1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2021-2022 Rubicon Communications, LLC (Netgate)
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 *
27 */
28 #include "opt_inet.h"
29 #include "opt_inet6.h"
30
31 #include <sys/param.h>
32 #include <sys/systm.h>
33 #include <sys/buf_ring.h>
34 #include <sys/epoch.h>
35 #include <sys/file.h>
36 #include <sys/filedesc.h>
37 #include <sys/jail.h>
38 #include <sys/kernel.h>
39 #include <sys/malloc.h>
40 #include <sys/mbuf.h>
41 #include <sys/module.h>
42 #include <sys/nv.h>
43 #include <sys/osd.h>
44 #include <sys/priv.h>
45 #include <sys/protosw.h>
46 #include <sys/rmlock.h>
47 #include <sys/sdt.h>
48 #include <sys/smp.h>
49 #include <sys/socket.h>
50 #include <sys/socketvar.h>
51 #include <sys/sockio.h>
52 #include <sys/sysctl.h>
53 #include <sys/time.h>
54
55 #include <machine/atomic.h>
56
57 #include <net/bpf.h>
58 #include <net/if.h>
59 #include <net/if_clone.h>
60 #include <net/if_types.h>
61 #include <net/if_var.h>
62 #include <net/if_private.h>
63 #include <net/netisr.h>
64 #include <net/route/nhop.h>
65
66 #include <netinet/in.h>
67 #include <netinet/in_fib.h>
68 #include <netinet/ip.h>
69 #include <netinet/ip6.h>
70 #include <netinet/ip_var.h>
71 #include <netinet/udp.h>
72 #include <netinet/udp_var.h>
73
74 #include <netinet6/ip6_var.h>
75 #include <netinet6/in6_fib.h>
76
77 #include <machine/in_cksum.h>
78
79 #include <opencrypto/cryptodev.h>
80
81 #include "if_ovpn.h"
82
83 struct ovpn_kkey_dir {
84 uint8_t key[32];
85 uint8_t keylen;
86 uint8_t nonce[8];
87 uint8_t noncelen;
88 enum ovpn_key_cipher cipher;
89 crypto_session_t cryptoid;
90
91 struct mtx replay_mtx;
92 /*
93 * Last seen gapless sequence number. New rx seq numbers must be
94 * strictly higher than this.
95 */
96 uint32_t rx_seq;
97 uint64_t tx_seq;
98
99 /* Seen packets, relative to rx_seq. bit(0) will always be 0. */
100 uint64_t rx_window;
101 };
102
103 struct ovpn_kkey {
104 struct ovpn_kkey_dir *encrypt;
105 struct ovpn_kkey_dir *decrypt;
106 uint8_t keyid;
107 uint32_t peerid;
108 };
109
110 struct ovpn_keepalive {
111 uint32_t interval;
112 uint32_t timeout;
113 };
114
115 struct ovpn_wire_header {
116 uint32_t opcode; /* opcode, key id, peer id */
117 uint32_t seq;
118 uint8_t auth_tag[16];
119 };
120
121 struct ovpn_peer_counters {
122 uint64_t pkt_in;
123 uint64_t pkt_out;
124 uint64_t bytes_in;
125 uint64_t bytes_out;
126 };
127 #define OVPN_PEER_COUNTER_SIZE (sizeof(struct ovpn_peer_counters)/sizeof(uint64_t))
128
129 struct ovpn_notification {
130 enum ovpn_notif_type type;
131 uint32_t peerid;
132
133 /* Delete notification */
134 enum ovpn_del_reason del_reason;
135 struct ovpn_peer_counters counters;
136
137 /* Float notification */
138 struct sockaddr_storage address;
139 };
140
141 struct ovpn_softc;
142
143 struct ovpn_kpeer {
144 RB_ENTRY(ovpn_kpeer) tree;
145 int refcount;
146 uint32_t peerid;
147
148 struct ovpn_softc *sc;
149 struct sockaddr_storage local;
150 struct sockaddr_storage remote;
151
152 struct in_addr vpn4;
153 struct in6_addr vpn6;
154
155 struct ovpn_kkey keys[2];
156
157 enum ovpn_del_reason del_reason;
158 struct ovpn_keepalive keepalive;
159 uint32_t *last_active;
160 struct callout ping_send;
161 struct callout ping_rcv;
162
163 counter_u64_t counters[OVPN_PEER_COUNTER_SIZE];
164 };
165
166 struct ovpn_counters {
167 uint64_t lost_ctrl_pkts_in;
168 uint64_t lost_ctrl_pkts_out;
169 uint64_t lost_data_pkts_in;
170 uint64_t lost_data_pkts_out;
171 uint64_t nomem_data_pkts_in;
172 uint64_t nomem_data_pkts_out;
173 uint64_t received_ctrl_pkts;
174 uint64_t received_data_pkts;
175 uint64_t sent_ctrl_pkts;
176 uint64_t sent_data_pkts;
177
178 uint64_t transport_bytes_sent;
179 uint64_t transport_bytes_received;
180 uint64_t tunnel_bytes_sent;
181 uint64_t tunnel_bytes_received;
182 };
183 #define OVPN_COUNTER_SIZE (sizeof(struct ovpn_counters)/sizeof(uint64_t))
184
185 RB_HEAD(ovpn_kpeers, ovpn_kpeer);
186
187 struct ovpn_softc {
188 int refcount;
189 struct rmlock lock;
190 struct ifnet *ifp;
191 struct socket *so;
192 int peercount;
193 struct ovpn_kpeers peers;
194
195 /* Pending notification */
196 struct buf_ring *notifring;
197
198 counter_u64_t counters[OVPN_COUNTER_SIZE];
199
200 struct epoch_context epoch_ctx;
201 };
202
203 struct ovpn_mtag {
204 struct sockaddr_storage addr;
205 };
206
207 static struct ovpn_kpeer *ovpn_find_peer(struct ovpn_softc *, uint32_t);
208 static bool ovpn_udp_input(struct mbuf *, int, struct inpcb *,
209 const struct sockaddr *, void *);
210 static int ovpn_transmit_to_peer(struct ifnet *, struct mbuf *,
211 struct ovpn_kpeer *, struct rm_priotracker *);
212 static int ovpn_encap(struct ovpn_softc *, uint32_t, struct mbuf *);
213 static int ovpn_get_af(struct mbuf *);
214 static void ovpn_free_kkey_dir(struct ovpn_kkey_dir *);
215 static bool ovpn_check_replay(struct ovpn_kkey_dir *, uint32_t);
216 static int ovpn_peer_compare(const struct ovpn_kpeer *,
217 const struct ovpn_kpeer *);
218 static bool ovpn_sockaddr_compare(const struct sockaddr *,
219 const struct sockaddr *);
220
221 static RB_PROTOTYPE(ovpn_kpeers, ovpn_kpeer, tree, ovpn_peer_compare);
222 static RB_GENERATE(ovpn_kpeers, ovpn_kpeer, tree, ovpn_peer_compare);
223
224 #define OVPN_MTU_MIN 576
225 #define OVPN_MTU_MAX (IP_MAXPACKET - sizeof(struct ip) - \
226 sizeof(struct udphdr) - sizeof(struct ovpn_wire_header))
227
228 #define OVPN_OP_DATA_V2 0x09
229 #define OVPN_OP_SHIFT 3
230 #define OVPN_SEQ_ROTATE 0x80000000
231
232 VNET_DEFINE_STATIC(struct if_clone *, ovpn_cloner);
233 #define V_ovpn_cloner VNET(ovpn_cloner)
234
235 #define OVPN_RLOCK_TRACKER struct rm_priotracker _ovpn_lock_tracker; \
236 struct rm_priotracker *_ovpn_lock_trackerp = &_ovpn_lock_tracker
237 #define OVPN_RLOCK(sc) rm_rlock(&(sc)->lock, _ovpn_lock_trackerp)
238 #define OVPN_RUNLOCK(sc) rm_runlock(&(sc)->lock, _ovpn_lock_trackerp)
239 #define OVPN_WLOCK(sc) rm_wlock(&(sc)->lock)
240 #define OVPN_WUNLOCK(sc) rm_wunlock(&(sc)->lock)
241 #define OVPN_ASSERT(sc) rm_assert(&(sc)->lock, RA_LOCKED)
242 #define OVPN_RASSERT(sc) rm_assert(&(sc)->lock, RA_RLOCKED)
243 #define OVPN_WASSERT(sc) rm_assert(&(sc)->lock, RA_WLOCKED)
244 #define OVPN_UNLOCK_ASSERT(sc) rm_assert(&(sc)->lock, RA_UNLOCKED)
245
246 #define OVPN_COUNTER(sc, name) \
247 ((sc)->counters[offsetof(struct ovpn_counters, name)/sizeof(uint64_t)])
248 #define OVPN_PEER_COUNTER(peer, name) \
249 ((peer)->counters[offsetof(struct ovpn_peer_counters, name) / \
250 sizeof(uint64_t)])
251
252 #define OVPN_COUNTER_ADD(sc, name, val) \
253 counter_u64_add(OVPN_COUNTER(sc, name), val)
254 #define OVPN_PEER_COUNTER_ADD(p, name, val) \
255 counter_u64_add(OVPN_PEER_COUNTER(p, name), val)
256
257 #define TO_IN(x) ((struct sockaddr_in *)(x))
258 #define TO_IN6(x) ((struct sockaddr_in6 *)(x))
259
260 SDT_PROVIDER_DEFINE(if_ovpn);
261 SDT_PROBE_DEFINE1(if_ovpn, tx, transmit, start, "struct mbuf *");
262 SDT_PROBE_DEFINE2(if_ovpn, tx, route, ip4, "struct in_addr *", "struct ovpn_kpeer *");
263 SDT_PROBE_DEFINE2(if_ovpn, tx, route, ip6, "struct in6_addr *", "struct ovpn_kpeer *");
264
265 static const char ovpnname[] = "ovpn";
266 static const char ovpngroupname[] = "openvpn";
267
268 static MALLOC_DEFINE(M_OVPN, ovpnname, "OpenVPN DCO Interface");
