1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2021-2022 Rubicon Communications, LLC (Netgate)
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 *
27 */
28 #include "opt_inet.h"
29 #include "opt_inet6.h"
30
31 #include <sys/param.h>
32 #include <sys/systm.h>
33 #include <sys/buf_ring.h>
34 #include <sys/epoch.h>
35 #include <sys/file.h>
36 #include <sys/filedesc.h>
37 #include <sys/kernel.h>
38 #include <sys/malloc.h>
39 #include <sys/mbuf.h>
40 #include <sys/module.h>
41 #include <sys/nv.h>
42 #include <sys/priv.h>
43 #include <sys/protosw.h>
44 #include <sys/rmlock.h>
45 #include <sys/sdt.h>
46 #include <sys/smp.h>
47 #include <sys/socket.h>
48 #include <sys/socketvar.h>
49 #include <sys/sockio.h>
50 #include <sys/sysctl.h>
51 #include <sys/time.h>
52
53 #include <machine/atomic.h>
54
55 #include <net/bpf.h>
56 #include <net/if.h>
57 #include <net/if_clone.h>
58 #include <net/if_types.h>
59 #include <net/if_var.h>
60 #include <net/if_private.h>
61 #include <net/netisr.h>
62 #include <net/route/nhop.h>
63
64 #include <netinet/in.h>
65 #include <netinet/in_fib.h>
66 #include <netinet/ip.h>
67 #include <netinet/ip6.h>
68 #include <netinet/ip_var.h>
69 #include <netinet/udp.h>
70 #include <netinet/udp_var.h>
71
72 #include <netinet6/ip6_var.h>
73 #include <netinet6/in6_fib.h>
74
75 #include <machine/in_cksum.h>
76
77 #include <opencrypto/cryptodev.h>
78
79 #include "if_ovpn.h"
80
81 struct ovpn_kkey_dir {
82 int refcount;
83 uint8_t key[32];
84 uint8_t keylen;
85 uint8_t nonce[8];
86 uint8_t noncelen;
87 enum ovpn_key_cipher cipher;
88 crypto_session_t cryptoid;
89
90 struct mtx replay_mtx;
91 /*
92 * Last seen gapless sequence number. New rx seq numbers must be
93 * strictly higher than this.
94 */
95 uint32_t rx_seq;
96 uint64_t tx_seq;
97
98 /* Seen packets, relative to rx_seq. bit(0) will always be 0. */
99 uint64_t rx_window;
100 };
101
102 struct ovpn_kkey {
103 struct ovpn_kkey_dir *encrypt;
104 struct ovpn_kkey_dir *decrypt;
105 uint8_t keyid;
106 uint32_t peerid;
107 };
108
109 struct ovpn_keepalive {
110 uint32_t interval;
111 uint32_t timeout;
112 };
113
114 struct ovpn_wire_header {
115 uint32_t opcode; /* opcode, key id, peer id */
116 uint32_t seq;
117 uint8_t auth_tag[16];
118 };
119
120 struct ovpn_peer_counters {
121 uint64_t pkt_in;
122 uint64_t pkt_out;
123 uint64_t bytes_in;
124 uint64_t bytes_out;
125 };
126 #define OVPN_PEER_COUNTER_SIZE (sizeof(struct ovpn_peer_counters)/sizeof(uint64_t))
127
128 struct ovpn_notification {
129 enum ovpn_notif_type type;
130 uint32_t peerid;
131
132 /* Delete notification */
133 enum ovpn_del_reason del_reason;
134 struct ovpn_peer_counters counters;
135 };
136
137 struct ovpn_softc;
138
139 struct ovpn_kpeer {
140 RB_ENTRY(ovpn_kpeer) tree;
141 int refcount;
142 uint32_t peerid;
143
144 struct ovpn_softc *sc;
145 struct sockaddr_storage local;
146 struct sockaddr_storage remote;
147
148 struct in_addr vpn4;
149 struct in6_addr vpn6;
150
151 struct ovpn_kkey keys[2];
152
153 enum ovpn_del_reason del_reason;
154 struct ovpn_keepalive keepalive;
155 uint32_t *last_active;
156 struct callout ping_send;
157 struct callout ping_rcv;
158
159 counter_u64_t counters[OVPN_PEER_COUNTER_SIZE];
160 };
161
162 struct ovpn_counters {
163 uint64_t lost_ctrl_pkts_in;
164 uint64_t lost_ctrl_pkts_out;
165 uint64_t lost_data_pkts_in;
166 uint64_t lost_data_pkts_out;
167 uint64_t nomem_data_pkts_in;
168 uint64_t nomem_data_pkts_out;
169 uint64_t received_ctrl_pkts;
170 uint64_t received_data_pkts;
171 uint64_t sent_ctrl_pkts;
172 uint64_t sent_data_pkts;
173
174 uint64_t transport_bytes_sent;
175 uint64_t transport_bytes_received;
176 uint64_t tunnel_bytes_sent;
177 uint64_t tunnel_bytes_received;
178 };
179 #define OVPN_COUNTER_SIZE (sizeof(struct ovpn_counters)/sizeof(uint64_t))
180
181 RB_HEAD(ovpn_kpeers, ovpn_kpeer);
182
183 struct ovpn_softc {
184 int refcount;
185 struct rmlock lock;
186 struct ifnet *ifp;
187 struct socket *so;
188 int peercount;
189 struct ovpn_kpeers peers;
190
191 /* Pending notification */
192 struct buf_ring *notifring;
193
194 counter_u64_t counters[OVPN_COUNTER_SIZE];
195
196 struct epoch_context epoch_ctx;
197 };
198
199 static struct ovpn_kpeer *ovpn_find_peer(struct ovpn_softc *, uint32_t);
200 static bool ovpn_udp_input(struct mbuf *, int, struct inpcb *,
201 const struct sockaddr *, void *);
202 static int ovpn_transmit_to_peer(struct ifnet *, struct mbuf *,
203 struct ovpn_kpeer *, struct rm_priotracker *);
204 static int ovpn_encap(struct ovpn_softc *, uint32_t, struct mbuf *);
205 static int ovpn_get_af(struct mbuf *);
206 static void ovpn_free_kkey_dir(struct ovpn_kkey_dir *);
207 static bool ovpn_check_replay(struct ovpn_kkey_dir *, uint32_t);
208 static int ovpn_peer_compare(struct ovpn_kpeer *, struct ovpn_kpeer *);
209
210 static RB_PROTOTYPE(ovpn_kpeers, ovpn_kpeer, tree, ovpn_peer_compare);
211 static RB_GENERATE(ovpn_kpeers, ovpn_kpeer, tree, ovpn_peer_compare);
212
213 #define OVPN_MTU_MIN 576
214 #define OVPN_MTU_MAX (IP_MAXPACKET - sizeof(struct ip) - \
215 sizeof(struct udphdr) - sizeof(struct ovpn_wire_header))
216
217 #define OVPN_OP_DATA_V2 0x09
218 #define OVPN_OP_SHIFT 3
219 #define OVPN_SEQ_ROTATE 0x80000000
220
221 VNET_DEFINE_STATIC(struct if_clone *, ovpn_cloner);
222 #define V_ovpn_cloner VNET(ovpn_cloner)
223
224 #define OVPN_RLOCK_TRACKER struct rm_priotracker _ovpn_lock_tracker; \
225 struct rm_priotracker *_ovpn_lock_trackerp = &_ovpn_lock_tracker
226 #define OVPN_RLOCK(sc) rm_rlock(&(sc)->lock, _ovpn_lock_trackerp)
227 #define OVPN_RUNLOCK(sc) rm_runlock(&(sc)->lock, _ovpn_lock_trackerp)
228 #define OVPN_WLOCK(sc) rm_wlock(&(sc)->lock)
229 #define OVPN_WUNLOCK(sc) rm_wunlock(&(sc)->lock)
230 #define OVPN_ASSERT(sc) rm_assert(&(sc)->lock, RA_LOCKED)
231 #define OVPN_RASSERT(sc) rm_assert(&(sc)->lock, RA_RLOCKED)
232 #define OVPN_WASSERT(sc) rm_assert(&(sc)->lock, RA_WLOCKED)
233 #define OVPN_UNLOCK_ASSERT(sc) rm_assert(&(sc)->lock, RA_UNLOCKED)
234
235 #define OVPN_COUNTER(sc, name) \
236 ((sc)->counters[offsetof(struct ovpn_counters, name)/sizeof(uint64_t)])
237 #define OVPN_PEER_COUNTER(peer, name) \
238 ((peer)->counters[offsetof(struct ovpn_peer_counters, name) / \
239 sizeof(uint64_t)])
240
241 #define OVPN_COUNTER_ADD(sc, name, val) \
242 counter_u64_add(OVPN_COUNTER(sc, name), val)
243 #define OVPN_PEER_COUNTER_ADD(p, name, val) \
244 counter_u64_add(OVPN_PEER_COUNTER(p, name), val)
245
246 #define TO_IN(x) ((struct sockaddr_in *)(x))
247 #define TO_IN6(x) ((struct sockaddr_in6 *)(x))
248
249 SDT_PROVIDER_DEFINE(if_ovpn);
250 SDT_PROBE_DEFINE1(if_ovpn, tx, transmit, start, "struct mbuf *");
251 SDT_PROBE_DEFINE2(if_ovpn, tx, route, ip4, "struct in_addr *", "struct ovpn_kpeer *");
252 SDT_PROBE_DEFINE2(if_ovpn, tx, route, ip6, "struct in6_addr *", "struct ovpn_kpeer *");
253
254 static const char ovpnname[] = "ovpn";
255 static const char ovpngroupname[] = "openvpn";
256
257 static MALLOC_DEFINE(M_OVPN, ovpnname, "OpenVPN DCO Interface");
258 #define MTAG_OVPN_LOOP 0x6f76706e /* ovpn */
259
260 SYSCTL_DECL(_net_link);
261 static SYSCTL_NODE(_net_link, IFT_OTHER, openvpn, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
262 "OpenVPN DCO Interface");
263 VNET_DEFINE_STATIC(int, replay_protection) = 0;
264 #define V_replay_protection VNET(replay_protection)
265 SYSCTL_INT(_net_link_openvpn, OID_AUTO, replay_protection, CTLFLAG_VNET | CTLFLAG_RW,
266 &VNET_NAME(replay_protection), 0, "Validate sequence numbers");
267
268 VNET_DEFINE_STATIC(int, async_crypto);
269 #define V_async_crypto VNET(async_crypto)
270 SYSCTL_INT(_net_link_openvpn, OID_AUTO, async_crypto,
271 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(async_crypto), 0,
272 "Use asynchronous mode to parallelize crypto jobs.");
273
274 VNET_DEFINE_STATIC(int, async_netisr_queue);
275 #define V_async_netisr_queue VNET(async_netisr_queue)
276 SYSCTL_INT(_net_link_openvpn, OID_AUTO, netisr_queue,
277 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(async_netisr_queue), 0,
278 "Use netisr_queue() rather than netisr_dispatch().");
279
280 static int
ovpn_peer_compare(struct ovpn_kpeer * a,struct ovpn_kpeer * b)281 ovpn_peer_compare(struct ovpn_kpeer *a, struct ovpn_kpeer *b)
282 {
283 return (a->peerid - b->peerid);
284 }
285
286 static struct ovpn_kpeer *
ovpn_find_peer(struct ovpn_softc * sc,uint32_t peerid)287 ovpn_find_peer(struct ovpn_softc *sc, uint32_t peerid)
288 {
289 struct ovpn_kpeer p;
290
291 OVPN_ASSERT(sc);
292
293 p.peerid = peerid;
294
295 return (RB_FIND(ovpn_kpeers, &sc->peers, &p));
296 }
297
298 static struct ovpn_kpeer *
ovpn_find_only_peer(struct ovpn_softc * sc)299 ovpn_find_only_peer(struct ovpn_softc *sc)
300 {
301 OVPN_ASSERT(sc);
302
