", argv[4]); 2311 return -1; 2312 } 2313 2314 ovpn->peers_file = argv[5]; 2315 2316 ovpn->mark = 0; 2317 if (argc > 6) { 2318 ovpn->mark = strtoul(argv[6], NULL, 10); 2319 if (errno == ERANGE || ovpn->mark > UINT32_MAX) { 2320 fprintf(stderr, "mark value out of range\n"); 2321 return -1; 2322 } 2323 } 2324 break; 2325 case CMD_SET_PEER: 2326 if (argc < 6) 2327 return -EINVAL; 2328 2329 ovpn->peer_id = strtoul(argv[3], NULL, 10); 2330 if (errno == ERANGE || ovpn->peer_id > PEER_ID_UNDEF) { 2331 fprintf(stderr, "peer ID value out of range\n"); 2332 return -1; 2333 } 2334 2335 ovpn->keepalive_interval = strtoul(argv[4], NULL, 10); 2336 if (errno == ERANGE) { 2337 fprintf(stderr, 2338 "keepalive interval value out of range\n"); 2339 return -1; 2340 } 2341 2342 ovpn->keepalive_timeout = strtoul(argv[5], NULL, 10); 2343 if (errno == ERANGE) { 2344 fprintf(stderr, 2345 "keepalive interval value out of range\n"); 2346 return -1; 2347 } 2348 2349 if (argc > 6) { 2350 ret = ovpn_parse_remote(ovpn, NULL, NULL, argv[6]); 2351 if (ret < 0) 2352 return -1; 2353 } 2354 break; 2355 case CMD_DEL_PEER: 2356 if (argc < 4) 2357 return -EINVAL; 2358 2359 ovpn->peer_id = strtoul(argv[3], NULL, 10); 2360 if (errno == ERANGE || ovpn->peer_id > PEER_ID_UNDEF) { 2361 fprintf(stderr, "peer ID value out of range\n"); 2362 return -1; 2363 } 2364 break; 2365 case CMD_GET_PEER: 2366 ovpn->peer_id = PEER_ID_UNDEF; 2367 if (argc > 3) { 2368 ovpn->peer_id = strtoul(argv[3], NULL, 10); 2369 if (errno == ERANGE || ovpn->peer_id > PEER_ID_UNDEF) { 2370 fprintf(stderr, "peer ID value out of range\n"); 2371 return -1; 2372 } 2373 } 2374 break; 2375 case CMD_NEW_KEY: 2376 if (argc < 9) 2377 return -EINVAL; 2378 2379 ovpn->peer_id = strtoul(argv[3], NULL, 10); 2380 if (errno == ERANGE) { 2381 fprintf(stderr, "peer ID value out of range\n"); 2382 return -1; 2383 } 2384 2385 ret = ovpn_parse_key_slot(argv[4], ovpn); 2386 if (ret) 2387 return -1; 2388 2389 ovpn->key_id = strtoul(argv[5], NULL, 10); 2390 if (errno == ERANGE || ovpn->key_id > 2) { 2391 fprintf(stderr, "key ID out of range\n"); 2392 return -1; 2393 } 2394 2395 ret = ovpn_parse_cipher(argv[6], ovpn); 2396 if (ret < 0) 2397 return -1; 2398 2399 ret = ovpn_parse_key_direction(argv[7], ovpn); 2400 if (ret < 0) 2401 return -1; 2402 2403 ret = ovpn_parse_key(argv[8], ovpn); 2404 if (ret) 2405 return -1; 2406 break; 2407 case CMD_DEL_KEY: 2408 if (argc < 4) 2409 return -EINVAL; 2410 2411 ovpn->peer_id = strtoul(argv[3], NULL, 10); 2412 if (errno == ERANGE) { 2413 fprintf(stderr, "peer ID value out of range\n"); 2414 return -1; 2415 } 2416 2417 ret = ovpn_parse_key_slot(argv[4], ovpn); 2418 if (ret) 2419 return ret; 2420 break; 2421 case CMD_GET_KEY: 2422 if (argc < 5) 2423 return -EINVAL; 2424 2425 ovpn->peer_id = strtoul(argv[3], NULL, 10); 2426 if (errno == ERANGE) { 2427 fprintf(stderr, "peer ID value out of range\n"); 2428 return -1; 2429 } 2430 2431 ret = ovpn_parse_key_slot(argv[4], ovpn); 2432 if (ret) 2433 return ret; 2434 break; 2435 case CMD_SWAP_KEYS: 2436 if (argc < 4) 2437 return -EINVAL; 2438 2439 ovpn->peer_id = strtoul(argv[3], NULL, 10); 2440 if (errno == ERANGE) { 2441 fprintf(stderr, "peer ID value out of range\n"); 2442 return -1; 2443 } 2444 break; 2445 case CMD_LISTEN_MCAST: 2446 break; 2447 case CMD_INVALID: 2448 break; 2449 } 2450 2451 return 0; 2452 } 2453 2454 int main(int argc, char *argv[]) 2455 { 2456 struct ovpn_ctx ovpn; 2457 int ret; 2458 2459 if (argc < 2) { 2460 usage(argv[0]); 2461 return -1; 2462 } 2463 2464 memset(&ovpn, 0, sizeof(ovpn)); 2465 ovpn.sa_family = AF_UNSPEC; 2466 ovpn.cipher = OVPN_CIPHER_ALG_NONE; 2467 2468 ovpn.cmd = ovpn_parse_cmd(argv[1]); 2469 if (ovpn.cmd == CMD_INVALID) { 2470 fprintf(stderr, "Error: unknown command.\n\n"); 2471 usage(argv[0]); 2472 return -1; 2473 } 2474 2475 ret = ovpn_parse_cmd_args(&ovpn, argc, argv); 2476 if (ret < 0) { 2477 fprintf(stderr, "Error: invalid arguments.\n\n"); 2478 if (ret == -EINVAL) 2479 usage(argv[0]); 2480 return ret; 2481 } 2482 2483 ret = ovpn_run_cmd(&ovpn); 2484 if (ret) 2485 fprintf(stderr, "Cannot execute command: %s (%d)\n", 2486 strerror(-ret), ret); 2487 2488 return ret; 2489 } 2490