269 #define MTAG_OVPN_LOOP 0x6f76706e /* ovpn */
270
271 SYSCTL_DECL(_net_link);
272 static SYSCTL_NODE(_net_link, IFT_OTHER, openvpn, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
273 "OpenVPN DCO Interface");
274 VNET_DEFINE_STATIC(int, replay_protection) = 0;
275 #define V_replay_protection VNET(replay_protection)
276 SYSCTL_INT(_net_link_openvpn, OID_AUTO, replay_protection, CTLFLAG_VNET | CTLFLAG_RW,
277 &VNET_NAME(replay_protection), 0, "Validate sequence numbers");
278
279 VNET_DEFINE_STATIC(int, async_crypto);
280 #define V_async_crypto VNET(async_crypto)
281 SYSCTL_INT(_net_link_openvpn, OID_AUTO, async_crypto,
282 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(async_crypto), 0,
283 "Use asynchronous mode to parallelize crypto jobs.");
284
285 VNET_DEFINE_STATIC(int, async_netisr_queue);
286 #define V_async_netisr_queue VNET(async_netisr_queue)
287 SYSCTL_INT(_net_link_openvpn, OID_AUTO, netisr_queue,
288 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(async_netisr_queue), 0,
289 "Use netisr_queue() rather than netisr_dispatch().");
290
291 static int
ovpn_peer_compare(const struct ovpn_kpeer * a,const struct ovpn_kpeer * b)292 ovpn_peer_compare(const struct ovpn_kpeer *a, const struct ovpn_kpeer *b)
293 {
294 return (a->peerid - b->peerid);
295 }
296
297 static bool
ovpn_sockaddr_compare(const struct sockaddr * a,const struct sockaddr * b)298 ovpn_sockaddr_compare(const struct sockaddr *a,
299 const struct sockaddr *b)
300 {
301 if (a->sa_family != b->sa_family)
302 return (false);
303 MPASS(a->sa_len == b->sa_len);
304
305 switch (a->sa_family) {
306 case AF_INET: {
307 const struct sockaddr_in *a4, *b4;
308
309 a4 = (const struct sockaddr_in *)a;
310 b4 = (const struct sockaddr_in *)b;
311
312 if (a4->sin_port != b4->sin_port)
313 return (false);
314
315 return (a4->sin_addr.s_addr == b4->sin_addr.s_addr);
316 }
317 case AF_INET6: {
318 const struct sockaddr_in6 *a6, *b6;
319
320 a6 = (const struct sockaddr_in6 *)a;
321 b6 = (const struct sockaddr_in6 *)b;
322
323 if (a6->sin6_port != b6->sin6_port)
324 return (false);
325 if (a6->sin6_scope_id != b6->sin6_scope_id)
326 return (false);
327
328 return (memcmp(&a6->sin6_addr, &b6->sin6_addr,
329 sizeof(a6->sin6_addr)) == 0);
330 }
331 default:
332 panic("Unknown address family %d", a->sa_family);
333 }
334 }
335
336 static struct ovpn_kpeer *
ovpn_find_peer(struct ovpn_softc * sc,uint32_t peerid)337 ovpn_find_peer(struct ovpn_softc *sc, uint32_t peerid)
338 {
339 struct ovpn_kpeer p;
340
341 OVPN_ASSERT(sc);
342
343 p.peerid = peerid;
344
345 return (RB_FIND(ovpn_kpeers, &sc->peers, &p));
346 }
347
348 static struct ovpn_kpeer *
ovpn_find_only_peer(struct ovpn_softc * sc)349 ovpn_find_only_peer(struct ovpn_softc *sc)
350 {
351 OVPN_ASSERT(sc);
352
353 return (RB_ROOT(&sc->peers));
354 }
355
356 static uint16_t
ovpn_get_port(const struct sockaddr_storage * s)357 ovpn_get_port(const struct sockaddr_storage *s)
358 {
359 switch (s->ss_family) {
360 case AF_INET: {
361 const struct sockaddr_in *in = (const struct sockaddr_in *)s;
362 return (in->sin_port);
363 }
364 case AF_INET6: {
365 const struct sockaddr_in6 *in6 = (const struct sockaddr_in6 *)s;
366 return (in6->sin6_port);
367 }
368 default:
369 panic("Unsupported address family %d", s->ss_family);
370 }
371 }
372
373 static void
ovpn_set_port(struct sockaddr_storage * s,unsigned short port)374 ovpn_set_port(struct sockaddr_storage *s, unsigned short port)
375 {
376 switch (s->ss_family) {
377 case AF_INET: {
378 struct sockaddr_in *in = (struct sockaddr_in *)s;
379 in->sin_port = port;
380 break;
381 }
382 case AF_INET6: {
383 struct sockaddr_in6 *in6 = (struct sockaddr_in6 *)s;
384 in6->sin6_port = port;
385 break;
386 }
387 default:
388 panic("Unsupported address family %d", s->ss_family);
389 }
390 }
391
392 static int
ovpn_nvlist_to_sockaddr(const nvlist_t * nvl,struct sockaddr_storage * sa)393 ovpn_nvlist_to_sockaddr(const nvlist_t *nvl, struct sockaddr_storage *sa)
394 {
395 int af;
396
397 memset(sa, 0, sizeof(*sa));
398
399 if (! nvlist_exists_number(nvl, "af"))
400 return (EINVAL);
401 if (! nvlist_exists_binary(nvl, "address"))
402 return (EINVAL);
403 if (! nvlist_exists_number(nvl, "port"))
404 return (EINVAL);
405
406 af = nvlist_get_number(nvl, "af");
407 switch (af) {
408 #ifdef INET
409 case AF_INET: {
410 struct sockaddr_in *in = (struct sockaddr_in *)sa;
411 size_t len;
412 const void *addr = nvlist_get_binary(nvl, "address", &len);
413
414 memset(in, 0, sizeof(*in));
415 in->sin_family = af;
416 in->sin_len = sizeof(*in);
417 if (len != sizeof(in->sin_addr))
418 return (EINVAL);
419
420 memcpy(&in->sin_addr, addr, sizeof(in->sin_addr));
421 in->sin_port = nvlist_get_number(nvl, "port");
422 break;
423 }
424 #endif
425 #ifdef INET6
426 case AF_INET6: {
427 struct sockaddr_in6 *in6 = (struct sockaddr_in6 *)sa;
428 size_t len;
429 const void *addr = nvlist_get_binary(nvl, "address", &len);
430
431 memset(in6, 0, sizeof(*in6));
432 in6->sin6_family = af;
433 in6->sin6_len = sizeof(*in6);
434 if (len != sizeof(in6->sin6_addr))
435 return (EINVAL);
436
437 memcpy(&in6->sin6_addr, addr, sizeof(in6->sin6_addr));
438 in6->sin6_port = nvlist_get_number(nvl, "port");
439
440 if (nvlist_exists_number(nvl, "scopeid"))
441 in6->sin6_scope_id = nvlist_get_number(nvl, "scopeid");
442
443 break;
444 }
445 #endif
446 default:
447 return (EINVAL);
448 }
449
450 return (0);
451 }
452
453 static int
ovpn_add_sockaddr(nvlist_t * parent,const char * name,const struct sockaddr * s)454 ovpn_add_sockaddr(nvlist_t *parent, const char *name, const struct sockaddr *s)
455 {
456 nvlist_t *nvl;
457
458 nvl = nvlist_create(0);
459 if (nvl == NULL)
460 return (ENOMEM);
461
462 nvlist_add_number(nvl, "af", s->sa_family);
463
464 switch (s->sa_family) {
465 case AF_INET: {
466 const struct sockaddr_in *s4 = (const struct sockaddr_in *)s;
467
468 nvlist_add_number(nvl, "port", s4->sin_port);
469 nvlist_add_binary(nvl, "address", &s4->sin_addr,
470 sizeof(s4->sin_addr));
471 break;
472 }
473 case AF_INET6: {
474 const struct sockaddr_in6 *s6 = (const struct sockaddr_in6 *)s;
475
476 nvlist_add_number(nvl, "port", s6->sin6_port);
477 nvlist_add_binary(nvl, "address", &s6->sin6_addr,
478 sizeof(s6->sin6_addr));
479 nvlist_add_number(nvl, "scopeid", s6->sin6_scope_id);
480 break;
481 }
482 default:
483 nvlist_destroy(nvl);
484 return (EINVAL);
485 }
486
487 nvlist_move_nvlist(parent, name, nvl);
488
489 return (0);
490 }
491
492 static void
ovpn_notify_del_peer(struct ovpn_softc * sc,struct ovpn_kpeer * peer)493 ovpn_notify_del_peer(struct ovpn_softc *sc, struct ovpn_kpeer *peer)
494 {
495 struct ovpn_notification *n;
496
497 OVPN_WASSERT(sc);
498
499 n = malloc(sizeof(*n), M_OVPN, M_NOWAIT);
500 if (n == NULL)
501 return;
502
503 n->peerid = peer->peerid;
504 n->type = OVPN_NOTIF_DEL_PEER;
505 n->del_reason = peer->del_reason;
506
507 n->counters.pkt_in = counter_u64_fetch(OVPN_PEER_COUNTER(peer, pkt_in));
508 n->counters.pkt_out = counter_u64_fetch(OVPN_PEER_COUNTER(peer, pkt_out));
509 n->counters.bytes_in = counter_u64_fetch(OVPN_PEER_COUNTER(peer, bytes_in));
510 n->counters.bytes_out = counter_u64_fetch(OVPN_PEER_COUNTER(peer, bytes_out));
511