303 return (RB_ROOT(&sc->peers));
304 }
305
306 static uint16_t
ovpn_get_port(struct sockaddr_storage * s)307 ovpn_get_port(struct sockaddr_storage *s)
308 {
309 switch (s->ss_family) {
310 case AF_INET: {
311 struct sockaddr_in *in = (struct sockaddr_in *)s;
312 return (in->sin_port);
313 }
314 case AF_INET6: {
315 struct sockaddr_in6 *in6 = (struct sockaddr_in6 *)s;
316 return (in6->sin6_port);
317 }
318 default:
319 panic("Unsupported address family %d", s->ss_family);
320 }
321 }
322
323 static int
ovpn_nvlist_to_sockaddr(const nvlist_t * nvl,struct sockaddr_storage * sa)324 ovpn_nvlist_to_sockaddr(const nvlist_t *nvl, struct sockaddr_storage *sa)
325 {
326 int af;
327
328 if (! nvlist_exists_number(nvl, "af"))
329 return (EINVAL);
330 if (! nvlist_exists_binary(nvl, "address"))
331 return (EINVAL);
332 if (! nvlist_exists_number(nvl, "port"))
333 return (EINVAL);
334
335 af = nvlist_get_number(nvl, "af");
336
337 switch (af) {
338 #ifdef INET
339 case AF_INET: {
340 struct sockaddr_in *in = (struct sockaddr_in *)sa;
341 size_t len;
342 const void *addr = nvlist_get_binary(nvl, "address", &len);
343 in->sin_family = af;
344 if (len != sizeof(in->sin_addr))
345 return (EINVAL);
346
347 memcpy(&in->sin_addr, addr, sizeof(in->sin_addr));
348 in->sin_port = nvlist_get_number(nvl, "port");
349 break;
350 }
351 #endif
352 #ifdef INET6
353 case AF_INET6: {
354 struct sockaddr_in6 *in6 = (struct sockaddr_in6 *)sa;
355 size_t len;
356 const void *addr = nvlist_get_binary(nvl, "address", &len);
357 in6->sin6_family = af;
358 if (len != sizeof(in6->sin6_addr))
359 return (EINVAL);
360
361 memcpy(&in6->sin6_addr, addr, sizeof(in6->sin6_addr));
362 in6->sin6_port = nvlist_get_number(nvl, "port");
363 break;
364 }
365 #endif
366 default:
367 return (EINVAL);
368 }
369
370 return (0);
371 }
372
373 static bool
ovpn_has_peers(struct ovpn_softc * sc)374 ovpn_has_peers(struct ovpn_softc *sc)
375 {
376 OVPN_ASSERT(sc);
377
378 return (sc->peercount > 0);
379 }
380
381 static void
ovpn_rele_so(struct ovpn_softc * sc)382 ovpn_rele_so(struct ovpn_softc *sc)
383 {
384 bool has_peers;
385
386 OVPN_WASSERT(sc);
387
388 if (sc->so == NULL)
389 return;
390
391 has_peers = ovpn_has_peers(sc);
392
393 if (! has_peers) {
394 MPASS(sc->peercount == 0);
395 } else {
396 MPASS(sc->peercount > 0);
397 }
398 }
399
400 static void
ovpn_notify_del_peer(struct ovpn_softc * sc,struct ovpn_kpeer * peer)401 ovpn_notify_del_peer(struct ovpn_softc *sc, struct ovpn_kpeer *peer)
402 {
403 struct ovpn_notification *n;
404
405 OVPN_WASSERT(sc);
406
407 n = malloc(sizeof(*n), M_OVPN, M_NOWAIT);
408 if (n == NULL)
409 return;
410
411 n->peerid = peer->peerid;
412 n->type = OVPN_NOTIF_DEL_PEER;
413 n->del_reason = peer->del_reason;
414
415 n->counters.pkt_in = counter_u64_fetch(OVPN_PEER_COUNTER(peer, pkt_in));
416 n->counters.pkt_out = counter_u64_fetch(OVPN_PEER_COUNTER(peer, pkt_out));
417 n->counters.bytes_in = counter_u64_fetch(OVPN_PEER_COUNTER(peer, bytes_in));
418 n->counters.bytes_out = counter_u64_fetch(OVPN_PEER_COUNTER(peer, bytes_out));
419
420 if (buf_ring_enqueue(sc->notifring, n) != 0) {
421 free(n, M_OVPN);
422 } else if (sc->so != NULL) {
423 /* Wake up userspace */
424 sc->so->so_error = EAGAIN;
425 sorwakeup(sc->so);
426 sowwakeup(sc->so);
427 }
428 }
429
430 static void
ovpn_notify_key_rotation(struct ovpn_softc * sc,struct ovpn_kpeer * peer)431 ovpn_notify_key_rotation(struct ovpn_softc *sc, struct ovpn_kpeer *peer)
432 {
433 struct ovpn_notification *n;
434
435 n = malloc(sizeof(*n), M_OVPN, M_NOWAIT | M_ZERO);
436 if (n == NULL)
437 return;
438
439 n->peerid = peer->peerid;
440 n->type = OVPN_NOTIF_ROTATE_KEY;
441
442 if (buf_ring_enqueue(sc->notifring, n) != 0) {
443 free(n, M_OVPN);
444 } else if (sc->so != NULL) {
445 /* Wake up userspace */
446 sc->so->so_error = EAGAIN;
447 sorwakeup(sc->so);
448 sowwakeup(sc->so);
449 }
450 }
451
452 static void
ovpn_peer_release_ref(struct ovpn_kpeer * peer,bool locked)453 ovpn_peer_release_ref(struct ovpn_kpeer *peer, bool locked)
454 {
455 struct ovpn_softc *sc;
456
457 CURVNET_ASSERT_SET();
458
459 atomic_add_int(&peer->refcount, -1);
460
461 if (atomic_load_int(&peer->refcount) > 0)
462 return;
463
464 sc = peer->sc;
465
466 if (! locked) {
467 OVPN_WLOCK(sc);
468
469 /* Might have changed before we acquired the lock. */
470 if (atomic_load_int(&peer->refcount) > 0) {
471 OVPN_WUNLOCK(sc);
472 return;
473 }
474 }
475
476 OVPN_ASSERT(sc);
477
478 /* The peer should have been removed from the list already. */
479 MPASS(ovpn_find_peer(sc, peer->peerid) == NULL);
480
481 ovpn_notify_del_peer(sc, peer);
482
483 for (int i = 0; i < 2; i++) {
484 ovpn_free_kkey_dir(peer->keys[i].encrypt);
485 ovpn_free_kkey_dir(peer->keys[i].decrypt);
486 }
487
488 ovpn_rele_so(sc);
489
490 callout_stop(&peer->ping_send);
491 callout_stop(&peer->ping_rcv);
492 uma_zfree_pcpu(pcpu_zone_4, peer->last_active);
493 free(peer, M_OVPN);
494
495 if (! locked)
496 OVPN_WUNLOCK(sc);
497 }
498
499 static int
ovpn_new_peer(struct ifnet * ifp,const nvlist_t * nvl)500 ovpn_new_peer(struct ifnet *ifp, const nvlist_t *nvl)
501 {
502 #ifdef INET6
503 struct epoch_tracker et;
504 #endif
505 struct sockaddr_storage remote;
506 struct ovpn_kpeer *peer = NULL;
507 struct file *fp = NULL;
508 struct ovpn_softc *sc = ifp->if_softc;
509 struct thread *td = curthread;
510 struct socket *so = NULL;
511 int fd;
512 uint32_t peerid;
513 int ret = 0;
514 bool setcb = false;
515
516 if (nvl == NULL)
517 return (EINVAL);
518
519 if (! nvlist_exists_number(nvl, "peerid"))
520 return (EINVAL);
521
522 if (! nvlist_exists_number(nvl, "fd"))
523 return (EINVAL);
524
525 if (! nvlist_exists_nvlist(nvl, "remote"))
526 return (EINVAL);
527
528 peerid = nvlist_get_number(nvl, "peerid");
529
530 ret = ovpn_nvlist_to_sockaddr(nvlist_get_nvlist(nvl, "remote"),
531 &remote);
532 if (ret != 0)
533 return (ret);
534
535 fd = nvlist_get_number(nvl, "fd");
536
537 /* Look up the userspace process and use the fd to find the socket. */
538 ret = getsock(td, fd, &cap_connect_rights, &fp);
539 if (ret != 0)
540 return (ret);
541
542 so = fp->f_data;
543
544 peer = malloc(sizeof(*peer), M_OVPN, M_WAITOK | M_ZERO);
545 peer->peerid = peerid;
546 peer->sc = sc;
547 peer->refcount = 1;
548 peer->last_active = uma_zalloc_pcpu(pcpu_zone_4, M_WAITOK | M_ZERO);
549 COUNTER_ARRAY_ALLOC(peer->counters, OVPN_PEER_COUNTER_SIZE, M_WAITOK);
550
551 if (nvlist_exists_binary(nvl, "vpn_ipv4")) {
552 size_t len;
553 const void *addr = nvlist_get_binary(nvl, "vpn_ipv4", &len);
554 if (len != sizeof(peer->vpn4)) {
555 ret = EINVAL;
556 goto error;
557 }
558 memcpy(&peer->vpn4, addr, len);
559 }
560
561 if (nvlist_exists_binary(nvl, "vpn_ipv6")) {
562 size_t len;
563 const void *addr = nvlist_get_binary(nvl, "vpn_ipv6", &len);
564 if (len != sizeof(peer->vpn6)) {
565 ret = EINVAL;
566 goto error;
567 }
568 memcpy(&peer->vpn6, addr, len);
569 }
570
571 callout_init_rm(&peer->ping_send, &sc->lock, CALLOUT_SHAREDLOCK);
572 callout_init_rm(&peer->ping_rcv, &sc->lock, 0);
573
574 peer->local.ss_len = sizeof(peer->local);
575 ret = sosockaddr(so, (struct sockaddr *)&peer->local);
576 if (ret)
577 goto error;
578
579 if (ovpn_get_port(&peer->local) == 0) {
580 ret = EINVAL;
581 goto error;
582 }
583 if (peer->local.ss_family != remote.ss_family) {
584 ret = EINVAL;
585 goto error;
586 }
587
588 memcpy(&peer->remote, &remote, sizeof(remote));
589
590 if (peer->local.ss_family == AF_INET6 &&
591 IN6_IS_ADDR_V4MAPPED(&TO_IN6(&peer->remote)->sin6_addr)) {
592 /* V4 mapped address, so treat this as v4, not v6. */
593 in6_sin6_2_sin_in_sock((struct sockaddr *)&peer->local);
594 in6_sin6_2_sin_in_sock((struct sockaddr *)&peer->remote);
595 }
596
597 #ifdef INET6
598 if (peer->local.ss_family == AF_INET6 &&
599 IN6_IS_ADDR_UNSPECIFIED(&TO_IN6(&peer->local)->sin6_addr)) {
600 NET_EPOCH_ENTER(et);
601 ret = in6_selectsrc_addr(curthread->td_proc->p_fibnum,
602 &TO_IN6(&peer->remote)->sin6_addr,
603 0, NULL, &TO_IN6(&peer->local)->sin6_addr, NULL);
604 NET_EPOCH_EXIT(et);
605 if (ret != 0) {
606 goto error;
607 }
608 }
609 #endif
610 OVPN_WLOCK(sc);
611
612 /* Disallow peer id re-use. */
613 if (ovpn_find_peer(sc, peerid) != NULL) {
614 ret = EEXIST;
615 goto error_locked;
616 }
617
618 /* Make sure this is really a UDP socket. */
619 if (so->so_type != SOCK_DGRAM || so->so_proto->pr_type != SOCK_DGRAM) {
620 ret = EPROTOTYPE;
621 goto error_locked;
622 }
623
624 /* Must be the same socket as for other peers on this interface. */
625 if (sc->so != NULL && so != sc->so)
626 goto error_locked;
627
628 if (sc->so == NULL) {
629 sc->so = so;
630 /*
631 * Maintain one extra ref so the socket doesn't go away until
632 * we're destroying the ifp.
633 */
634 soref(sc->so);
635 setcb = true;
636 }
637
638 /* Insert the peer into the list. */
639 RB_INSERT(ovpn_kpeers, &sc->peers, peer);
640 sc->peercount++;
641
642 OVPN_WUNLOCK(sc);
643
644 if (setcb) {
645 ret = udp_set_kernel_tunneling(sc->so, ovpn_udp_input, NULL, sc);
646 MPASS(ret == 0);
647 }
648
649 goto done;
650
651 error_locked:
652 OVPN_WUNLOCK(sc);
653 error:
654 COUNTER_ARRAY_FREE(peer->counters, OVPN_PEER_COUNTER_SIZE);
655 uma_zfree_pcpu(pcpu_zone_4, peer->last_active);
656 free(peer, M_OVPN);
657 done:
658 if (fp != NULL)
659 fdrop(fp, td);
660
661 return (ret);
662 }
663
664 static int
_ovpn_del_peer(struct ovpn_softc * sc,struct ovpn_kpeer * peer)665 _ovpn_del_peer(struct ovpn_softc *sc, struct ovpn_kpeer *peer)
666 {
667 struct ovpn_kpeer *tmp __diagused;
668
669 OVPN_WASSERT(sc);
670 CURVNET_ASSERT_SET();
671
672 MPASS(RB_FIND(ovpn_kpeers, &sc->peers, peer) == peer);
673
674 tmp = RB_REMOVE(ovpn_kpeers, &sc->peers, peer);
675 MPASS(tmp != NULL);
676
677 sc->peercount--;
678
679 ovpn_peer_release_ref(peer, true);
680
681 return (0);
682 }
683
684 static int
ovpn_del_peer(struct ifnet * ifp,nvlist_t * nvl)685 ovpn_del_peer(struct ifnet *ifp, nvlist_t *nvl)
686 {
687 struct ovpn_softc *sc = ifp->if_softc;
688 struct ovpn_kpeer *peer;
689 uint32_t peerid;
690 int ret;
691
692 OVPN_WASSERT(sc);
693
694 if (nvl == NULL)
695 return (EINVAL);
696
697 if (! nvlist_exists_number(nvl, "peerid"))
698 return (EINVAL);
699
700 peerid = nvlist_get_number(nvl, "peerid");
701
702 peer = ovpn_find_peer(sc, peerid);
703 if (peer == NULL)
704 return (ENOENT);
705
706 peer->del_reason = OVPN_DEL_REASON_REQUESTED;
707 ret = _ovpn_del_peer(sc, peer);
708
709 return (ret);
710 }
711
712 static int
ovpn_create_kkey_dir(struct ovpn_kkey_dir ** kdirp,const nvlist_t * nvl)713 ovpn_create_kkey_dir(struct ovpn_kkey_dir **kdirp,
714 const nvlist_t *nvl)
715 {
716 struct crypto_session_params csp;
717 struct ovpn_kkey_dir *kdir;
718 const char *ciphername;
719 enum ovpn_key_cipher cipher;
720 const void *key, *iv;
721 size_t keylen = 0, ivlen = 0;
722 int error;
723
724 if (! nvlist_exists_string(nvl, "cipher"))
725 return (EINVAL);
726 ciphername = nvlist_get_string(nvl, "cipher");
727
728 if (strcmp(ciphername, "none") == 0)
729 cipher = OVPN_CIPHER_ALG_NONE;
730 else if (strcmp(ciphername, "AES-256-GCM") == 0 ||
731 strcmp(ciphername, "AES-192-GCM") == 0 ||
732 strcmp(ciphername, "AES-128-GCM") == 0)
733 cipher = OVPN_CIPHER_ALG_AES_GCM;
734 else if (strcmp(ciphername, "CHACHA20-POLY1305") == 0)
735 cipher = OVPN_CIPHER_ALG_CHACHA20_POLY1305;
736 else
737 return (EINVAL);
738
739 if (cipher != OVPN_CIPHER_ALG_NONE) {
740 if (! nvlist_exists_binary(nvl, "key"))
741 return (EINVAL);
742 key = nvlist_get_binary(nvl, "key", &keylen);
743 if (keylen > sizeof(kdir->key))
744 return (E2BIG);
745
746 if (! nvlist_exists_binary(nvl, "iv"))
747 return (EINVAL);
748 iv = nvlist_get_binary(nvl, "iv", &ivlen);
749 if (ivlen != 8)
750 return (E2BIG);
751 }
752
753 kdir = malloc(sizeof(struct ovpn_kkey_dir), M_OVPN,
754 M_WAITOK | M_ZERO);
755
756 kdir->cipher = cipher;
757 kdir->keylen = keylen;
758 kdir->tx_seq = 1;
759 memcpy(kdir->key, key, keylen);
760 kdir->noncelen = ivlen;
761 memcpy(kdir->nonce, iv, ivlen);
762
763 if (kdir->cipher != OVPN_CIPHER_ALG_NONE) {
764 /* Crypto init */
765 bzero(&csp, sizeof(csp));
766 csp.csp_mode = CSP_MODE_AEAD;
767
768 if (kdir->cipher == OVPN_CIPHER_ALG_CHACHA20_POLY1305)
769 csp.csp_cipher_alg = CRYPTO_CHACHA20_POLY1305;
770 else
771 csp.csp_cipher_alg = CRYPTO_AES_NIST_GCM_16;
772
773 csp.csp_flags |= CSP_F_SEPARATE_AAD;
774
775 csp.csp_cipher_klen = kdir->keylen;
776 csp.csp_cipher_key = kdir->key;
777 csp.csp_ivlen = 96 / 8;
778
779 error = crypto_newsession(&kdir->cryptoid, &csp,
780 CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE);
781 if (error) {
782 free(kdir, M_OVPN);
783 return (error);
784 }
785 }
786
787 mtx_init(&kdir->replay_mtx, "if_ovpn rx replay", NULL, MTX_DEF);
788 *kdirp = kdir;
789
790 return (0);
791 }
792
793 static void
ovpn_free_kkey_dir(struct ovpn_kkey_dir * kdir)794 ovpn_free_kkey_dir(struct ovpn_kkey_dir *kdir)
795 {
796 if (kdir == NULL)
797 return;
798
799 mtx_destroy(&kdir->replay_mtx);
800
801 crypto_freesession(kdir->cryptoid);
802 free(kdir, M_OVPN);
803 }
804
805 static int
ovpn_set_key(struct ifnet * ifp,const nvlist_t * nvl)806 ovpn_set_key(struct ifnet *ifp, const nvlist_t *nvl)
807 {
808 struct ovpn_softc *sc = ifp->if_softc;
809 struct ovpn_kkey_dir *enc, *dec;
810 struct ovpn_kpeer *peer;
811 int slot, keyid, peerid;
812 int error;
813
814 if (nvl == NULL)
815 return (EINVAL);
816
817 if (! nvlist_exists_number(nvl, "slot"))
818 return (EINVAL);
819 slot = nvlist_get_number(nvl, "slot");
820
821 if (! nvlist_exists_number(nvl, "keyid"))
822 return (EINVAL);
823 keyid = nvlist_get_number(nvl, "keyid");
824
825 if (! nvlist_exists_number(nvl, "peerid"))
826 return (EINVAL);
827 peerid = nvlist_get_number(nvl, "peerid");
828
829 if (slot != OVPN_KEY_SLOT_PRIMARY &&
830 slot != OVPN_KEY_SLOT_SECONDARY)
831 return (EINVAL);
832
833 if (! nvlist_exists_nvlist(nvl, "encrypt") ||
834 ! nvlist_exists_nvlist(nvl, "decrypt"))
835 return (EINVAL);
836
837 error = ovpn_create_kkey_dir(&enc, nvlist_get_nvlist(nvl, "encrypt"));
838 if (error)
839 return (error);
840
841 error = ovpn_create_kkey_dir(&dec, nvlist_get_nvlist(nvl, "decrypt"));
842 if (error) {
843 ovpn_free_kkey_dir(enc);
844 return (error);
845 }
846
847 OVPN_WLOCK(sc);
848
849 peer = ovpn_find_peer(sc, peerid);
850 if (peer == NULL) {
851 ovpn_free_kkey_dir(dec);
852 ovpn_free_kkey_dir(enc);
853 OVPN_WUNLOCK(sc);
854 return (ENOENT);
855 }
856
857 ovpn_free_kkey_dir(peer->keys[slot].encrypt);
858 ovpn_free_kkey_dir(peer->keys[slot].decrypt);
859
860 peer->keys[slot].encrypt = enc;
861 peer->keys[slot].decrypt = dec;
862
863 peer->keys[slot].keyid = keyid;
864 peer->keys[slot].peerid = peerid;
865
866 OVPN_WUNLOCK(sc);
867
868 return (0);
869 }
870
871 static int
ovpn_check_key(struct ovpn_softc * sc,struct ovpn_kpeer * peer,enum ovpn_key_slot slot)872 ovpn_check_key(struct ovpn_softc *sc, struct ovpn_kpeer *peer, enum ovpn_key_slot slot)
873 {
874 OVPN_ASSERT(sc);
875
876 if (peer->keys[slot].encrypt == NULL)
877 return (ENOLINK);
878
879 if (peer->keys[slot].decrypt == NULL)
880 return (ENOLINK);
881
882 return (0);
883 }
884
885 static int
ovpn_start(struct ifnet * ifp)886 ovpn_start(struct ifnet *ifp)
887 {
888 struct ovpn_softc *sc = ifp->if_softc;
889
890 OVPN_WLOCK(sc);
891
892 ifp->if_flags |= IFF_UP;
893 ifp->if_drv_flags |= IFF_DRV_RUNNING;
894 if_link_state_change(ifp, LINK_STATE_UP);
895
896 OVPN_WUNLOCK(sc);
897
898 return (0);
899 }
900
901 static int
ovpn_swap_keys(struct ifnet * ifp,nvlist_t * nvl)902 ovpn_swap_keys(struct ifnet *ifp, nvlist_t *nvl)
903 {
904 struct ovpn_softc *sc = ifp->if_softc;
905 struct ovpn_kpeer *peer;
906 struct ovpn_kkey tmpkey;
907 int error;
908
909 if (nvl == NULL)
910 return (EINVAL);
911
912 if (! nvlist_exists_number(nvl, "peerid"))
913 return (EINVAL);
914
915 OVPN_WLOCK(sc);
916
917 peer = ovpn_find_peer(sc, nvlist_get_number(nvl, "peerid"));
918 if (peer == NULL) {
919 OVPN_WUNLOCK(sc);
920 return (ENOENT);
921 }
922
923 /* Check that we have a second key to swap to. */
924 error = ovpn_check_key(sc, peer, OVPN_KEY_SLOT_SECONDARY);
925 if (error) {
926 OVPN_WUNLOCK(sc);
927 return (error);
928 }
929
930 tmpkey = peer->keys[0];
931 peer->keys[0] = peer->keys[1];
932 peer->keys[1] = tmpkey;
933
934 OVPN_WUNLOCK(sc);
935
936 return (0);
937 }
938
939 static int
ovpn_del_key(struct ifnet * ifp,const nvlist_t * nvl)940 ovpn_del_key(struct ifnet *ifp, const nvlist_t *nvl)
941 {
942 enum ovpn_key_slot slot;
943 struct ovpn_kpeer *peer;
944 struct ovpn_softc *sc = ifp->if_softc;
945
946 if (nvl == NULL)
947 return (EINVAL);
948
949 if (! nvlist_exists_number(nvl, "peerid"))
950 return (EINVAL);
951
952 if (! nvlist_exists_number(nvl, "slot"))
953 return (EINVAL);
954 slot = nvlist_get_number(nvl, "slot");
955
956 if (slot != OVPN_KEY_SLOT_PRIMARY &&
957 slot != OVPN_KEY_SLOT_SECONDARY)
958 return (EINVAL);
959
960 OVPN_WLOCK(sc);
961
962 peer = ovpn_find_peer(sc, nvlist_get_number(nvl, "peerid"));
963 if (peer == NULL) {
964 OVPN_WUNLOCK(sc);
965 return (ENOENT);
966 }
967
968 ovpn_free_kkey_dir(peer->keys[slot].encrypt);
969 ovpn_free_kkey_dir(peer->keys[slot].decrypt);
970
971 peer->keys[slot].encrypt = NULL;
972 peer->keys[slot].decrypt = NULL;
973
974 peer->keys[slot].keyid = 0;
975 peer->keys[slot].peerid = 0;
976
977 OVPN_WUNLOCK(sc);
978
979 return (0);
980 }
981
982 static void
ovpn_send_ping(void * arg)983 ovpn_send_ping(void *arg)
984 {
985 static const uint8_t ping_str[] = {
986 0x2a, 0x18, 0x7b, 0xf3, 0x64, 0x1e, 0xb4, 0xcb,
987 0x07, 0xed, 0x2d, 0x0a, 0x98, 0x1f, 0xc7, 0x48
988 };
989
990 struct epoch_tracker et;
991 struct ovpn_kpeer *peer = arg;