512 if (buf_ring_enqueue(sc->notifring, n) != 0) {
513 free(n, M_OVPN);
514 } else if (sc->so != NULL) {
515 /* Wake up userspace */
516 sc->so->so_error = EAGAIN;
517 sorwakeup(sc->so);
518 sowwakeup(sc->so);
519 }
520 }
521
522 static void
ovpn_notify_key_rotation(struct ovpn_softc * sc,struct ovpn_kpeer * peer)523 ovpn_notify_key_rotation(struct ovpn_softc *sc, struct ovpn_kpeer *peer)
524 {
525 struct ovpn_notification *n;
526
527 n = malloc(sizeof(*n), M_OVPN, M_NOWAIT | M_ZERO);
528 if (n == NULL)
529 return;
530
531 n->peerid = peer->peerid;
532 n->type = OVPN_NOTIF_ROTATE_KEY;
533
534 if (buf_ring_enqueue(sc->notifring, n) != 0) {
535 free(n, M_OVPN);
536 } else if (sc->so != NULL) {
537 /* Wake up userspace */
538 sc->so->so_error = EAGAIN;
539 sorwakeup(sc->so);
540 sowwakeup(sc->so);
541 }
542 }
543
544 static int
ovpn_notify_float(struct ovpn_softc * sc,uint32_t peerid,const struct sockaddr_storage * remote)545 ovpn_notify_float(struct ovpn_softc *sc, uint32_t peerid,
546 const struct sockaddr_storage *remote)
547 {
548 struct ovpn_notification *n;
549
550 n = malloc(sizeof(*n), M_OVPN, M_NOWAIT | M_ZERO);
551 if (n == NULL)
552 return (ENOMEM);
553
554 n->peerid = peerid;
555 n->type = OVPN_NOTIF_FLOAT;
556 memcpy(&n->address, remote, sizeof(n->address));
557
558 if (buf_ring_enqueue(sc->notifring, n) != 0) {
559 free(n, M_OVPN);
560 return (ENOMEM);
561 } else if (sc->so != NULL) {
562 /* Wake up userspace */
563 sc->so->so_error = EAGAIN;
564 sorwakeup(sc->so);
565 sowwakeup(sc->so);
566 }
567
568 return (0);
569 }
570
571 static void
ovpn_peer_release_ref(struct ovpn_kpeer * peer,bool locked)572 ovpn_peer_release_ref(struct ovpn_kpeer *peer, bool locked)
573 {
574 struct ovpn_softc *sc;
575
576 CURVNET_ASSERT_SET();
577
578 atomic_add_int(&peer->refcount, -1);
579
580 if (atomic_load_int(&peer->refcount) > 0)
581 return;
582
583 sc = peer->sc;
584
585 if (! locked) {
586 OVPN_WLOCK(sc);
587
588 /* Might have changed before we acquired the lock. */
589 if (atomic_load_int(&peer->refcount) > 0) {
590 OVPN_WUNLOCK(sc);
591 return;
592 }
593 }
594
595 OVPN_ASSERT(sc);
596
597 /* The peer should have been removed from the list already. */
598 MPASS(ovpn_find_peer(sc, peer->peerid) == NULL);
599
600 ovpn_notify_del_peer(sc, peer);
601
602 for (int i = 0; i < 2; i++) {
603 ovpn_free_kkey_dir(peer->keys[i].encrypt);
604 ovpn_free_kkey_dir(peer->keys[i].decrypt);
605 }
606
607 callout_stop(&peer->ping_send);
608 callout_stop(&peer->ping_rcv);
609 uma_zfree_pcpu(pcpu_zone_4, peer->last_active);
610 free(peer, M_OVPN);
611
612 if (! locked)
613 OVPN_WUNLOCK(sc);
614 }
615
616 static int
ovpn_new_peer(struct ifnet * ifp,const nvlist_t * nvl)617 ovpn_new_peer(struct ifnet *ifp, const nvlist_t *nvl)
618 {
619 #ifdef INET6
620 struct epoch_tracker et;
621 #endif
622 struct sockaddr_storage local, remote;
623 struct ovpn_kpeer *peer = NULL;
624 struct file *fp = NULL;
625 struct ovpn_softc *sc = ifp->if_softc;
626 struct thread *td = curthread;
627 struct socket *so = NULL;
628 int fd;
629 uint32_t peerid;
630 int ret = 0;
631 bool setcb = false;
632
633 if (nvl == NULL)
634 return (EINVAL);
635
636 if (! nvlist_exists_number(nvl, "peerid"))
637 return (EINVAL);
638
639 if (! nvlist_exists_number(nvl, "fd"))
640 return (EINVAL);
641
642 if (! nvlist_exists_nvlist(nvl, "remote"))
643 return (EINVAL);
644
645 peerid = nvlist_get_number(nvl, "peerid");
646
647 ret = ovpn_nvlist_to_sockaddr(nvlist_get_nvlist(nvl, "remote"),
648 &remote);
649 if (ret != 0)
650 return (ret);
651
652 fd = nvlist_get_number(nvl, "fd");
653
654 /* Look up the userspace process and use the fd to find the socket. */
655 ret = getsock(td, fd, &cap_connect_rights, &fp);
656 if (ret != 0)
657 return (ret);
658
659 so = fp->f_data;
660
661 peer = malloc(sizeof(*peer), M_OVPN, M_WAITOK | M_ZERO);
662 peer->peerid = peerid;
663 peer->sc = sc;
664 peer->refcount = 1;
665 peer->last_active = uma_zalloc_pcpu(pcpu_zone_4, M_WAITOK | M_ZERO);
666 COUNTER_ARRAY_ALLOC(peer->counters, OVPN_PEER_COUNTER_SIZE, M_WAITOK);
667
668 if (nvlist_exists_binary(nvl, "vpn_ipv4")) {
669 size_t len;
670 const void *addr = nvlist_get_binary(nvl, "vpn_ipv4", &len);
671 if (len != sizeof(peer->vpn4)) {
672 ret = EINVAL;
673 goto error;
674 }
675 memcpy(&peer->vpn4, addr, len);
676 }
677
678 if (nvlist_exists_binary(nvl, "vpn_ipv6")) {
679 size_t len;
680 const void *addr = nvlist_get_binary(nvl, "vpn_ipv6", &len);
681 if (len != sizeof(peer->vpn6)) {
682 ret = EINVAL;
683 goto error;
684 }
685 memcpy(&peer->vpn6, addr, len);
686 }
687
688 callout_init_rm(&peer->ping_send, &sc->lock, CALLOUT_SHAREDLOCK);
689 callout_init_rm(&peer->ping_rcv, &sc->lock, 0);
690
691 memset(&local, 0, sizeof(local));
692 local.ss_len = sizeof(local);
693 ret = sosockaddr(so, (struct sockaddr *)&local);
694 if (ret != 0)
695 goto error;
696 if (nvlist_exists_nvlist(nvl, "local")) {
697 struct sockaddr_storage local1;
698
699 ret = ovpn_nvlist_to_sockaddr(nvlist_get_nvlist(nvl, "local"),
700 &local1);
701 if (ret != 0)
702 goto error;
703
704 /*
705 * openvpn doesn't provide a port here when in multihome mode,
706 * just steal the one the socket is bound to.
707 */
708 if (ovpn_get_port(&local1) == 0)
709 ovpn_set_port(&local1, ovpn_get_port(&local));
710 memcpy(&local, &local1, sizeof(local1));
711 }
712 if (ovpn_get_port(&local) == 0) {
713 ret = EINVAL;
714 goto error;
715 }
716 if (local.ss_family != remote.ss_family) {
717 ret = EINVAL;
718 goto error;
719 }
720
721 memcpy(&peer->local, &local, sizeof(local));
722 memcpy(&peer->remote, &remote, sizeof(remote));
723
724 #ifdef INET6
725 if (peer->local.ss_family == AF_INET6 &&
726 IN6_IS_ADDR_V4MAPPED(&TO_IN6(&peer->remote)->sin6_addr)) {
727 /* V4 mapped address, so treat this as v4, not v6. */
728 in6_sin6_2_sin_in_sock((struct sockaddr *)&peer->local);
729 in6_sin6_2_sin_in_sock((struct sockaddr *)&peer->remote);
730 }
731
732 if (peer->local.ss_family == AF_INET6 &&
733 IN6_IS_ADDR_UNSPECIFIED(&TO_IN6(&peer->local)->sin6_addr)) {
734 NET_EPOCH_ENTER(et);
735 ret = in6_selectsrc_addr(curthread->td_proc->p_fibnum,
736 &TO_IN6(&peer->remote)->sin6_addr,
737 TO_IN6(&peer->remote)->sin6_scope_id, NULL,
738 &TO_IN6(&peer->local)->sin6_addr, NULL);
739 NET_EPOCH_EXIT(et);
740 if (ret != 0) {
741 goto error;
742 }
743 }
744 #endif
745 OVPN_WLOCK(sc);
746
747 /* Disallow peer id re-use. */
748 if (ovpn_find_peer(sc, peerid) != NULL) {
749 ret = EEXIST;
750 goto error_locked;
751 }
752
753 /* Make sure this is really a UDP socket. */
754 if (so->so_type != SOCK_DGRAM || so->so_proto->pr_type != SOCK_DGRAM) {
755 ret = EPROTOTYPE;
756 goto error_locked;
757 }
758
759 /* Must be the same socket as for other peers on this interface. */
760 if (sc->so != NULL && so != sc->so) {
761 if (! RB_EMPTY(&sc->peers)) {
762 ret = EBUSY;
763 goto error_locked;
764 }
765
766 /*
767 * If we have no peers we can safely release the socket and accept
768 * a new one.
769 */
770 ret = udp_set_kernel_tunneling(sc->so, NULL, NULL, NULL);
771 MPASS(ret == 0);
772 sorele(sc->so);
773 sc->so = NULL;
774 }
775
776 if (sc->so == NULL) {
777 sc->so = so;
778 /*
779 * Maintain one extra ref so the socket doesn't go away until
780 * we're destroying the ifp.
781 */
782 soref(sc->so);
783 setcb = true;
784 }
785
786 /* Insert the peer into the list. */
787 RB_INSERT(ovpn_kpeers, &sc->peers, peer);
788 sc->peercount++;
789
790 OVPN_WUNLOCK(sc);
791
792 if (setcb) {
793 ret = udp_set_kernel_tunneling(sc->so, ovpn_udp_input, NULL, sc);
794 MPASS(ret == 0);
795 }
796
797 goto done;
798
799 error_locked:
800 OVPN_WUNLOCK(sc);
801 error:
802 COUNTER_ARRAY_FREE(peer->counters, OVPN_PEER_COUNTER_SIZE);
803 uma_zfree_pcpu(pcpu_zone_4, peer->last_active);
804 free(peer, M_OVPN);
805 done:
806 if (fp != NULL)
807 fdrop(fp, td);
808
809 return (ret);
810 }
811
812 static int
_ovpn_del_peer(struct ovpn_softc * sc,struct ovpn_kpeer * peer)813 _ovpn_del_peer(struct ovpn_softc *sc, struct ovpn_kpeer *peer)
814 {
815 struct ovpn_kpeer *tmp __diagused;
816
817 OVPN_WASSERT(sc);
818 CURVNET_ASSERT_SET();
819
820 MPASS(RB_FIND(ovpn_kpeers, &sc->peers, peer) == peer);
821
822 tmp = RB_REMOVE(ovpn_kpeers, &sc->peers, peer);
823 MPASS(tmp != NULL);
824
825 sc->peercount--;
826
827 ovpn_peer_release_ref(peer, true);
828
829 return (0);
830 }
831
832 static int
ovpn_del_peer(struct ifnet * ifp,nvlist_t * nvl)833 ovpn_del_peer(struct ifnet *ifp, nvlist_t *nvl)
834 {
835 struct ovpn_softc *sc = ifp->if_softc;
836 struct ovpn_kpeer *peer;
837 uint32_t peerid;
838 int ret;
839
840 OVPN_WASSERT(sc);
841
842 if (nvl == NULL)
843 return (EINVAL);
844
845 if (! nvlist_exists_number(nvl, "peerid"))
846 return (EINVAL);
847
848 peerid = nvlist_get_number(nvl, "peerid");
849
850 peer = ovpn_find_peer(sc, peerid);
851 if (peer == NULL)
852 return (ENOENT);
853
854 peer->del_reason = OVPN_DEL_REASON_REQUESTED;
855 ret = _ovpn_del_peer(sc, peer);
856
857 return (ret);
858 }
859
860 static int
ovpn_create_kkey_dir(struct ovpn_kkey_dir ** kdirp,const nvlist_t * nvl)861 ovpn_create_kkey_dir(struct ovpn_kkey_dir **kdirp,
862 const nvlist_t *nvl)
863 {
864 struct crypto_session_params csp;
865 struct ovpn_kkey_dir *kdir;
866 const char *ciphername;
867 enum ovpn_key_cipher cipher;
868 const void *key, *iv;
869 size_t keylen = 0, ivlen = 0;
870 int error;
871
872 if (! nvlist_exists_string(nvl, "cipher"))
873 return (EINVAL);
874 ciphername = nvlist_get_string(nvl, "cipher");
875
876 if (strcmp(ciphername, "none") == 0)
877 cipher = OVPN_CIPHER_ALG_NONE;
878 else if (strcmp(ciphername, "AES-256-GCM") == 0 ||
879 strcmp(ciphername, "AES-192-GCM") == 0 ||
880 strcmp(ciphername, "AES-128-GCM") == 0)
881 cipher = OVPN_CIPHER_ALG_AES_GCM;
882 else if (strcmp(ciphername, "CHACHA20-POLY1305") == 0)
883 cipher = OVPN_CIPHER_ALG_CHACHA20_POLY1305;
884 else
885 return (EINVAL);
886
887 if (cipher != OVPN_CIPHER_ALG_NONE) {
888 if (! nvlist_exists_binary(nvl, "key"))
889 return (EINVAL);
890 key = nvlist_get_binary(nvl, "key", &keylen);
891 if (keylen > sizeof(kdir->key))
892 return (E2BIG);
893
894 if (! nvlist_exists_binary(nvl, "iv"))
895 return (EINVAL);
896 iv = nvlist_get_binary(nvl, "iv", &ivlen);
897 if (ivlen != 8)
898 return (E2BIG);
899 }
900
901 kdir = malloc(sizeof(struct ovpn_kkey_dir), M_OVPN,
902 M_WAITOK | M_ZERO);
903
904 kdir->cipher = cipher;
905 kdir->keylen = keylen;
906 kdir->tx_seq = 1;
907 memcpy(kdir->key, key, keylen);
908 kdir->noncelen = ivlen;
909 memcpy(kdir->nonce, iv, ivlen);
910
911 if (kdir->cipher != OVPN_CIPHER_ALG_NONE) {
912 /* Crypto init */
913 bzero(&csp, sizeof(csp));
914 csp.csp_mode = CSP_MODE_AEAD;
915
916 if (kdir->cipher == OVPN_CIPHER_ALG_CHACHA20_POLY1305)
917 csp.csp_cipher_alg = CRYPTO_CHACHA20_POLY1305;
918 else
919 csp.csp_cipher_alg = CRYPTO_AES_NIST_GCM_16;
920
921 csp.csp_flags |= CSP_F_SEPARATE_AAD;
922
923 csp.csp_cipher_klen = kdir->keylen;
924 csp.csp_cipher_key = kdir->key;
925 csp.csp_ivlen = 96 / 8;
926
927 error = crypto_newsession(&kdir->cryptoid, &csp,
928 CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE);
929 if (error) {
930 free(kdir, M_OVPN);
931 return (error);
932 }
933 }
934
935 mtx_init(&kdir->replay_mtx, "if_ovpn rx replay", NULL, MTX_DEF);
936 *kdirp = kdir;
937
938 return (0);
939 }
940
941 static void
ovpn_free_kkey_dir(struct ovpn_kkey_dir * kdir)942 ovpn_free_kkey_dir(struct ovpn_kkey_dir *kdir)
943 {
944 if (kdir == NULL)
945 return;
946
947 mtx_destroy(&kdir->replay_mtx);
948
949 crypto_freesession(kdir->cryptoid);
950 free(kdir, M_OVPN);
951 }
952
953 static int
ovpn_set_key(struct ifnet * ifp,const nvlist_t * nvl)954 ovpn_set_key(struct ifnet *ifp, const nvlist_t *nvl)
955 {
956 struct ovpn_softc *sc = ifp->if_softc;
957 struct ovpn_kkey_dir *enc, *dec;
958 struct ovpn_kpeer *peer;
959 int slot, keyid, peerid;
960 int error;
961
962 if (nvl == NULL)
963 return (EINVAL);
964
965 if (! nvlist_exists_number(nvl, "slot"))
966 return (EINVAL);
967 slot = nvlist_get_number(nvl, "slot");
968
969 if (! nvlist_exists_number(nvl, "keyid"))
970 return (EINVAL);
971 keyid = nvlist_get_number(nvl, "keyid");
972
973 if (! nvlist_exists_number(nvl, "peerid"))
974 return (EINVAL);
975 peerid = nvlist_get_number(nvl, "peerid");
976
977 if (slot != OVPN_KEY_SLOT_PRIMARY &&
978 slot != OVPN_KEY_SLOT_SECONDARY)
979 return (EINVAL);
980
981 if (! nvlist_exists_nvlist(nvl, "encrypt") ||
982 ! nvlist_exists_nvlist(nvl, "decrypt"))
983 return (EINVAL);
984
985 error = ovpn_create_kkey_dir(&enc, nvlist_get_nvlist(nvl, "encrypt"));
986 if (error)
987 return (error);
988
989 error = ovpn_create_kkey_dir(&dec, nvlist_get_nvlist(nvl, "decrypt"));
990 if (error) {
991 ovpn_free_kkey_dir(enc);
992 return (error);
993 }
994
995 OVPN_WLOCK(sc);
996
997 peer = ovpn_find_peer(sc, peerid);
998 if (peer == NULL) {
999 ovpn_free_kkey_dir(dec);
1000 ovpn_free_kkey_dir(enc);
1001 OVPN_WUNLOCK(sc);
1002 return (ENOENT);
1003 }
1004
1005 ovpn_free_kkey_dir(peer->keys[slot].encrypt);
1006 ovpn_free_kkey_dir(peer->keys[slot].decrypt);
1007
1008 peer->keys[slot].encrypt = enc;
1009 peer->keys[slot].decrypt = dec;
1010
1011 peer->keys[slot].keyid = keyid;
1012 peer->keys[slot].peerid = peerid;
1013
1014 OVPN_WUNLOCK(sc);
1015
1016 return (0);
1017 }
1018
1019 static int
ovpn_check_key(struct ovpn_softc * sc,struct ovpn_kpeer * peer,enum ovpn_key_slot slot)1020 ovpn_check_key(struct ovpn_softc *sc, struct ovpn_kpeer *peer, enum ovpn_key_slot slot)
1021 {
1022 OVPN_ASSERT(sc);
1023
1024 if (peer->keys[slot].encrypt == NULL)
1025 return (ENOLINK);
1026
1027 if (peer->keys[slot].decrypt == NULL)
1028 return (ENOLINK);