992 struct ovpn_softc *sc = peer->sc;
993 struct mbuf *m;
994
995 OVPN_RASSERT(sc);
996
997 /* Ensure we repeat! */
998 callout_reset(&peer->ping_send, peer->keepalive.interval * hz,
999 ovpn_send_ping, peer);
1000
1001 m = m_get2(sizeof(ping_str), M_NOWAIT, MT_DATA, M_PKTHDR);
1002 if (m == NULL)
1003 return;
1004
1005 m_copyback(m, 0, sizeof(ping_str), ping_str);
1006 m->m_len = m->m_pkthdr.len = sizeof(ping_str);
1007
1008 CURVNET_SET(sc->ifp->if_vnet);
1009 NET_EPOCH_ENTER(et);
1010 (void)ovpn_transmit_to_peer(sc->ifp, m, peer, NULL);
1011 NET_EPOCH_EXIT(et);
1012 CURVNET_RESTORE();
1013 }
1014
1015 static void
ovpn_timeout(void * arg)1016 ovpn_timeout(void *arg)
1017 {
1018 struct ovpn_kpeer *peer = arg;
1019 struct ovpn_softc *sc = peer->sc;
1020 uint32_t last, _last_active;
1021 int ret __diagused;
1022 int cpu;
1023
1024 OVPN_WASSERT(sc);
1025
1026 last = 0;
1027 CPU_FOREACH(cpu) {
1028 _last_active = *zpcpu_get_cpu(peer->last_active, cpu);
1029 if (_last_active > last)
1030 last = _last_active;
1031 }
1032
1033 if (last + peer->keepalive.timeout > time_uptime) {
1034 callout_reset(&peer->ping_rcv,
1035 (peer->keepalive.timeout - (time_uptime - last)) * hz,
1036 ovpn_timeout, peer);
1037 return;
1038 }
1039
1040 CURVNET_SET(sc->ifp->if_vnet);
1041 peer->del_reason = OVPN_DEL_REASON_TIMEOUT;
1042 ret = _ovpn_del_peer(sc, peer);
1043 MPASS(ret == 0);
1044 CURVNET_RESTORE();
1045 }
1046
1047 static int
ovpn_set_peer(struct ifnet * ifp,const nvlist_t * nvl)1048 ovpn_set_peer(struct ifnet *ifp, const nvlist_t *nvl)
1049 {
1050 struct ovpn_softc *sc = ifp->if_softc;
1051 struct ovpn_kpeer *peer;
1052
1053 if (nvl == NULL)
1054 return (EINVAL);
1055
1056 if (! nvlist_exists_number(nvl, "interval") ||
1057 ! nvlist_exists_number(nvl, "timeout") ||
1058 ! nvlist_exists_number(nvl, "peerid"))
1059 return (EINVAL);
1060
1061 OVPN_WLOCK(sc);
1062
1063 peer = ovpn_find_peer(sc, nvlist_get_number(nvl, "peerid"));
1064 if (peer == NULL) {
1065 OVPN_WUNLOCK(sc);
1066 return (ENOENT);
1067 }
1068
1069 peer->keepalive.interval = nvlist_get_number(nvl, "interval");
1070 peer->keepalive.timeout = nvlist_get_number(nvl, "timeout");
1071
1072 if (peer->keepalive.interval > 0)
1073 callout_reset(&peer->ping_send, peer->keepalive.interval * hz,
1074 ovpn_send_ping, peer);
1075 if (peer->keepalive.timeout > 0)
1076 callout_reset(&peer->ping_rcv, peer->keepalive.timeout * hz,
1077 ovpn_timeout, peer);
1078
1079 OVPN_WUNLOCK(sc);
1080
1081 return (0);
1082 }
1083
1084 static int
ovpn_set_ifmode(struct ifnet * ifp,const nvlist_t * nvl)1085 ovpn_set_ifmode(struct ifnet *ifp, const nvlist_t *nvl)
1086 {
1087 struct ovpn_softc *sc = ifp->if_softc;
1088 int ifmode;
1089
1090 if (nvl == NULL)
1091 return (EINVAL);
1092
1093 if (! nvlist_exists_number(nvl, "ifmode") )
1094 return (EINVAL);
1095
1096 ifmode = nvlist_get_number(nvl, "ifmode");
1097
1098 OVPN_WLOCK(sc);
1099
1100 /* deny this if UP */
1101 if (ifp->if_flags & IFF_UP) {
1102 OVPN_WUNLOCK(sc);
1103 return (EBUSY);
1104 }
1105
1106 switch (ifmode & ~IFF_MULTICAST) {
1107 case IFF_POINTOPOINT:
1108 case IFF_BROADCAST:
1109 ifp->if_flags &=
1110 ~(IFF_BROADCAST|IFF_POINTOPOINT|IFF_MULTICAST);
1111 ifp->if_flags |= ifmode;
1112 break;
1113 default:
1114 OVPN_WUNLOCK(sc);
1115 return (EINVAL);
1116 }
1117
1118 OVPN_WUNLOCK(sc);
1119
1120 return (0);
1121 }
1122
1123 static int
ovpn_ioctl_set(struct ifnet * ifp,struct ifdrv * ifd)1124 ovpn_ioctl_set(struct ifnet *ifp, struct ifdrv *ifd)
1125 {
1126 struct ovpn_softc *sc = ifp->if_softc;
1127 uint8_t *buf = NULL;
1128 nvlist_t *nvl = NULL;
1129 int ret;
1130
1131 if (ifd->ifd_len != 0) {
1132 if (ifd->ifd_len > OVPN_MAX_REQUEST_SIZE)
1133 return (E2BIG);
1134
1135 buf = malloc(ifd->ifd_len, M_OVPN, M_WAITOK);
1136
1137 ret = copyin(ifd->ifd_data, buf, ifd->ifd_len);
1138 if (ret != 0) {
1139 free(buf, M_OVPN);
1140 return (ret);
1141 }
1142
1143 nvl = nvlist_unpack(buf, ifd->ifd_len, 0);
1144 free(buf, M_OVPN);
1145 if (nvl == NULL) {
1146 return (EINVAL);
1147 }
1148 }
1149
1150 switch (ifd->ifd_cmd) {
1151 case OVPN_NEW_PEER:
1152 ret = ovpn_new_peer(ifp, nvl);
1153 break;
1154 case OVPN_DEL_PEER:
1155 OVPN_WLOCK(sc);
1156 ret = ovpn_del_peer(ifp, nvl);
1157 OVPN_WUNLOCK(sc);
1158 break;
1159 case OVPN_NEW_KEY:
1160 ret = ovpn_set_key(ifp, nvl);
1161 break;
1162 case OVPN_START_VPN:
1163 ret = ovpn_start(ifp);
1164 break;
1165 case OVPN_SWAP_KEYS:
1166 ret = ovpn_swap_keys(ifp, nvl);
1167 break;
1168 case OVPN_DEL_KEY:
1169 ret = ovpn_del_key(ifp, nvl);
1170 break;
1171 case OVPN_SET_PEER:
1172 ret = ovpn_set_peer(ifp, nvl);
1173 break;
1174 case OVPN_SET_IFMODE:
1175 ret = ovpn_set_ifmode(ifp, nvl);
1176 break;
1177 default:
1178 ret = ENOTSUP;
1179 }
1180
1181 nvlist_destroy(nvl);
1182 return (ret);
1183 }
1184
1185 static int
ovpn_add_counters(nvlist_t * parent,const char * name,counter_u64_t in,counter_u64_t out)1186 ovpn_add_counters(nvlist_t *parent, const char *name, counter_u64_t in,
1187 counter_u64_t out)
1188 {
1189 nvlist_t *nvl;
1190
1191 nvl = nvlist_create(0);
1192 if (nvl == NULL)
1193 return (ENOMEM);
1194
1195 nvlist_add_number(nvl, "in", counter_u64_fetch(in));
1196 nvlist_add_number(nvl, "out", counter_u64_fetch(out));
1197
1198 nvlist_add_nvlist(parent, name, nvl);
1199
1200 nvlist_destroy(nvl);
1201
1202 return (0);
1203 }
1204
1205 static int
ovpn_get_stats(struct ovpn_softc * sc,nvlist_t ** onvl)1206 ovpn_get_stats(struct ovpn_softc *sc, nvlist_t **onvl)
1207 {
1208 nvlist_t *nvl;
1209 int ret;
1210
1211 nvl = nvlist_create(0);
1212 if (nvl == NULL)
1213 return (ENOMEM);
1214
1215 #define OVPN_COUNTER_OUT(name, in, out) \
1216 do { \
1217 ret = ovpn_add_counters(nvl, name, OVPN_COUNTER(sc, in), \
1218 OVPN_COUNTER(sc, out)); \
1219 if (ret != 0) \
1220 goto error; \
1221 } while(0)
1222
1223 OVPN_COUNTER_OUT("lost_ctrl", lost_ctrl_pkts_in, lost_ctrl_pkts_out);
1224 OVPN_COUNTER_OUT("lost_data", lost_data_pkts_in, lost_data_pkts_out);
1225 OVPN_COUNTER_OUT("nomem_data", nomem_data_pkts_in,
1226 nomem_data_pkts_out);
1227 OVPN_COUNTER_OUT("data", received_data_pkts, sent_data_pkts);
1228 OVPN_COUNTER_OUT("ctrl", received_ctrl_pkts, sent_ctrl_pkts);
1229 OVPN_COUNTER_OUT("tunnel", tunnel_bytes_received,
1230 tunnel_bytes_received);
1231 OVPN_COUNTER_OUT("transport", transport_bytes_received,
1232 transport_bytes_received);
1233 #undef OVPN_COUNTER_OUT
1234
1235 *onvl = nvl;
1236
1237 return (0);
1238
1239 error:
1240 nvlist_destroy(nvl);
1241 return (ret);
1242 }
1243
1244 static int
ovpn_get_peer_stats(struct ovpn_softc * sc,nvlist_t ** nvl)1245 ovpn_get_peer_stats(struct ovpn_softc *sc, nvlist_t **nvl)
1246 {
1247 struct ovpn_kpeer *peer;
1248 nvlist_t *nvpeer = NULL;
1249 int ret;
1250
1251 OVPN_RLOCK_TRACKER;
1252
1253 *nvl = nvlist_create(0);
1254 if (*nvl == NULL)
1255 return (ENOMEM);
1256
1257 #define OVPN_PEER_COUNTER_OUT(name, in, out) \
1258 do { \
1259 ret = ovpn_add_counters(nvpeer, name, \
1260 OVPN_PEER_COUNTER(peer, in), OVPN_PEER_COUNTER(peer, out)); \
1261 if (ret != 0) \
1262 goto error; \
1263 } while(0)
1264
1265 OVPN_RLOCK(sc);
1266 RB_FOREACH(peer, ovpn_kpeers, &sc->peers) {
1267 nvpeer = nvlist_create(0);
1268 if (nvpeer == NULL) {
1269 OVPN_RUNLOCK(sc);
1270 nvlist_destroy(*nvl);
1271 *nvl = NULL;
1272 return (ENOMEM);
1273 }
1274
1275 nvlist_add_number(nvpeer, "peerid", peer->peerid);
1276
1277 OVPN_PEER_COUNTER_OUT("packets", pkt_in, pkt_out);
1278 OVPN_PEER_COUNTER_OUT("bytes", bytes_in, bytes_out);
1279
1280 nvlist_append_nvlist_array(*nvl, "peers", nvpeer);
1281 nvlist_destroy(nvpeer);
1282 }
1283 #undef OVPN_PEER_COUNTER_OUT
1284 OVPN_RUNLOCK(sc);
1285
1286 return (0);
1287
1288 error:
1289 nvlist_destroy(nvpeer);
1290 nvlist_destroy(*nvl);
1291 *nvl = NULL;
1292 return (ret);
1293 }
1294
1295 static int
ovpn_poll_pkt(struct ovpn_softc * sc,nvlist_t ** onvl)1296 ovpn_poll_pkt(struct ovpn_softc *sc, nvlist_t **onvl)
1297 {
1298 nvlist_t *nvl;
1299
1300 nvl = nvlist_create(0);
1301 if (nvl == NULL)
1302 return (ENOMEM);
1303
1304 nvlist_add_number(nvl, "pending", buf_ring_count(sc->notifring));
1305
1306 *onvl = nvl;
1307
1308 return (0);
1309 }
1310
1311 static void
ovpn_notif_add_counters(nvlist_t * parent,struct ovpn_notification * n)1312 ovpn_notif_add_counters(nvlist_t *parent, struct ovpn_notification *n)
1313 {
1314 nvlist_t *nvl;
1315
1316 nvl = nvlist_create(0);
1317 if (nvl == NULL)
1318 return;
1319
1320 nvlist_add_number(nvl, "in", n->counters.pkt_in);
1321 nvlist_add_number(nvl, "out", n->counters.pkt_out);
1322
1323 nvlist_add_nvlist(parent, "packets", nvl);
1324 nvlist_destroy(nvl);
1325
1326 nvl = nvlist_create(0);
1327 if (nvl == NULL)
1328 return;
1329
1330 nvlist_add_number(nvl, "in", n->counters.bytes_in);
1331 nvlist_add_number(nvl, "out", n->counters.bytes_out);
1332
1333 nvlist_add_nvlist(parent, "bytes", nvl);
1334 nvlist_destroy(nvl);
1335 }
1336
1337 static int
opvn_get_pkt(struct ovpn_softc * sc,nvlist_t ** onvl)1338 opvn_get_pkt(struct ovpn_softc *sc, nvlist_t **onvl)
1339 {
1340 struct ovpn_notification *n;
1341 nvlist_t *nvl;
1342
1343 /* Check if we have notifications pending. */
1344 n = buf_ring_dequeue_mc(sc->notifring);
1345 if (n == NULL)
1346 return (ENOENT);
1347
1348 nvl = nvlist_create(0);
1349 if (nvl == NULL) {
1350 free(n, M_OVPN);
1351 return (ENOMEM);
1352 }
1353 nvlist_add_number(nvl, "peerid", n->peerid);
1354 nvlist_add_number(nvl, "notification", n->type);
1355 if (n->type == OVPN_NOTIF_DEL_PEER) {
1356 nvlist_add_number(nvl, "del_reason", n->del_reason);
1357
1358 /* No error handling, because we want to send the notification
1359 * even if we can't attach the counters. */
1360 ovpn_notif_add_counters(nvl, n);
1361 }
1362 free(n, M_OVPN);
1363
1364 *onvl = nvl;
1365
1366 return (0);
1367 }
1368
1369 static int
ovpn_ioctl_get(struct ifnet * ifp,struct ifdrv * ifd)1370 ovpn_ioctl_get(struct ifnet *ifp, struct ifdrv *ifd)
1371 {
1372 struct ovpn_softc *sc = ifp->if_softc;
1373 nvlist_t *nvl = NULL;
1374 int error;
1375
1376 switch (ifd->ifd_cmd) {
1377 case OVPN_GET_STATS:
1378 error = ovpn_get_stats(sc, &nvl);
1379 break;
1380 case OVPN_GET_PEER_STATS:
1381 error = ovpn_get_peer_stats(sc, &nvl);
1382 break;
1383 case OVPN_POLL_PKT:
1384 error = ovpn_poll_pkt(sc, &nvl);
1385 break;
1386 case OVPN_GET_PKT:
1387 error = opvn_get_pkt(sc, &nvl);
1388 break;
1389 default:
1390 error = ENOTSUP;
1391 break;
1392 }
1393
1394 if (error == 0) {
1395 void *packed = NULL;
1396 size_t len;
1397
1398 MPASS(nvl != NULL);
1399
1400 packed = nvlist_pack(nvl, &len);
1401 if (! packed) {
1402 nvlist_destroy(nvl);
1403 return (ENOMEM);
1404 }
1405
1406 if (len > ifd->ifd_len) {
1407 free(packed, M_NVLIST);
1408 nvlist_destroy(nvl);
1409 return (ENOSPC);
1410 }
1411
1412 error = copyout(packed, ifd->ifd_data, len);
1413 ifd->ifd_len = len;
1414
1415 free(packed, M_NVLIST);
1416 nvlist_destroy(nvl);
1417 }
1418
1419 return (error);
1420 }
1421
1422 static int
ovpn_ioctl(struct ifnet * ifp,u_long cmd,caddr_t data)1423 ovpn_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1424 {
1425 struct ifdrv *ifd;
1426 int error;
1427
1428 CURVNET_ASSERT_SET();
1429
1430 switch (cmd) {
1431 case SIOCSDRVSPEC:
1432 case SIOCGDRVSPEC:
1433 error = priv_check(curthread, PRIV_NET_OVPN);
1434 if (error)
1435 return (error);
1436 break;
1437 }
1438
1439 switch (cmd) {
1440 case SIOCSDRVSPEC:
1441 ifd = (struct ifdrv *)data;
1442 error = ovpn_ioctl_set(ifp, ifd);
1443 break;
1444 case SIOCGDRVSPEC:
1445 ifd = (struct ifdrv *)data;
1446 error = ovpn_ioctl_get(ifp, ifd);
1447 break;
1448 case SIOCSIFMTU: {
1449 struct ifreq *ifr = (struct ifreq *)data;
1450 if (ifr->ifr_mtu < OVPN_MTU_MIN || ifr->ifr_mtu > OVPN_MTU_MAX)
1451 return (EINVAL);
1452
1453 ifp->if_mtu = ifr->ifr_mtu;
1454 return (0);
1455 }
1456 case SIOCSIFADDR:
1457 case SIOCADDMULTI:
1458 case SIOCDELMULTI:
1459 case SIOCGIFMTU:
1460 case SIOCSIFFLAGS:
1461 return (0);
1462 default:
1463 error = EINVAL;
1464 }
1465
1466 return (error);
1467 }
1468
1469 static int
ovpn_encrypt_tx_cb(struct cryptop * crp)1470 ovpn_encrypt_tx_cb(struct cryptop *crp)
1471 {
1472 struct epoch_tracker et;
1473 struct ovpn_kpeer *peer = crp->crp_opaque;
1474 struct ovpn_softc *sc = peer->sc;
1475 struct mbuf *m = crp->crp_buf.cb_mbuf;
1476 int tunnel_len;
1477 int ret;
1478
1479 CURVNET_SET(sc->ifp->if_vnet);
1480 NET_EPOCH_ENTER(et);
1481
1482 if (crp->crp_etype != 0) {
1483 crypto_freereq(crp);
1484 ovpn_peer_release_ref(peer, false);
1485 NET_EPOCH_EXIT(et);
1486 CURVNET_RESTORE();
1487 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1);
1488 m_freem(m);
1489 return (0);
1490 }
1491
1492 MPASS(crp->crp_buf.cb_type == CRYPTO_BUF_MBUF);
1493
1494 tunnel_len = m->m_pkthdr.len - sizeof(struct ovpn_wire_header);
1495 ret = ovpn_encap(sc, peer->peerid, m);
1496 if (ret == 0) {
1497 OVPN_COUNTER_ADD(sc, sent_data_pkts, 1);
1498 OVPN_COUNTER_ADD(sc, tunnel_bytes_sent, tunnel_len);
1499 }
1500
1501 crypto_freereq(crp);
1502 ovpn_peer_release_ref(peer, false);
1503
1504 NET_EPOCH_EXIT(et);
1505 CURVNET_RESTORE();
1506
1507 return (0);
1508 }
1509
1510 static void
ovpn_finish_rx(struct ovpn_softc * sc,struct mbuf * m,struct ovpn_kpeer * peer,struct ovpn_kkey * key,uint32_t seq,struct rm_priotracker * _ovpn_lock_trackerp)1511 ovpn_finish_rx(struct ovpn_softc *sc, struct mbuf *m,
1512 struct ovpn_kpeer *peer, struct ovpn_kkey *key, uint32_t seq,
1513 struct rm_priotracker *_ovpn_lock_trackerp)
1514 {
1515 uint32_t af;
1516
1517 OVPN_RASSERT(sc);
1518 NET_EPOCH_ASSERT();
1519
1520 /* Replay protection. */
1521 if (V_replay_protection && ! ovpn_check_replay(key->decrypt, seq)) {
1522 OVPN_RUNLOCK(sc);
1523 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1);
1524 m_freem(m);
1525 return;
1526 }
1527
1528 critical_enter();
1529 *zpcpu_get(peer->last_active) = time_uptime;
1530 critical_exit();
1531
1532 OVPN_RUNLOCK(sc);
1533
1534 OVPN_COUNTER_ADD(sc, received_data_pkts, 1);
1535 OVPN_COUNTER_ADD(sc, tunnel_bytes_received, m->m_pkthdr.len);
1536 OVPN_PEER_COUNTER_ADD(peer, pkt_in, 1);
1537 OVPN_PEER_COUNTER_ADD(peer, bytes_in, m->m_pkthdr.len);
1538
1539 /* Receive the packet on our interface. */
1540 m->m_pkthdr.rcvif = sc->ifp;
1541
1542 /* Clear checksum flags in case the real hardware set them. */
1543 m->m_pkthdr.csum_flags = 0;
1544
1545 /* Clear mbuf tags & flags */
1546 m_tag_delete_nonpersistent(m);
1547 m_clrprotoflags(m);
1548
1549 /* Ensure we can read the first byte. */
1550 m = m_pullup(m, 1);
1551 if (m == NULL) {
1552 OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1);
1553 return;
1554 }
1555
1556 /*
1557 * Check for address family, and disregard any control packets (e.g.
1558 * keepalive).
1559 */
1560 af = ovpn_get_af(m);
1561 if (af != 0) {
1562 BPF_MTAP2(sc->ifp, &af, sizeof(af), m);
1563 if (V_async_netisr_queue)
1564 netisr_queue(af == AF_INET ? NETISR_IP : NETISR_IPV6, m);
1565 else
1566 netisr_dispatch(af == AF_INET ? NETISR_IP : NETISR_IPV6, m);
1567 } else {
1568 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1);
1569 m_freem(m);
1570 }
1571 }
1572
1573 static struct ovpn_kkey *
ovpn_find_key(struct ovpn_softc * sc,struct ovpn_kpeer * peer,const struct ovpn_wire_header * ohdr)1574 ovpn_find_key(struct ovpn_softc *sc, struct ovpn_kpeer *peer,
1575 const struct ovpn_wire_header *ohdr)
1576 {
1577 struct ovpn_kkey *key = NULL;
1578 uint8_t keyid;
1579
1580 OVPN_RASSERT(sc);
1581
1582 keyid = (ntohl(ohdr->opcode) >> 24) & 0x07;
1583
1584 if (peer->keys[0].keyid == keyid)
1585 key = &peer->keys[0];
1586 else if (peer->keys[1].keyid == keyid)
1587 key = &peer->keys[1];
1588
1589 return (key);
1590 }
1591
1592 static int
ovpn_decrypt_rx_cb(struct cryptop * crp)1593 ovpn_decrypt_rx_cb(struct cryptop *crp)
1594 {
1595 struct epoch_tracker et;
1596 struct ovpn_softc *sc = crp->crp_opaque;
1597 struct mbuf *m = crp->crp_buf.cb_mbuf;
1598 struct ovpn_kkey *key;
1599 struct ovpn_kpeer *peer;
1600 struct ovpn_wire_header *ohdr;
1601 uint32_t peerid;
1602
1603 OVPN_RLOCK_TRACKER;
1604
1605 OVPN_RLOCK(sc);
1606
1607 MPASS(crp->crp_buf.cb_type == CRYPTO_BUF_MBUF);
1608
1609 if (crp->crp_etype != 0) {
1610 crypto_freereq(crp);
1611 atomic_add_int(&sc->refcount, -1);
1612 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1);
1613 OVPN_RUNLOCK(sc);
1614 m_freem(m);
1615 return (0);
1616 }
1617
1618 CURVNET_SET(sc->ifp->if_vnet);
1619
1620 ohdr = mtodo(m, sizeof(struct udphdr));
1621
1622 peerid = ntohl(ohdr->opcode) & 0x00ffffff;
1623 peer = ovpn_find_peer(sc, peerid);
1624 if (peer == NULL) {
1625 /* No such peer. Drop packet. */
1626 crypto_freereq(crp);
1627 atomic_add_int(&sc->refcount, -1);
1628 OVPN_RUNLOCK(sc);
1629 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1);
1630 m_freem(m);
1631 CURVNET_RESTORE();
1632 return (0);
1633 }
1634
1635 key = ovpn_find_key(sc, peer, ohdr);
1636 if (key == NULL) {
1637 crypto_freereq(crp);
1638 atomic_add_int(&sc->refcount, -1);
1639 /*
1640 * Has this key been removed between us starting the decrypt
1641 * and finishing it?
1642 */
1643 OVPN_RUNLOCK(sc);
1644 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1);
1645 m_freem(m);
1646 CURVNET_RESTORE();
1647 return (0);
1648 }
1649
1650 /* Now remove the outer headers */
1651 m_adj_decap(m, sizeof(struct udphdr) +
1652 sizeof(struct ovpn_wire_header));
1653
1654 NET_EPOCH_ENTER(et);
1655 ovpn_finish_rx(sc, m, peer, key, ntohl(ohdr->seq), _ovpn_lock_trackerp);
1656 NET_EPOCH_EXIT(et);
1657 OVPN_UNLOCK_ASSERT(sc);
1658
1659 CURVNET_RESTORE();
1660
1661 crypto_freereq(crp);
1662 atomic_add_int(&sc->refcount, -1);
1663
1664 return (0);
1665 }
1666
1667 static int
ovpn_get_af(struct mbuf * m)1668 ovpn_get_af(struct mbuf *m)
1669 {
1670 struct ip *ip;
1671 struct ip6_hdr *ip6;
1672
1673 /*
1674 * We should pullup, but we're only interested in the first byte, so
1675 * that'll always be contiguous.