1029
1030 return (0);
1031 }
1032
1033 static int
ovpn_start(struct ifnet * ifp)1034 ovpn_start(struct ifnet *ifp)
1035 {
1036 struct ovpn_softc *sc = ifp->if_softc;
1037
1038 OVPN_WLOCK(sc);
1039
1040 ifp->if_flags |= IFF_UP;
1041 ifp->if_drv_flags |= IFF_DRV_RUNNING;
1042 if_link_state_change(ifp, LINK_STATE_UP);
1043
1044 OVPN_WUNLOCK(sc);
1045
1046 return (0);
1047 }
1048
1049 static int
ovpn_swap_keys(struct ifnet * ifp,nvlist_t * nvl)1050 ovpn_swap_keys(struct ifnet *ifp, nvlist_t *nvl)
1051 {
1052 struct ovpn_softc *sc = ifp->if_softc;
1053 struct ovpn_kpeer *peer;
1054 struct ovpn_kkey tmpkey;
1055 int error;
1056
1057 if (nvl == NULL)
1058 return (EINVAL);
1059
1060 if (! nvlist_exists_number(nvl, "peerid"))
1061 return (EINVAL);
1062
1063 OVPN_WLOCK(sc);
1064
1065 peer = ovpn_find_peer(sc, nvlist_get_number(nvl, "peerid"));
1066 if (peer == NULL) {
1067 OVPN_WUNLOCK(sc);
1068 return (ENOENT);
1069 }
1070
1071 /* Check that we have a second key to swap to. */
1072 error = ovpn_check_key(sc, peer, OVPN_KEY_SLOT_SECONDARY);
1073 if (error) {
1074 OVPN_WUNLOCK(sc);
1075 return (error);
1076 }
1077
1078 tmpkey = peer->keys[0];
1079 peer->keys[0] = peer->keys[1];
1080 peer->keys[1] = tmpkey;
1081
1082 OVPN_WUNLOCK(sc);
1083
1084 return (0);
1085 }
1086
1087 static int
ovpn_del_key(struct ifnet * ifp,const nvlist_t * nvl)1088 ovpn_del_key(struct ifnet *ifp, const nvlist_t *nvl)
1089 {
1090 enum ovpn_key_slot slot;
1091 struct ovpn_kpeer *peer;
1092 struct ovpn_softc *sc = ifp->if_softc;
1093
1094 if (nvl == NULL)
1095 return (EINVAL);
1096
1097 if (! nvlist_exists_number(nvl, "peerid"))
1098 return (EINVAL);
1099
1100 if (! nvlist_exists_number(nvl, "slot"))
1101 return (EINVAL);
1102 slot = nvlist_get_number(nvl, "slot");
1103
1104 if (slot != OVPN_KEY_SLOT_PRIMARY &&
1105 slot != OVPN_KEY_SLOT_SECONDARY)
1106 return (EINVAL);
1107
1108 OVPN_WLOCK(sc);
1109
1110 peer = ovpn_find_peer(sc, nvlist_get_number(nvl, "peerid"));
1111 if (peer == NULL) {
1112 OVPN_WUNLOCK(sc);
1113 return (ENOENT);
1114 }
1115
1116 ovpn_free_kkey_dir(peer->keys[slot].encrypt);
1117 ovpn_free_kkey_dir(peer->keys[slot].decrypt);
1118
1119 peer->keys[slot].encrypt = NULL;
1120 peer->keys[slot].decrypt = NULL;
1121
1122 peer->keys[slot].keyid = 0;
1123 peer->keys[slot].peerid = 0;
1124
1125 OVPN_WUNLOCK(sc);
1126
1127 return (0);
1128 }
1129
1130 static void
ovpn_send_ping(void * arg)1131 ovpn_send_ping(void *arg)
1132 {
1133 static const uint8_t ping_str[] = {
1134 0x2a, 0x18, 0x7b, 0xf3, 0x64, 0x1e, 0xb4, 0xcb,
1135 0x07, 0xed, 0x2d, 0x0a, 0x98, 0x1f, 0xc7, 0x48
1136 };
1137
1138 struct epoch_tracker et;
1139 struct ovpn_kpeer *peer = arg;
1140 struct ovpn_softc *sc = peer->sc;
1141 struct mbuf *m;
1142
1143 OVPN_RASSERT(sc);
1144
1145 /* Ensure we repeat! */
1146 callout_reset(&peer->ping_send, peer->keepalive.interval * hz,
1147 ovpn_send_ping, peer);
1148
1149 m = m_get2(sizeof(ping_str), M_NOWAIT, MT_DATA, M_PKTHDR);
1150 if (m == NULL)
1151 return;
1152
1153 m_copyback(m, 0, sizeof(ping_str), ping_str);
1154 m->m_len = m->m_pkthdr.len = sizeof(ping_str);
1155
1156 CURVNET_SET(sc->ifp->if_vnet);
1157 NET_EPOCH_ENTER(et);
1158 (void)ovpn_transmit_to_peer(sc->ifp, m, peer, NULL);
1159 NET_EPOCH_EXIT(et);
1160 CURVNET_RESTORE();
1161 }
1162
1163 static void
ovpn_timeout(void * arg)1164 ovpn_timeout(void *arg)
1165 {
1166 struct ovpn_kpeer *peer = arg;
1167 struct ovpn_softc *sc = peer->sc;
1168 uint32_t last, _last_active;
1169 int ret __diagused;
1170 int cpu;
1171
1172 OVPN_WASSERT(sc);
1173
1174 last = 0;
1175 CPU_FOREACH(cpu) {
1176 _last_active = *zpcpu_get_cpu(peer->last_active, cpu);
1177 if (_last_active > last)
1178 last = _last_active;
1179 }
1180
1181 if (last + peer->keepalive.timeout > time_uptime) {
1182 callout_reset(&peer->ping_rcv,
1183 (peer->keepalive.timeout - (time_uptime - last)) * hz,
1184 ovpn_timeout, peer);
1185 return;
1186 }
1187
1188 CURVNET_SET(sc->ifp->if_vnet);
1189 peer->del_reason = OVPN_DEL_REASON_TIMEOUT;
1190 ret = _ovpn_del_peer(sc, peer);
1191 MPASS(ret == 0);
1192 CURVNET_RESTORE();
1193 }
1194
1195 static int
ovpn_set_peer(struct ifnet * ifp,const nvlist_t * nvl)1196 ovpn_set_peer(struct ifnet *ifp, const nvlist_t *nvl)
1197 {
1198 struct ovpn_softc *sc = ifp->if_softc;
1199 struct ovpn_kpeer *peer;
1200
1201 if (nvl == NULL)
1202 return (EINVAL);
1203
1204 if (! nvlist_exists_number(nvl, "interval") ||
1205 ! nvlist_exists_number(nvl, "timeout") ||
1206 ! nvlist_exists_number(nvl, "peerid"))
1207 return (EINVAL);
1208
1209 OVPN_WLOCK(sc);
1210
1211 peer = ovpn_find_peer(sc, nvlist_get_number(nvl, "peerid"));
1212 if (peer == NULL) {
1213 OVPN_WUNLOCK(sc);
1214 return (ENOENT);
1215 }
1216
1217 peer->keepalive.interval = nvlist_get_number(nvl, "interval");
1218 peer->keepalive.timeout = nvlist_get_number(nvl, "timeout");
1219
1220 if (peer->keepalive.interval > 0)
1221 callout_reset(&peer->ping_send, peer->keepalive.interval * hz,
1222 ovpn_send_ping, peer);
1223 if (peer->keepalive.timeout > 0)
1224 callout_reset(&peer->ping_rcv, peer->keepalive.timeout * hz,
1225 ovpn_timeout, peer);
1226
1227 OVPN_WUNLOCK(sc);
1228
1229 return (0);
1230 }
1231
1232 static int
ovpn_set_ifmode(struct ifnet * ifp,const nvlist_t * nvl)1233 ovpn_set_ifmode(struct ifnet *ifp, const nvlist_t *nvl)
1234 {
1235 struct ovpn_softc *sc = ifp->if_softc;
1236 int ifmode;
1237
1238 if (nvl == NULL)
1239 return (EINVAL);
1240
1241 if (! nvlist_exists_number(nvl, "ifmode") )
1242 return (EINVAL);
1243
1244 ifmode = nvlist_get_number(nvl, "ifmode");
1245
1246 OVPN_WLOCK(sc);
1247
1248 /* deny this if UP */
1249 if (ifp->if_flags & IFF_UP) {
1250 OVPN_WUNLOCK(sc);
1251 return (EBUSY);
1252 }
1253
1254 switch (ifmode & ~IFF_MULTICAST) {
1255 case IFF_POINTOPOINT:
1256 case IFF_BROADCAST:
1257 ifp->if_flags &=
1258 ~(IFF_BROADCAST|IFF_POINTOPOINT|IFF_MULTICAST);
1259 ifp->if_flags |= ifmode;
1260 break;
1261 default:
1262 OVPN_WUNLOCK(sc);
1263 return (EINVAL);
1264 }
1265
1266 OVPN_WUNLOCK(sc);
1267
1268 return (0);
1269 }
1270
1271 static int
ovpn_ioctl_set(struct ifnet * ifp,struct ifdrv * ifd)1272 ovpn_ioctl_set(struct ifnet *ifp, struct ifdrv *ifd)
1273 {
1274 struct ovpn_softc *sc = ifp->if_softc;
1275 uint8_t *buf = NULL;
1276 nvlist_t *nvl = NULL;
1277 int ret;
1278
1279 if (ifd->ifd_len != 0) {
1280 if (ifd->ifd_len > OVPN_MAX_REQUEST_SIZE)
1281 return (E2BIG);
1282
1283 buf = malloc(ifd->ifd_len, M_OVPN, M_WAITOK);
1284
1285 ret = copyin(ifd->ifd_data, buf, ifd->ifd_len);
1286 if (ret != 0) {
1287 free(buf, M_OVPN);
1288 return (ret);
1289 }
1290
1291 nvl = nvlist_unpack(buf, ifd->ifd_len, 0);
1292 free(buf, M_OVPN);
1293 if (nvl == NULL) {
1294 return (EINVAL);
1295 }
1296 }
1297
1298 switch (ifd->ifd_cmd) {
1299 case OVPN_NEW_PEER:
1300 ret = ovpn_new_peer(ifp, nvl);
1301 break;
1302 case OVPN_DEL_PEER:
1303 OVPN_WLOCK(sc);
1304 ret = ovpn_del_peer(ifp, nvl);
1305 OVPN_WUNLOCK(sc);
1306 break;
1307 case OVPN_NEW_KEY:
1308 ret = ovpn_set_key(ifp, nvl);
1309 break;
1310 case OVPN_START_VPN:
1311 ret = ovpn_start(ifp);
1312 break;
1313 case OVPN_SWAP_KEYS:
1314 ret = ovpn_swap_keys(ifp, nvl);
1315 break;
1316 case OVPN_DEL_KEY:
1317 ret = ovpn_del_key(ifp, nvl);
1318 break;
1319 case OVPN_SET_PEER:
1320 ret = ovpn_set_peer(ifp, nvl);
1321 break;
1322 case OVPN_SET_IFMODE:
1323 ret = ovpn_set_ifmode(ifp, nvl);
1324 break;
1325 default:
1326 ret = ENOTSUP;
1327 }
1328
1329 nvlist_destroy(nvl);
1330 return (ret);
1331 }
1332
1333 static int
ovpn_add_counters(nvlist_t * parent,const char * name,counter_u64_t in,counter_u64_t out)1334 ovpn_add_counters(nvlist_t *parent, const char *name, counter_u64_t in,
1335 counter_u64_t out)
1336 {
1337 nvlist_t *nvl;
1338
1339 nvl = nvlist_create(0);
1340 if (nvl == NULL)
1341 return (ENOMEM);
1342
1343 nvlist_add_number(nvl, "in", counter_u64_fetch(in));
1344 nvlist_add_number(nvl, "out", counter_u64_fetch(out));
1345
1346 nvlist_add_nvlist(parent, name, nvl);
1347
1348 nvlist_destroy(nvl);
1349
1350 return (0);
1351 }
1352
1353 static int
ovpn_get_stats(struct ovpn_softc * sc,nvlist_t ** onvl)1354 ovpn_get_stats(struct ovpn_softc *sc, nvlist_t **onvl)
1355 {
1356 nvlist_t *nvl;
1357 int ret;
1358
1359 nvl = nvlist_create(0);
1360 if (nvl == NULL)
1361 return (ENOMEM);
1362
1363 #define OVPN_COUNTER_OUT(name, in, out) \
1364 do { \
1365 ret = ovpn_add_counters(nvl, name, OVPN_COUNTER(sc, in), \
1366 OVPN_COUNTER(sc, out)); \
1367 if (ret != 0) \
1368 goto error; \
1369 } while(0)
1370
1371 OVPN_COUNTER_OUT("lost_ctrl", lost_ctrl_pkts_in, lost_ctrl_pkts_out);
1372 OVPN_COUNTER_OUT("lost_data", lost_data_pkts_in, lost_data_pkts_out);
1373 OVPN_COUNTER_OUT("nomem_data", nomem_data_pkts_in,
1374 nomem_data_pkts_out);
1375 OVPN_COUNTER_OUT("data", received_data_pkts, sent_data_pkts);
1376 OVPN_COUNTER_OUT("ctrl", received_ctrl_pkts, sent_ctrl_pkts);
1377 OVPN_COUNTER_OUT("tunnel", tunnel_bytes_received,
1378 tunnel_bytes_received);
1379 OVPN_COUNTER_OUT("transport", transport_bytes_received,
1380 transport_bytes_received);
1381 #undef OVPN_COUNTER_OUT
1382
1383 *onvl = nvl;
1384
1385 return (0);
1386
1387 error:
1388 nvlist_destroy(nvl);
1389 return (ret);
1390 }
1391
1392 static int
ovpn_get_peer_stats(struct ovpn_softc * sc,nvlist_t ** nvl)1393 ovpn_get_peer_stats(struct ovpn_softc *sc, nvlist_t **nvl)
1394 {
1395 struct ovpn_kpeer *peer;
1396 nvlist_t *nvpeer = NULL;
1397 int ret;
1398
1399 OVPN_RLOCK_TRACKER;
1400
1401 *nvl = nvlist_create(0);
1402 if (*nvl == NULL)
1403 return (ENOMEM);
1404
1405 #define OVPN_PEER_COUNTER_OUT(name, in, out) \
1406 do { \
1407 ret = ovpn_add_counters(nvpeer, name, \
1408 OVPN_PEER_COUNTER(peer, in), OVPN_PEER_COUNTER(peer, out)); \
1409 if (ret != 0) \
1410 goto error; \
1411 } while(0)
1412
1413 OVPN_RLOCK(sc);
1414 RB_FOREACH(peer, ovpn_kpeers, &sc->peers) {
1415 nvpeer = nvlist_create(0);
1416 if (nvpeer == NULL) {
1417 OVPN_RUNLOCK(sc);
1418 nvlist_destroy(*nvl);
1419 *nvl = NULL;
1420 return (ENOMEM);
1421 }
1422
1423 nvlist_add_number(nvpeer, "peerid", peer->peerid);
1424
1425 OVPN_PEER_COUNTER_OUT("packets", pkt_in, pkt_out);
1426 OVPN_PEER_COUNTER_OUT("bytes", bytes_in, bytes_out);
1427
1428 nvlist_append_nvlist_array(*nvl, "peers", nvpeer);
1429 nvlist_destroy(nvpeer);
1430 }
1431 #undef OVPN_PEER_COUNTER_OUT
1432 OVPN_RUNLOCK(sc);
1433
1434 return (0);
1435
1436 error:
1437 nvlist_destroy(nvpeer);
1438 nvlist_destroy(*nvl);
1439 *nvl = NULL;
1440 return (ret);
1441 }
1442
1443 static int
ovpn_poll_pkt(struct ovpn_softc * sc,nvlist_t ** onvl)1444 ovpn_poll_pkt(struct ovpn_softc *sc, nvlist_t **onvl)
1445 {
1446 nvlist_t *nvl;
1447
1448 nvl = nvlist_create(0);
1449 if (nvl == NULL)
1450 return (ENOMEM);
1451
1452 nvlist_add_number(nvl, "pending", buf_ring_count(sc->notifring));
1453
1454 *onvl = nvl;
1455
1456 return (0);
1457 }
1458
1459 static void
ovpn_notif_add_counters(nvlist_t * parent,struct ovpn_notification * n)1460 ovpn_notif_add_counters(nvlist_t *parent, struct ovpn_notification *n)
1461 {
1462 nvlist_t *nvl;
1463
1464 nvl = nvlist_create(0);
1465 if (nvl == NULL)
1466 return;
1467
1468 nvlist_add_number(nvl, "in", n->counters.pkt_in);
1469 nvlist_add_number(nvl, "out", n->counters.pkt_out);
1470
1471 nvlist_add_nvlist(parent, "packets", nvl);
1472 nvlist_destroy(nvl);
1473
1474 nvl = nvlist_create(0);
1475 if (nvl == NULL)
1476 return;
1477
1478 nvlist_add_number(nvl, "in", n->counters.bytes_in);
1479 nvlist_add_number(nvl, "out", n->counters.bytes_out);
1480
1481 nvlist_add_nvlist(parent, "bytes", nvl);
1482 nvlist_destroy(nvl);
1483 }
1484
1485 static int
opvn_get_pkt(struct ovpn_softc * sc,nvlist_t ** onvl)1486 opvn_get_pkt(struct ovpn_softc *sc, nvlist_t **onvl)
1487 {
1488 struct ovpn_notification *n;
1489 nvlist_t *nvl;
1490
1491 /* Check if we have notifications pending. */
1492 n = buf_ring_dequeue_mc(sc->notifring);
1493 if (n == NULL)
1494 return (ENOENT);
1495
1496 nvl = nvlist_create(0);
1497 if (nvl == NULL) {
1498 free(n, M_OVPN);
1499 return (ENOMEM);
1500 }
1501 nvlist_add_number(nvl, "peerid", n->peerid);
1502 nvlist_add_number(nvl, "notification", n->type);
1503 switch (n->type) {
1504 case OVPN_NOTIF_DEL_PEER: {
1505 nvlist_add_number(nvl, "del_reason", n->del_reason);
1506
1507 /* No error handling, because we want to send the notification
1508 * even if we can't attach the counters. */
1509 ovpn_notif_add_counters(nvl, n);
1510 break;
1511 }
1512 case OVPN_NOTIF_FLOAT: {
1513 int ret;
1514
1515 ret = ovpn_add_sockaddr(nvl, "address",
1516 (struct sockaddr *)&n->address);
1517
1518 if (ret) {
1519 /*
1520 * Try to re-enqueue the notification. Maybe we'll
1521 * have better luck next time. No error handling,
1522 * because if we fail to re-enqueue there's nothing we can do.