1676 */
1677 ip = mtod(m, struct ip *);
1678 if (ip->ip_v == IPVERSION)
1679 return (AF_INET);
1680
1681 ip6 = mtod(m, struct ip6_hdr *);
1682 if ((ip6->ip6_vfc & IPV6_VERSION_MASK) == IPV6_VERSION)
1683 return (AF_INET6);
1684
1685 return (0);
1686 }
1687
1688 #ifdef INET
1689 static struct ovpn_kpeer *
ovpn_find_peer_by_ip(struct ovpn_softc * sc,const struct in_addr addr)1690 ovpn_find_peer_by_ip(struct ovpn_softc *sc, const struct in_addr addr)
1691 {
1692 struct ovpn_kpeer *peer = NULL;
1693
1694 OVPN_ASSERT(sc);
1695
1696 /* TODO: Add a second RB so we can look up by IP. */
1697 RB_FOREACH(peer, ovpn_kpeers, &sc->peers) {
1698 if (addr.s_addr == peer->vpn4.s_addr)
1699 return (peer);
1700 }
1701
1702 return (peer);
1703 }
1704 #endif
1705
1706 #ifdef INET6
1707 static struct ovpn_kpeer *
ovpn_find_peer_by_ip6(struct ovpn_softc * sc,const struct in6_addr * addr)1708 ovpn_find_peer_by_ip6(struct ovpn_softc *sc, const struct in6_addr *addr)
1709 {
1710 struct ovpn_kpeer *peer = NULL;
1711
1712 OVPN_ASSERT(sc);
1713
1714 /* TODO: Add a third RB so we can look up by IPv6 address. */
1715 RB_FOREACH(peer, ovpn_kpeers, &sc->peers) {
1716 if (memcmp(addr, &peer->vpn6, sizeof(*addr)) == 0)
1717 return (peer);
1718 }
1719
1720 return (peer);
1721 }
1722 #endif
1723
1724 static struct ovpn_kpeer *
ovpn_route_peer(struct ovpn_softc * sc,struct mbuf ** m0,const struct sockaddr * dst)1725 ovpn_route_peer(struct ovpn_softc *sc, struct mbuf **m0,
1726 const struct sockaddr *dst)
1727 {
1728 struct ovpn_kpeer *peer = NULL;
1729 int af;
1730
1731 NET_EPOCH_ASSERT();
1732 OVPN_ASSERT(sc);
1733
1734 /* Shortcut if we're a client (or are a server and have only one client). */
1735 if (sc->peercount == 1)
1736 return (ovpn_find_only_peer(sc));
1737
1738 if (dst != NULL)
1739 af = dst->sa_family;
1740 else
1741 af = ovpn_get_af(*m0);
1742
1743 switch (af) {
1744 #ifdef INET
1745 case AF_INET: {
1746 const struct sockaddr_in *sa = (const struct sockaddr_in *)dst;
1747 struct nhop_object *nh;
1748 const struct in_addr *ip_dst;
1749
1750 if (sa != NULL) {
1751 ip_dst = &sa->sin_addr;
1752 } else {
1753 struct ip *ip;
1754
1755 *m0 = m_pullup(*m0, sizeof(struct ip));
1756 if (*m0 == NULL)
1757 return (NULL);
1758 ip = mtod(*m0, struct ip *);
1759 ip_dst = &ip->ip_dst;
1760 }
1761
1762 peer = ovpn_find_peer_by_ip(sc, *ip_dst);
1763 SDT_PROBE2(if_ovpn, tx, route, ip4, ip_dst, peer);
1764 if (peer == NULL) {
1765 nh = fib4_lookup(M_GETFIB(*m0), *ip_dst, 0,
1766 NHR_NONE, 0);
1767 if (nh && (nh->nh_flags & NHF_GATEWAY)) {
1768 peer = ovpn_find_peer_by_ip(sc,
1769 nh->gw4_sa.sin_addr);
1770 SDT_PROBE2(if_ovpn, tx, route, ip4,
1771 &nh->gw4_sa.sin_addr, peer);
1772 }
1773 }
1774 break;
1775 }
1776 #endif
1777 #ifdef INET6
1778 case AF_INET6: {
1779 const struct sockaddr_in6 *sa6 =
1780 (const struct sockaddr_in6 *)dst;
1781 struct nhop_object *nh;
1782 const struct in6_addr *ip6_dst;
1783
1784 if (sa6 != NULL) {
1785 ip6_dst = &sa6->sin6_addr;
1786 } else {
1787 struct ip6_hdr *ip6;
1788
1789 *m0 = m_pullup(*m0, sizeof(struct ip6_hdr));
1790 if (*m0 == NULL)
1791 return (NULL);
1792 ip6 = mtod(*m0, struct ip6_hdr *);
1793 ip6_dst = &ip6->ip6_dst;
1794 }
1795
1796 peer = ovpn_find_peer_by_ip6(sc, ip6_dst);
1797 SDT_PROBE2(if_ovpn, tx, route, ip6, ip6_dst, peer);
1798 if (peer == NULL) {
1799 nh = fib6_lookup(M_GETFIB(*m0), ip6_dst, 0,
1800 NHR_NONE, 0);
1801 if (nh && (nh->nh_flags & NHF_GATEWAY)) {
1802 peer = ovpn_find_peer_by_ip6(sc,
1803 &nh->gw6_sa.sin6_addr);
1804 SDT_PROBE2(if_ovpn, tx, route, ip6,
1805 &nh->gw6_sa.sin6_addr, peer);
1806 }
1807 }
1808 break;
1809 }
1810 #endif
1811 }
1812
1813 return (peer);
1814 }
1815
1816 static int
ovpn_transmit(struct ifnet * ifp,struct mbuf * m)1817 ovpn_transmit(struct ifnet *ifp, struct mbuf *m)
1818 {
1819 return (ifp->if_output(ifp, m, NULL, NULL));
1820 }
1821
1822 static int
ovpn_transmit_to_peer(struct ifnet * ifp,struct mbuf * m,struct ovpn_kpeer * peer,struct rm_priotracker * _ovpn_lock_trackerp)1823 ovpn_transmit_to_peer(struct ifnet *ifp, struct mbuf *m,
1824 struct ovpn_kpeer *peer, struct rm_priotracker *_ovpn_lock_trackerp)
1825 {
1826 struct ovpn_wire_header *ohdr;
1827 struct ovpn_kkey *key;
1828 struct ovpn_softc *sc;
1829 struct cryptop *crp;
1830 uint32_t af, seq;
1831 uint64_t seq64;
1832 size_t len, ovpn_hdr_len;
1833 int tunnel_len;
1834 int ret;
1835
1836 sc = ifp->if_softc;
1837
1838 OVPN_RASSERT(sc);
1839
1840 tunnel_len = m->m_pkthdr.len;
1841
1842 key = &peer->keys[OVPN_KEY_SLOT_PRIMARY];
1843 if (key->encrypt == NULL) {
1844 if (_ovpn_lock_trackerp != NULL)
1845 OVPN_RUNLOCK(sc);
1846 m_freem(m);
1847 return (ENOLINK);
1848 }
1849
1850 af = ovpn_get_af(m);
1851 /* Don't capture control packets. */
1852 if (af != 0)
1853 BPF_MTAP2(ifp, &af, sizeof(af), m);
1854
1855 if (__predict_false(if_tunnel_check_nesting(ifp, m, MTAG_OVPN_LOOP, 3))) {
1856 if (_ovpn_lock_trackerp != NULL)
1857 OVPN_RUNLOCK(sc);
1858 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1);
1859 m_freem(m);
1860 return (ELOOP);
1861 }
1862
1863 len = m->m_pkthdr.len;
1864 MPASS(len <= ifp->if_mtu);
1865
1866 ovpn_hdr_len = sizeof(struct ovpn_wire_header);
1867 if (key->encrypt->cipher == OVPN_CIPHER_ALG_NONE)
1868 ovpn_hdr_len -= 16; /* No auth tag. */
1869
1870 M_PREPEND(m, ovpn_hdr_len, M_NOWAIT);
1871 if (m == NULL) {
1872 if (_ovpn_lock_trackerp != NULL)
1873 OVPN_RUNLOCK(sc);
1874 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1);
1875 return (ENOBUFS);
1876 }
1877 ohdr = mtod(m, struct ovpn_wire_header *);
1878 ohdr->opcode = (OVPN_OP_DATA_V2 << OVPN_OP_SHIFT) | key->keyid;
1879 ohdr->opcode <<= 24;
1880 ohdr->opcode |= key->peerid;
1881 ohdr->opcode = htonl(ohdr->opcode);
1882
1883 seq64 = atomic_fetchadd_64(&peer->keys[OVPN_KEY_SLOT_PRIMARY].encrypt->tx_seq, 1);
1884 if (seq64 == OVPN_SEQ_ROTATE) {
1885 ovpn_notify_key_rotation(sc, peer);
1886 } else if (seq64 > UINT32_MAX) {
1887 /* We've wrapped, give up on this packet. */
1888 if (_ovpn_lock_trackerp != NULL)
1889 OVPN_RUNLOCK(sc);
1890 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1);
1891
1892 /* Let's avoid (very unlikely, but still) wraparounds of the
1893 * 64-bit counter taking us back to 0. */
1894 atomic_store_64(&peer->keys[OVPN_KEY_SLOT_PRIMARY].encrypt->tx_seq,
1895 UINT32_MAX);
1896
1897 return (ENOBUFS);
1898 }
1899
1900 seq = htonl(seq64 & UINT32_MAX);
1901 ohdr->seq = seq;
1902
1903 OVPN_PEER_COUNTER_ADD(peer, pkt_out, 1);
1904 OVPN_PEER_COUNTER_ADD(peer, bytes_out, len);
1905
1906 if (key->encrypt->cipher == OVPN_CIPHER_ALG_NONE) {
1907 ret = ovpn_encap(sc, peer->peerid, m);
1908 if (_ovpn_lock_trackerp != NULL)
1909 OVPN_RUNLOCK(sc);
1910 if (ret == 0) {
1911 OVPN_COUNTER_ADD(sc, sent_data_pkts, 1);
1912 OVPN_COUNTER_ADD(sc, tunnel_bytes_sent, tunnel_len);
1913 }
1914 return (ret);
1915 }
1916
1917 crp = crypto_getreq(key->encrypt->cryptoid, M_NOWAIT);
1918 if (crp == NULL) {
1919 if (_ovpn_lock_trackerp != NULL)
1920 OVPN_RUNLOCK(sc);
1921 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1);
1922 m_freem(m);
1923 return (ENOBUFS);
1924 }
1925
1926 /* Encryption covers only the payload, not the header. */
1927 crp->crp_payload_start = sizeof(*ohdr);
1928 crp->crp_payload_length = len;
1929 crp->crp_op = CRYPTO_OP_ENCRYPT;
1930
1931 /*
1932 * AAD data covers the ovpn_wire_header minus the auth
1933 * tag.
1934 */
1935 crp->crp_aad_length = sizeof(*ohdr) - sizeof(ohdr->auth_tag);
1936 crp->crp_aad = ohdr;
1937 crp->crp_aad_start = 0;
1938 crp->crp_op |= CRYPTO_OP_COMPUTE_DIGEST;
1939 crp->crp_digest_start = offsetof(struct ovpn_wire_header, auth_tag);
1940
1941 crp->crp_flags |= CRYPTO_F_IV_SEPARATE;
1942 memcpy(crp->crp_iv, &seq, sizeof(seq));
1943 memcpy(crp->crp_iv + sizeof(seq), key->encrypt->nonce,
1944 key->encrypt->noncelen);
1945
1946 crypto_use_mbuf(crp, m);
1947 crp->crp_flags |= CRYPTO_F_CBIFSYNC;
1948 crp->crp_callback = ovpn_encrypt_tx_cb;
1949 crp->crp_opaque = peer;
1950
1951 atomic_add_int(&peer->refcount, 1);
1952 if (_ovpn_lock_trackerp != NULL)
1953 OVPN_RUNLOCK(sc);
1954 if (V_async_crypto)
1955 ret = crypto_dispatch_async(crp, CRYPTO_ASYNC_ORDERED);
1956 else
1957 ret = crypto_dispatch(crp);
1958 if (ret) {
1959 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1);
1960 }
1961
1962 return (ret);
1963 }
1964
1965 /*
1966 * Note: Expects to hold the read lock on entry, and will release it itself.
1967 */
1968 static int
ovpn_encap(struct ovpn_softc * sc,uint32_t peerid,struct mbuf * m)1969 ovpn_encap(struct ovpn_softc *sc, uint32_t peerid, struct mbuf *m)
1970 {
1971 struct udphdr *udp;
1972 struct ovpn_kpeer *peer;
1973 int len;
1974
1975 OVPN_RLOCK_TRACKER;
1976
1977 OVPN_RLOCK(sc);
1978 NET_EPOCH_ASSERT();
1979
1980 peer = ovpn_find_peer(sc, peerid);
1981 if (peer == NULL || sc->ifp->if_link_state != LINK_STATE_UP) {
1982 OVPN_RUNLOCK(sc);
1983 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1);
1984 m_freem(m);
1985 return (ENETDOWN);
1986 }
1987
1988 len = m->m_pkthdr.len;
1989
1990 M_PREPEND(m, sizeof(struct udphdr), M_NOWAIT);
1991 if (m == NULL) {
1992 OVPN_RUNLOCK(sc);
1993 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1);
1994 m_freem(m);
1995 return (ENOBUFS);
1996 }
1997 udp = mtod(m, struct udphdr *);
1998
1999 MPASS(peer->local.ss_family == peer->remote.ss_family);
2000
2001 udp->uh_sport = ovpn_get_port(&peer->local);
2002 udp->uh_dport = ovpn_get_port(&peer->remote);
2003 udp->uh_ulen = htons(sizeof(struct udphdr) + len);
2004
2005 switch (peer->remote.ss_family) {
2006 #ifdef INET
2007 case AF_INET: {
2008 struct sockaddr_in *in_local = TO_IN(&peer->local);
2009 struct sockaddr_in *in_remote = TO_IN(&peer->remote);
2010 struct ip *ip;
2011
2012 /*
2013 * This requires knowing the source IP, which we don't. Happily
2014 * we're allowed to keep this at 0, and the checksum won't do
2015 * anything the crypto won't already do.
2016 */
2017 udp->uh_sum = 0;
2018
2019 /* Set the checksum flags so we recalculate checksums. */
2020 m->m_pkthdr.csum_flags |= CSUM_IP;
2021 m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
2022
2023 M_PREPEND(m, sizeof(struct ip), M_NOWAIT);
2024 if (m == NULL) {
2025 OVPN_RUNLOCK(sc);
2026 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1);
2027 return (ENOBUFS);
2028 }
2029 ip = mtod(m, struct ip *);
2030
2031 ip->ip_tos = 0;
2032 ip->ip_len = htons(sizeof(struct ip) + sizeof(struct udphdr) +
2033 len);
2034 ip->ip_off = 0;
2035 ip->ip_ttl = V_ip_defttl;
2036 ip->ip_p = IPPROTO_UDP;
2037 ip->ip_sum = 0;
2038 if (in_local->sin_port != 0)
2039 ip->ip_src = in_local->sin_addr;
2040 else
2041 ip->ip_src.s_addr = INADDR_ANY;
2042 ip->ip_dst = in_remote->sin_addr;
2043
2044 OVPN_RUNLOCK(sc);
2045 OVPN_COUNTER_ADD(sc, transport_bytes_sent, m->m_pkthdr.len);
2046
2047 return (ip_output(m, NULL, NULL, 0, NULL, NULL));
2048 }
2049 #endif
2050 #ifdef INET6
2051 case AF_INET6: {
2052 struct sockaddr_in6 *in6_local = TO_IN6(&peer->local);
2053 struct sockaddr_in6 *in6_remote = TO_IN6(&peer->remote);
2054 struct ip6_hdr *ip6;
2055
2056 M_PREPEND(m, sizeof(struct ip6_hdr), M_NOWAIT);
2057 if (m == NULL) {
2058 OVPN_RUNLOCK(sc);
2059 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1);
2060 return (ENOBUFS);
2061 }
2062 m = m_pullup(m, sizeof(*ip6) + sizeof(*udp));
2063 if (m == NULL) {
2064 OVPN_RUNLOCK(sc);
2065 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1);
2066 return (ENOBUFS);
2067 }
2068
2069 ip6 = mtod(m, struct ip6_hdr *);
2070
2071 ip6->ip6_vfc = IPV6_VERSION;
2072 ip6->ip6_flow &= ~IPV6_FLOWINFO_MASK;
2073 ip6->ip6_plen = htons(sizeof(*ip6) + sizeof(struct udphdr) +
2074 len);
2075 ip6->ip6_nxt = IPPROTO_UDP;
2076 ip6->ip6_hlim = V_ip6_defhlim;
2077
2078 memcpy(&ip6->ip6_src, &in6_local->sin6_addr,
2079 sizeof(ip6->ip6_src));
2080 memcpy(&ip6->ip6_dst, &in6_remote->sin6_addr,
2081 sizeof(ip6->ip6_dst));
2082
2083 udp = mtodo(m, sizeof(*ip6));
2084 udp->uh_sum = in6_cksum_pseudo(ip6,
2085 m->m_pkthdr.len - sizeof(struct ip6_hdr),
2086 IPPROTO_UDP, 0);
2087
2088 m->m_pkthdr.csum_flags |= CSUM_UDP_IPV6;
2089 m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
2090
2091 OVPN_RUNLOCK(sc);
2092 OVPN_COUNTER_ADD(sc, transport_bytes_sent, m->m_pkthdr.len);
2093
2094 return (ip6_output(m, NULL, NULL, IPV6_UNSPECSRC, NULL, NULL,
2095 NULL));
2096 }
2097 #endif
2098 default:
2099 panic("Unsupported address family %d",
2100 peer->remote.ss_family);
2101 }
2102 }
2103
2104 static int
ovpn_output(struct ifnet * ifp,struct mbuf * m,const struct sockaddr * dst,struct route * ro)2105 ovpn_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
2106 struct route *ro)
2107 {
2108 struct ovpn_softc *sc;
2109 struct ovpn_kpeer *peer;
2110
2111 OVPN_RLOCK_TRACKER;
2112
2113 sc = ifp->if_softc;
2114
2115 m = m_unshare(m, M_NOWAIT);
2116 if (m == NULL) {
2117 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1);
2118 return (ENOBUFS);
2119 }
2120
2121 OVPN_RLOCK(sc);
2122
2123 SDT_PROBE1(if_ovpn, tx, transmit, start, m);
2124
2125 if (__predict_false(ifp->if_link_state != LINK_STATE_UP)) {
2126 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1);
2127 OVPN_RUNLOCK(sc);
2128 m_freem(m);
2129 return (ENETDOWN);
2130 }
2131
2132 /**
2133 * Only obey 'dst' (i.e. the gateway) if no route is supplied.
2134 * That's our indication that we're being called through pf's route-to,
2135 * and we should route according to 'dst' instead. We can't do so
2136 * consistently, because the usual openvpn configuration sets the first
2137 * non-server IP in the subnet as the gateway. If we always use that
2138 * one we'd end up routing all traffic to the first client.
2139 * tl;dr: 'ro == NULL' tells us pf is doing a route-to, and then but
2140 * only then, we should treat 'dst' as the destination. */
2141 peer = ovpn_route_peer(sc, &m, ro == NULL ? dst : NULL);
2142 if (peer == NULL) {
2143 /* No destination. */
2144 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1);
2145 OVPN_RUNLOCK(sc);
2146 m_freem(m);
2147 return (ENETDOWN);
2148 }
2149
2150 return (ovpn_transmit_to_peer(ifp, m, peer, _ovpn_lock_trackerp));
2151 }
2152
2153 static bool
ovpn_check_replay(struct ovpn_kkey_dir * key,uint32_t seq)2154 ovpn_check_replay(struct ovpn_kkey_dir *key, uint32_t seq)
2155 {
2156 uint32_t d;
2157
2158 mtx_lock(&key->replay_mtx);
2159
2160 /* Sequence number must be strictly greater than rx_seq */
2161 if (seq <= key->rx_seq) {
2162 mtx_unlock(&key->replay_mtx);
2163 return (false);
2164 }
2165
2166 /* Large jump. The packet authenticated okay, so just accept that. */
2167 if (seq > (key->rx_seq + (sizeof(key->rx_window) * 8))) {
2168 key->rx_seq = seq;
2169 key->rx_window = 0;
2170 mtx_unlock(&key->replay_mtx);
2171 return (true);
2172 }
2173
2174 /* Happy case. */
2175 if ((seq == key->rx_seq + 1) && key->rx_window == 0) {
2176 key->rx_seq++;
2177 mtx_unlock(&key->replay_mtx);
2178 return (true);
2179 }
2180
2181 d = seq - key->rx_seq - 1;
2182
2183 if (key->rx_window & ((uint64_t)1 << d)) {
2184 /* Dupe! */
2185 mtx_unlock(&key->replay_mtx);
2186 return (false);
2187 }
2188
2189 key->rx_window |= (uint64_t)1 << d;
2190
2191 while (key->rx_window & 1) {
2192 key->rx_seq++;
2193 key->rx_window >>= 1;
2194 }
2195
2196 mtx_unlock(&key->replay_mtx);
2197
2198 return (true);
2199 }
2200
2201 static struct ovpn_kpeer *
ovpn_peer_from_mbuf(struct ovpn_softc * sc,struct mbuf * m,int off)2202 ovpn_peer_from_mbuf(struct ovpn_softc *sc, struct mbuf *m, int off)
2203 {
2204 struct ovpn_wire_header ohdr;
2205 uint32_t peerid;
2206 const size_t hdrlen = sizeof(ohdr) - sizeof(ohdr.auth_tag);
2207
2208 OVPN_RASSERT(sc);
2209
2210 if (m_length(m, NULL) < (off + sizeof(struct udphdr) + hdrlen))
2211 return (NULL);
2212
2213 m_copydata(m, off + sizeof(struct udphdr), hdrlen, (caddr_t)&ohdr);
2214
2215 peerid = ntohl(ohdr.opcode) & 0x00ffffff;
2216
2217 return (ovpn_find_peer(sc, peerid));
2218 }
2219
2220 static bool
ovpn_udp_input(struct mbuf * m,int off,struct inpcb * inp,const struct sockaddr * sa,void * ctx)2221 ovpn_udp_input(struct mbuf *m, int off, struct inpcb *inp,
2222 const struct sockaddr *sa, void *ctx)
2223 {
2224 struct ovpn_softc *sc = ctx;
2225 struct ovpn_wire_header tmphdr;
2226 struct ovpn_wire_header *ohdr;
2227 struct udphdr *uhdr;
2228 struct ovpn_kkey *key;
2229 struct cryptop *crp;
2230 struct ovpn_kpeer *peer;
2231 size_t ohdrlen;
2232 int ret;
2233 uint8_t op;
2234
2235 OVPN_RLOCK_TRACKER;
2236
2237 M_ASSERTPKTHDR(m);
2238
2239 m = m_unshare(m, M_NOWAIT);
2240 if (m == NULL) {
2241 OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1);
2242 return (true);
2243 }
2244
2245 OVPN_COUNTER_ADD(sc, transport_bytes_received, m->m_pkthdr.len - off);
2246
2247 ohdrlen = sizeof(*ohdr) - sizeof(ohdr->auth_tag);
2248
2249 OVPN_RLOCK(sc);
2250
2251 peer = ovpn_peer_from_mbuf(sc, m, off);
2252 if (peer == NULL) {
2253 OVPN_RUNLOCK(sc);
2254 return (false);
2255 }
2256
2257 if (m_length(m, NULL) < (off + sizeof(*uhdr) + ohdrlen)) {
2258 /* Short packet. */
2259 OVPN_RUNLOCK(sc);
2260 return (false);
2261 }
2262
2263 m_copydata(m, off + sizeof(*uhdr), ohdrlen, (caddr_t)&tmphdr);
2264
2265 op = ntohl(tmphdr.opcode) >> 24 >> OVPN_OP_SHIFT;
2266 if (op != OVPN_OP_DATA_V2) {
2267 /* Control packet? */
2268 OVPN_RUNLOCK(sc);
2269 return (false);
2270 }
2271
2272 m = m_pullup(m, off + sizeof(*uhdr) + ohdrlen);
2273 if (m == NULL) {
2274 OVPN_RUNLOCK(sc);
2275 OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1);
2276 return (true);
2277 }
2278
2279 /*
2280 * Simplify things by getting rid of the preceding headers, we don't
2281 * care about them.