1523 */
1524 (void)ovpn_notify_float(sc, n->peerid, &n->address);
1525 nvlist_destroy(nvl);
1526 free(n, M_OVPN);
1527 return (ret);
1528 }
1529 break;
1530 }
1531 default:
1532 break;
1533 }
1534 free(n, M_OVPN);
1535
1536 *onvl = nvl;
1537
1538 return (0);
1539 }
1540
1541 static int
ovpn_ioctl_get(struct ifnet * ifp,struct ifdrv * ifd)1542 ovpn_ioctl_get(struct ifnet *ifp, struct ifdrv *ifd)
1543 {
1544 struct ovpn_softc *sc = ifp->if_softc;
1545 nvlist_t *nvl = NULL;
1546 int error;
1547
1548 switch (ifd->ifd_cmd) {
1549 case OVPN_GET_STATS:
1550 error = ovpn_get_stats(sc, &nvl);
1551 break;
1552 case OVPN_GET_PEER_STATS:
1553 error = ovpn_get_peer_stats(sc, &nvl);
1554 break;
1555 case OVPN_POLL_PKT:
1556 error = ovpn_poll_pkt(sc, &nvl);
1557 break;
1558 case OVPN_GET_PKT:
1559 error = opvn_get_pkt(sc, &nvl);
1560 break;
1561 default:
1562 error = ENOTSUP;
1563 break;
1564 }
1565
1566 if (error == 0) {
1567 void *packed = NULL;
1568 size_t len;
1569
1570 MPASS(nvl != NULL);
1571
1572 packed = nvlist_pack(nvl, &len);
1573 if (! packed) {
1574 nvlist_destroy(nvl);
1575 return (ENOMEM);
1576 }
1577
1578 if (len > ifd->ifd_len) {
1579 free(packed, M_NVLIST);
1580 nvlist_destroy(nvl);
1581 return (ENOSPC);
1582 }
1583
1584 error = copyout(packed, ifd->ifd_data, len);
1585 ifd->ifd_len = len;
1586
1587 free(packed, M_NVLIST);
1588 nvlist_destroy(nvl);
1589 }
1590
1591 return (error);
1592 }
1593
1594 static int
ovpn_ioctl(struct ifnet * ifp,u_long cmd,caddr_t data)1595 ovpn_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1596 {
1597 struct ifdrv *ifd;
1598 int error;
1599
1600 CURVNET_ASSERT_SET();
1601
1602 switch (cmd) {
1603 case SIOCSDRVSPEC:
1604 case SIOCGDRVSPEC:
1605 error = priv_check(curthread, PRIV_NET_OVPN);
1606 if (error)
1607 return (error);
1608 break;
1609 }
1610
1611 switch (cmd) {
1612 case SIOCSDRVSPEC:
1613 ifd = (struct ifdrv *)data;
1614 error = ovpn_ioctl_set(ifp, ifd);
1615 break;
1616 case SIOCGDRVSPEC:
1617 ifd = (struct ifdrv *)data;
1618 error = ovpn_ioctl_get(ifp, ifd);
1619 break;
1620 case SIOCSIFMTU: {
1621 struct ifreq *ifr = (struct ifreq *)data;
1622 if (ifr->ifr_mtu < OVPN_MTU_MIN || ifr->ifr_mtu > OVPN_MTU_MAX)
1623 return (EINVAL);
1624
1625 ifp->if_mtu = ifr->ifr_mtu;
1626 return (0);
1627 }
1628 case SIOCSIFADDR:
1629 case SIOCADDMULTI:
1630 case SIOCDELMULTI:
1631 case SIOCGIFMTU:
1632 case SIOCSIFFLAGS:
1633 return (0);
1634 default:
1635 error = EINVAL;
1636 }
1637
1638 return (error);
1639 }
1640
1641 static int
ovpn_encrypt_tx_cb(struct cryptop * crp)1642 ovpn_encrypt_tx_cb(struct cryptop *crp)
1643 {
1644 struct epoch_tracker et;
1645 struct ovpn_kpeer *peer = crp->crp_opaque;
1646 struct ovpn_softc *sc = peer->sc;
1647 struct mbuf *m = crp->crp_buf.cb_mbuf;
1648 int tunnel_len;
1649 int ret;
1650
1651 CURVNET_SET(sc->ifp->if_vnet);
1652 NET_EPOCH_ENTER(et);
1653
1654 if (crp->crp_etype != 0) {
1655 crypto_freereq(crp);
1656 ovpn_peer_release_ref(peer, false);
1657 NET_EPOCH_EXIT(et);
1658 CURVNET_RESTORE();
1659 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1);
1660 m_freem(m);
1661 return (0);
1662 }
1663
1664 MPASS(crp->crp_buf.cb_type == CRYPTO_BUF_MBUF);
1665
1666 tunnel_len = m->m_pkthdr.len - sizeof(struct ovpn_wire_header);
1667 ret = ovpn_encap(sc, peer->peerid, m);
1668 if (ret == 0) {
1669 OVPN_COUNTER_ADD(sc, sent_data_pkts, 1);
1670 OVPN_COUNTER_ADD(sc, tunnel_bytes_sent, tunnel_len);
1671 }
1672
1673 crypto_freereq(crp);
1674 ovpn_peer_release_ref(peer, false);
1675
1676 NET_EPOCH_EXIT(et);
1677 CURVNET_RESTORE();
1678
1679 return (0);
1680 }
1681
1682 static void
ovpn_finish_rx(struct ovpn_softc * sc,struct mbuf * m,struct ovpn_kpeer * peer,struct ovpn_kkey * key,uint32_t seq,struct rm_priotracker * _ovpn_lock_trackerp)1683 ovpn_finish_rx(struct ovpn_softc *sc, struct mbuf *m,
1684 struct ovpn_kpeer *peer, struct ovpn_kkey *key, uint32_t seq,
1685 struct rm_priotracker *_ovpn_lock_trackerp)
1686 {
1687 uint32_t af;
1688 struct m_tag *mtag;
1689
1690 OVPN_RASSERT(sc);
1691 NET_EPOCH_ASSERT();
1692
1693 /* Replay protection. */
1694 if (V_replay_protection && ! ovpn_check_replay(key->decrypt, seq)) {
1695 OVPN_RUNLOCK(sc);
1696 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1);
1697 m_freem(m);
1698 return;
1699 }
1700
1701 critical_enter();
1702 *zpcpu_get(peer->last_active) = time_uptime;
1703 critical_exit();
1704
1705 OVPN_RUNLOCK(sc);
1706
1707 /* Check if the peer changed to a new source address. */
1708 mtag = m_tag_find(m, PACKET_TAG_OVPN, NULL);
1709 if (mtag != NULL) {
1710 struct ovpn_mtag *ot = (struct ovpn_mtag *)(mtag + 1);
1711
1712 OVPN_WLOCK(sc);
1713
1714 /*
1715 * Check the address against the peer's remote again, because we may race
1716 * against ourselves (i.e. we may have tagged multiple packets to indicate we
1717 * floated).
1718 */
1719 if (ovpn_sockaddr_compare((struct sockaddr *)&ot->addr,
1720 (struct sockaddr *)&peer->remote)) {
1721 OVPN_WUNLOCK(sc);
1722 goto skip_float;
1723 }
1724
1725 /* And notify userspace. */
1726 if (ovpn_notify_float(sc, peer->peerid, &ot->addr) == 0) {
1727 /*
1728 * Update the 'remote' for this peer, but only if
1729 * we've actually enqueued the notification.
1730 * Otherwise we can try again later.
1731 */
1732 memcpy(&peer->remote, &ot->addr, sizeof(peer->remote));
1733 }
1734
1735 OVPN_WUNLOCK(sc);
1736 }
1737
1738 skip_float:
1739 OVPN_COUNTER_ADD(sc, received_data_pkts, 1);
1740 OVPN_COUNTER_ADD(sc, tunnel_bytes_received, m->m_pkthdr.len);
1741 OVPN_PEER_COUNTER_ADD(peer, pkt_in, 1);
1742 OVPN_PEER_COUNTER_ADD(peer, bytes_in, m->m_pkthdr.len);
1743
1744 /* Receive the packet on our interface. */
1745 m->m_pkthdr.rcvif = sc->ifp;
1746
1747 /* Clear checksum flags in case the real hardware set them. */
1748 m->m_pkthdr.csum_flags = 0;
1749
1750 /* Clear mbuf tags & flags */
1751 m_tag_delete_nonpersistent(m);
1752 m_clrprotoflags(m);
1753
1754 /* Ensure we can read the first byte. */
1755 m = m_pullup(m, 1);
1756 if (m == NULL) {
1757 OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1);
1758 return;
1759 }
1760
1761 /*
1762 * Check for address family, and disregard any control packets (e.g.
1763 * keepalive).
1764 */
1765 af = ovpn_get_af(m);
1766 if (af != 0) {
1767 BPF_MTAP2(sc->ifp, &af, sizeof(af), m);
1768 if (V_async_netisr_queue)
1769 netisr_queue(af == AF_INET ? NETISR_IP : NETISR_IPV6, m);
1770 else
1771 netisr_dispatch(af == AF_INET ? NETISR_IP : NETISR_IPV6, m);
1772 } else {
1773 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1);
1774 m_freem(m);
1775 }
1776 }
1777
1778 static struct ovpn_kkey *
ovpn_find_key(struct ovpn_softc * sc,struct ovpn_kpeer * peer,const struct ovpn_wire_header * ohdr)1779 ovpn_find_key(struct ovpn_softc *sc, struct ovpn_kpeer *peer,
1780 const struct ovpn_wire_header *ohdr)
1781 {
1782 struct ovpn_kkey *key = NULL;
1783 uint8_t keyid;
1784
1785 OVPN_RASSERT(sc);
1786
1787 keyid = (ntohl(ohdr->opcode) >> 24) & 0x07;
1788
1789 if (peer->keys[0].keyid == keyid)
1790 key = &peer->keys[0];
1791 else if (peer->keys[1].keyid == keyid)
1792 key = &peer->keys[1];
1793
1794 return (key);
1795 }
1796
1797 static int
ovpn_decrypt_rx_cb(struct cryptop * crp)1798 ovpn_decrypt_rx_cb(struct cryptop *crp)
1799 {
1800 struct epoch_tracker et;
1801 struct ovpn_softc *sc = crp->crp_opaque;
1802 struct mbuf *m = crp->crp_buf.cb_mbuf;
1803 struct ovpn_kkey *key;
1804 struct ovpn_kpeer *peer;
1805 struct ovpn_wire_header *ohdr;
1806 uint32_t peerid;
1807
1808 OVPN_RLOCK_TRACKER;
1809
1810 OVPN_RLOCK(sc);
1811
1812 MPASS(crp->crp_buf.cb_type == CRYPTO_BUF_MBUF);
1813
1814 if (crp->crp_etype != 0) {
1815 crypto_freereq(crp);
1816 atomic_add_int(&sc->refcount, -1);
1817 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1);
1818 OVPN_RUNLOCK(sc);
1819 m_freem(m);
1820 return (0);
1821 }
1822
1823 CURVNET_SET(sc->ifp->if_vnet);
1824
1825 ohdr = mtodo(m, sizeof(struct udphdr));
1826
1827 peerid = ntohl(ohdr->opcode) & 0x00ffffff;
1828 peer = ovpn_find_peer(sc, peerid);
1829 if (peer == NULL) {
1830 /* No such peer. Drop packet. */
1831 crypto_freereq(crp);
1832 atomic_add_int(&sc->refcount, -1);
1833 OVPN_RUNLOCK(sc);
1834 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1);
1835 m_freem(m);
1836 CURVNET_RESTORE();
1837 return (0);
1838 }
1839
1840 key = ovpn_find_key(sc, peer, ohdr);
1841 if (key == NULL) {
1842 crypto_freereq(crp);
1843 atomic_add_int(&sc->refcount, -1);
1844 /*
1845 * Has this key been removed between us starting the decrypt
1846 * and finishing it?