2282 */
2283 m_adj_decap(m, off);
2284
2285 uhdr = mtodo(m, 0);
2286 ohdr = mtodo(m, sizeof(*uhdr));
2287
2288 key = ovpn_find_key(sc, peer, ohdr);
2289 if (key == NULL || key->decrypt == NULL) {
2290 OVPN_RUNLOCK(sc);
2291 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1);
2292 m_freem(m);
2293 return (true);
2294 }
2295
2296 if (key->decrypt->cipher == OVPN_CIPHER_ALG_NONE) {
2297 /* Now remove the outer headers */
2298 m_adj_decap(m, sizeof(struct udphdr) + ohdrlen);
2299
2300 ohdr = mtodo(m, sizeof(*uhdr));
2301
2302 ovpn_finish_rx(sc, m, peer, key, ntohl(ohdr->seq),
2303 _ovpn_lock_trackerp);
2304 OVPN_UNLOCK_ASSERT(sc);
2305 return (true);
2306 }
2307
2308 ohdrlen += sizeof(ohdr->auth_tag);
2309
2310 m = m_pullup(m, sizeof(*uhdr) + ohdrlen);
2311 if (m == NULL) {
2312 OVPN_RUNLOCK(sc);
2313 OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1);
2314 return (true);
2315 }
2316 uhdr = mtodo(m, 0);
2317 ohdr = mtodo(m, sizeof(*uhdr));
2318
2319 /* Decrypt */
2320 crp = crypto_getreq(key->decrypt->cryptoid, M_NOWAIT);
2321 if (crp == NULL) {
2322 OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1);
2323 OVPN_RUNLOCK(sc);
2324 m_freem(m);
2325 return (true);
2326 }
2327
2328 crp->crp_payload_start = sizeof(struct udphdr) + sizeof(*ohdr);
2329 crp->crp_payload_length = ntohs(uhdr->uh_ulen) -
2330 sizeof(*uhdr) - sizeof(*ohdr);
2331 crp->crp_op = CRYPTO_OP_DECRYPT;
2332
2333 /* AAD validation. */
2334 crp->crp_aad_length = sizeof(*ohdr) - sizeof(ohdr->auth_tag);
2335 crp->crp_aad = ohdr;
2336 crp->crp_aad_start = 0;
2337 crp->crp_op |= CRYPTO_OP_VERIFY_DIGEST;
2338 crp->crp_digest_start = sizeof(struct udphdr) +
2339 offsetof(struct ovpn_wire_header, auth_tag);
2340
2341 crp->crp_flags |= CRYPTO_F_IV_SEPARATE;
2342 memcpy(crp->crp_iv, &ohdr->seq, sizeof(ohdr->seq));
2343 memcpy(crp->crp_iv + sizeof(ohdr->seq), key->decrypt->nonce,
2344 key->decrypt->noncelen);
2345
2346 crypto_use_mbuf(crp, m);
2347 crp->crp_flags |= CRYPTO_F_CBIFSYNC;
2348 crp->crp_callback = ovpn_decrypt_rx_cb;
2349 crp->crp_opaque = sc;
2350
2351 atomic_add_int(&sc->refcount, 1);
2352 OVPN_RUNLOCK(sc);
2353 if (V_async_crypto)
2354 ret = crypto_dispatch_async(crp, CRYPTO_ASYNC_ORDERED);
2355 else
2356 ret = crypto_dispatch(crp);
2357 if (ret != 0) {
2358 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1);
2359 }
2360
2361 return (true);
2362 }
2363
2364 static void
ovpn_qflush(struct ifnet * ifp __unused)2365 ovpn_qflush(struct ifnet *ifp __unused)
2366 {
2367
2368 }
2369
2370 static void
ovpn_flush_rxring(struct ovpn_softc * sc)2371 ovpn_flush_rxring(struct ovpn_softc *sc)
2372 {
2373 struct ovpn_notification *n;
2374
2375 OVPN_WASSERT(sc);
2376
2377 while (! buf_ring_empty(sc->notifring)) {
2378 n = buf_ring_dequeue_sc(sc->notifring);
2379 free(n, M_OVPN);
2380 }
2381 }
2382
2383 #ifdef VIMAGE
2384 static void
ovpn_reassign(struct ifnet * ifp,struct vnet * new_vnet __unused,char * unused __unused)2385 ovpn_reassign(struct ifnet *ifp, struct vnet *new_vnet __unused,
2386 char *unused __unused)
2387 {
2388 struct ovpn_softc *sc = ifp->if_softc;
2389 struct ovpn_kpeer *peer, *tmppeer;
2390 int ret __diagused;
2391
2392 OVPN_WLOCK(sc);
2393
2394 /* Flush keys & configuration. */
2395 RB_FOREACH_SAFE(peer, ovpn_kpeers, &sc->peers, tmppeer) {
2396 peer->del_reason = OVPN_DEL_REASON_REQUESTED;
2397 ret = _ovpn_del_peer(sc, peer);
2398 MPASS(ret == 0);
2399 }
2400
2401 ovpn_flush_rxring(sc);
2402
2403 OVPN_WUNLOCK(sc);
2404 }
2405 #endif
2406
2407 static int
ovpn_clone_match(struct if_clone * ifc,const char * name)2408 ovpn_clone_match(struct if_clone *ifc, const char *name)
2409 {
2410 /*
2411 * Allow all names that start with 'ovpn', specifically because pfSense
2412 * uses ovpnc1 / ovpns2
2413 */
2414 return (strncmp(ovpnname, name, strlen(ovpnname)) == 0);
2415 }
2416
2417 static int
ovpn_clone_create(struct if_clone * ifc,char * name,size_t len,struct ifc_data * ifd,struct ifnet ** ifpp)2418 ovpn_clone_create(struct if_clone *ifc, char *name, size_t len,
2419 struct ifc_data *ifd, struct ifnet **ifpp)
2420 {
2421 struct ovpn_softc *sc;
2422 struct ifnet *ifp;
2423 char *dp;
2424 int error, unit, wildcard;
2425
2426 /* Try to see if a special unit was requested. */
2427 error = ifc_name2unit(name, &unit);
2428 if (error != 0)
2429 return (error);
2430 wildcard = (unit < 0);
2431
2432 error = ifc_alloc_unit(ifc, &unit);
2433 if (error != 0)
2434 return (error);
2435
2436 /*
2437 * If no unit had been given, we need to adjust the ifName.
2438 */
2439 for (dp = name; *dp != '\0'; dp++);
2440 if (wildcard) {
2441 error = snprintf(dp, len - (dp - name), "%d", unit);
2442 if (error > len - (dp - name)) {
2443 /* ifName too long. */
2444 ifc_free_unit(ifc, unit);
2445 return (ENOSPC);
2446 }
2447 dp += error;
2448 }
2449
2450 /* Make sure it doesn't already exist. */
2451 if (ifunit(name) != NULL)
2452 return (EEXIST);
2453
2454 sc = malloc(sizeof(struct ovpn_softc), M_OVPN, M_WAITOK | M_ZERO);
2455 sc->ifp = if_alloc(IFT_ENC);
2456 rm_init_flags(&sc->lock, "if_ovpn_lock", RM_RECURSE);
2457 sc->refcount = 0;
2458
2459 sc->notifring = buf_ring_alloc(32, M_OVPN, M_WAITOK, NULL);
2460
2461 COUNTER_ARRAY_ALLOC(sc->counters, OVPN_COUNTER_SIZE, M_WAITOK);
2462
2463 ifp = sc->ifp;
2464 ifp->if_softc = sc;
2465 strlcpy(ifp->if_xname, name, IFNAMSIZ);
2466 ifp->if_dname = ovpngroupname;
2467 ifp->if_dunit = unit;
2468
2469 ifp->if_addrlen = 0;
2470 ifp->if_mtu = 1428;
2471 ifp->if_flags = IFF_POINTOPOINT | IFF_MULTICAST;
2472 ifp->if_ioctl = ovpn_ioctl;
2473 ifp->if_transmit = ovpn_transmit;
2474 ifp->if_output = ovpn_output;
2475 ifp->if_qflush = ovpn_qflush;
2476 #ifdef VIMAGE
2477 ifp->if_reassign = ovpn_reassign;
2478 #endif
2479 ifp->if_capabilities |= IFCAP_LINKSTATE;
2480 ifp->if_capenable |= IFCAP_LINKSTATE;
2481
2482 if_attach(ifp);
2483 bpfattach(ifp, DLT_NULL, sizeof(uint32_t));
2484 *ifpp = ifp;
2485
2486 return (0);
2487 }
2488
2489 static void
ovpn_clone_destroy_cb(struct epoch_context * ctx)2490 ovpn_clone_destroy_cb(struct epoch_context *ctx)
2491 {
2492 struct ovpn_softc *sc;
2493 int ret __diagused;
2494
2495 sc = __containerof(ctx, struct ovpn_softc, epoch_ctx);
2496
2497 MPASS(sc->peercount == 0);
2498 MPASS(RB_EMPTY(&sc->peers));
2499
2500 if (sc->so != NULL) {
2501 CURVNET_SET(sc->ifp->if_vnet);
2502 ret = udp_set_kernel_tunneling(sc->so, NULL, NULL, NULL);
2503 MPASS(ret == 0);
2504 sorele(sc->so);
2505 CURVNET_RESTORE();
2506 }
2507
2508 COUNTER_ARRAY_FREE(sc->counters, OVPN_COUNTER_SIZE);
2509
2510 if_free(sc->ifp);
2511 free(sc, M_OVPN);
2512 }
2513
2514 static int
ovpn_clone_destroy(struct if_clone * ifc,struct ifnet * ifp,uint32_t flags)2515 ovpn_clone_destroy(struct if_clone *ifc, struct ifnet *ifp, uint32_t flags)
2516 {
2517 struct ovpn_softc *sc;
2518 struct ovpn_kpeer *peer, *tmppeer;
2519 int unit;
2520 int ret __diagused;
2521
2522 sc = ifp->if_softc;
2523 unit = ifp->if_dunit;
2524
2525 OVPN_WLOCK(sc);
2526
2527 if (atomic_load_int(&sc->refcount) > 0) {
2528 OVPN_WUNLOCK(sc);
2529 return (EBUSY);
2530 }
2531
2532 RB_FOREACH_SAFE(peer, ovpn_kpeers, &sc->peers, tmppeer) {
2533 peer->del_reason = OVPN_DEL_REASON_REQUESTED;
2534 ret = _ovpn_del_peer(sc, peer);
2535 MPASS(ret == 0);
2536 }
2537
2538 ovpn_flush_rxring(sc);
2539 buf_ring_free(sc->notifring, M_OVPN);
2540
2541 OVPN_WUNLOCK(sc);
2542
2543 bpfdetach(ifp);
2544 if_detach(ifp);
2545 ifp->if_softc = NULL;
2546
2547 NET_EPOCH_CALL(ovpn_clone_destroy_cb, &sc->epoch_ctx);
2548
2549 if (unit != IF_DUNIT_NONE)
2550 ifc_free_unit(ifc, unit);
2551
2552 NET_EPOCH_DRAIN_CALLBACKS();
2553
2554 return (0);
2555 }
2556
2557 static void
vnet_ovpn_init(const void * unused __unused)2558 vnet_ovpn_init(const void *unused __unused)
2559 {
2560 struct if_clone_addreq req = {
2561 .match_f = ovpn_clone_match,
2562 .create_f = ovpn_clone_create,
2563 .destroy_f = ovpn_clone_destroy,
2564 };
2565 V_ovpn_cloner = ifc_attach_cloner(ovpngroupname, &req);
2566 }
2567 VNET_SYSINIT(vnet_ovpn_init, SI_SUB_PSEUDO, SI_ORDER_ANY,
2568 vnet_ovpn_init, NULL);
2569
2570 static void
vnet_ovpn_uninit(const void * unused __unused)2571 vnet_ovpn_uninit(const void *unused __unused)
2572 {
2573 if_clone_detach(V_ovpn_cloner);
2574 }
2575 VNET_SYSUNINIT(vnet_ovpn_uninit, SI_SUB_PSEUDO, SI_ORDER_ANY,
2576 vnet_ovpn_uninit, NULL);
2577
2578 static int
ovpnmodevent(module_t mod,int type,void * data)2579 ovpnmodevent(module_t mod, int type, void *data)
2580 {
2581 switch (type) {
2582 case MOD_LOAD:
2583 /* Done in vnet_ovpn_init() */
2584 break;
2585 case MOD_UNLOAD:
2586 /* Done in vnet_ovpn_uninit() */
2587 break;
2588 default:
2589 return (EOPNOTSUPP);
2590 }
2591
2592 return (0);
2593 }
2594
2595 static moduledata_t ovpn_mod = {
2596 "if_ovpn",
2597 ovpnmodevent,
2598 0
2599 };
2600
2601 DECLARE_MODULE(if_ovpn, ovpn_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
2602 MODULE_VERSION(if_ovpn, 1);
2603 MODULE_DEPEND(if_ovpn, crypto, 1, 1, 1);
2604