1847 */
1848 OVPN_RUNLOCK(sc);
1849 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1);
1850 m_freem(m);
1851 CURVNET_RESTORE();
1852 return (0);
1853 }
1854
1855 /* Now remove the outer headers */
1856 m_adj_decap(m, sizeof(struct udphdr) +
1857 sizeof(struct ovpn_wire_header));
1858
1859 NET_EPOCH_ENTER(et);
1860 ovpn_finish_rx(sc, m, peer, key, ntohl(ohdr->seq), _ovpn_lock_trackerp);
1861 NET_EPOCH_EXIT(et);
1862 OVPN_UNLOCK_ASSERT(sc);
1863
1864 CURVNET_RESTORE();
1865
1866 crypto_freereq(crp);
1867 atomic_add_int(&sc->refcount, -1);
1868
1869 return (0);
1870 }
1871
1872 static int
ovpn_get_af(struct mbuf * m)1873 ovpn_get_af(struct mbuf *m)
1874 {
1875 struct ip *ip;
1876 struct ip6_hdr *ip6;
1877
1878 /*
1879 * We should pullup, but we're only interested in the first byte, so
1880 * that'll always be contiguous.
1881 */
1882 ip = mtod(m, struct ip *);
1883 if (ip->ip_v == IPVERSION)
1884 return (AF_INET);
1885
1886 ip6 = mtod(m, struct ip6_hdr *);
1887 if ((ip6->ip6_vfc & IPV6_VERSION_MASK) == IPV6_VERSION)
1888 return (AF_INET6);
1889
1890 return (0);
1891 }
1892
1893 #ifdef INET
1894 static struct ovpn_kpeer *
ovpn_find_peer_by_ip(struct ovpn_softc * sc,const struct in_addr addr)1895 ovpn_find_peer_by_ip(struct ovpn_softc *sc, const struct in_addr addr)
1896 {
1897 struct ovpn_kpeer *peer = NULL;
1898
1899 OVPN_ASSERT(sc);
1900
1901 /* TODO: Add a second RB so we can look up by IP. */
1902 RB_FOREACH(peer, ovpn_kpeers, &sc->peers) {
1903 if (addr.s_addr == peer->vpn4.s_addr)
1904 return (peer);
1905 }
1906
1907 return (peer);
1908 }
1909 #endif
1910
1911 #ifdef INET6
1912 static struct ovpn_kpeer *
ovpn_find_peer_by_ip6(struct ovpn_softc * sc,const struct in6_addr * addr)1913 ovpn_find_peer_by_ip6(struct ovpn_softc *sc, const struct in6_addr *addr)
1914 {
1915 struct ovpn_kpeer *peer = NULL;
1916
1917 OVPN_ASSERT(sc);
1918
1919 /* TODO: Add a third RB so we can look up by IPv6 address. */
1920 RB_FOREACH(peer, ovpn_kpeers, &sc->peers) {
1921 if (memcmp(addr, &peer->vpn6, sizeof(*addr)) == 0)
1922 return (peer);
1923 }
1924
1925 return (peer);
1926 }
1927 #endif
1928
1929 static struct ovpn_kpeer *
ovpn_route_peer(struct ovpn_softc * sc,struct mbuf ** m0,const struct sockaddr * dst)1930 ovpn_route_peer(struct ovpn_softc *sc, struct mbuf **m0,
1931 const struct sockaddr *dst)
1932 {
1933 struct ovpn_kpeer *peer = NULL;
1934 int af;
1935
1936 NET_EPOCH_ASSERT();
1937 OVPN_ASSERT(sc);
1938
1939 /* Shortcut if we're a client (or are a server and have only one client). */
1940 if (sc->peercount == 1)
1941 return (ovpn_find_only_peer(sc));
1942
1943 if (dst != NULL)
1944 af = dst->sa_family;
1945 else
1946 af = ovpn_get_af(*m0);
1947
1948 switch (af) {
1949 #ifdef INET
1950 case AF_INET: {
1951 const struct sockaddr_in *sa = (const struct sockaddr_in *)dst;
1952 struct nhop_object *nh;
1953 const struct in_addr *ip_dst;
1954
1955 if (sa != NULL) {
1956 ip_dst = &sa->sin_addr;
1957 } else {
1958 struct ip *ip;
1959
1960 *m0 = m_pullup(*m0, sizeof(struct ip));
1961 if (*m0 == NULL)
1962 return (NULL);
1963 ip = mtod(*m0, struct ip *);
1964 ip_dst = &ip->ip_dst;
1965 }
1966
1967 peer = ovpn_find_peer_by_ip(sc, *ip_dst);
1968 SDT_PROBE2(if_ovpn, tx, route, ip4, ip_dst, peer);
1969 if (peer == NULL) {
1970 nh = fib4_lookup(M_GETFIB(*m0), *ip_dst, 0,
1971 NHR_NONE, 0);
1972 if (nh && (nh->nh_flags & NHF_GATEWAY)) {
1973 peer = ovpn_find_peer_by_ip(sc,
1974 nh->gw4_sa.sin_addr);
1975 SDT_PROBE2(if_ovpn, tx, route, ip4,
1976 &nh->gw4_sa.sin_addr, peer);
1977 }
1978 }
1979 break;
1980 }
1981 #endif
1982 #ifdef INET6
1983 case AF_INET6: {
1984 const struct sockaddr_in6 *sa6 =
1985 (const struct sockaddr_in6 *)dst;
1986 struct nhop_object *nh;
1987 const struct in6_addr *ip6_dst;
1988
1989 if (sa6 != NULL) {
1990 ip6_dst = &sa6->sin6_addr;
1991 } else {
1992 struct ip6_hdr *ip6;
1993
1994 *m0 = m_pullup(*m0, sizeof(struct ip6_hdr));
1995 if (*m0 == NULL)
1996 return (NULL);
1997 ip6 = mtod(*m0, struct ip6_hdr *);
1998 ip6_dst = &ip6->ip6_dst;
1999 }
2000
2001 peer = ovpn_find_peer_by_ip6(sc, ip6_dst);
2002 SDT_PROBE2(if_ovpn, tx, route, ip6, ip6_dst, peer);
2003 if (peer == NULL) {
2004 nh = fib6_lookup(M_GETFIB(*m0), ip6_dst, 0,
2005 NHR_NONE, 0);
2006 if (nh && (nh->nh_flags & NHF_GATEWAY)) {
2007 peer = ovpn_find_peer_by_ip6(sc,
2008 &nh->gw6_sa.sin6_addr);
2009 SDT_PROBE2(if_ovpn, tx, route, ip6,
2010 &nh->gw6_sa.sin6_addr, peer);
2011 }
2012 }
2013 break;
2014 }
2015 #endif
2016 }
2017
2018 return (peer);
2019 }
2020
2021 static int
ovpn_transmit(struct ifnet * ifp,struct mbuf * m)2022 ovpn_transmit(struct ifnet *ifp, struct mbuf *m)
2023 {
2024 return (ifp->if_output(ifp, m, NULL, NULL));
2025 }
2026
2027 static int
ovpn_transmit_to_peer(struct ifnet * ifp,struct mbuf * m,struct ovpn_kpeer * peer,struct rm_priotracker * _ovpn_lock_trackerp)2028 ovpn_transmit_to_peer(struct ifnet *ifp, struct mbuf *m,
2029 struct ovpn_kpeer *peer, struct rm_priotracker *_ovpn_lock_trackerp)
2030 {
2031 struct ovpn_wire_header *ohdr;
2032 struct ovpn_kkey *key;
2033 struct ovpn_softc *sc;
2034 struct cryptop *crp;
2035 uint32_t af, seq;
2036 uint64_t seq64;
2037 size_t len, ovpn_hdr_len;
2038 int tunnel_len;
2039 int ret;
2040
2041 sc = ifp->if_softc;
2042
2043 OVPN_RASSERT(sc);
2044
2045 tunnel_len = m->m_pkthdr.len;
2046
2047 key = &peer->keys[OVPN_KEY_SLOT_PRIMARY];
2048 if (key->encrypt == NULL) {
2049 if (_ovpn_lock_trackerp != NULL)
2050 OVPN_RUNLOCK(sc);
2051 m_freem(m);
2052 return (ENOLINK);
2053 }
2054
2055 af = ovpn_get_af(m);
2056 /* Don't capture control packets. */
2057 if (af != 0)
2058 BPF_MTAP2(ifp, &af, sizeof(af), m);
2059
2060 if (__predict_false(if_tunnel_check_nesting(ifp, m, MTAG_OVPN_LOOP, 3))) {
2061 if (_ovpn_lock_trackerp != NULL)
2062 OVPN_RUNLOCK(sc);
2063 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1);
2064 m_freem(m);
2065 return (ELOOP);
2066 }
2067
2068 len = m->m_pkthdr.len;
2069 MPASS(len <= ifp->if_mtu);
2070
2071 ovpn_hdr_len = sizeof(struct ovpn_wire_header);
2072 if (key->encrypt->cipher == OVPN_CIPHER_ALG_NONE)
2073 ovpn_hdr_len -= 16; /* No auth tag. */
2074
2075 M_PREPEND(m, ovpn_hdr_len, M_NOWAIT);
2076 if (m == NULL) {
2077 if (_ovpn_lock_trackerp != NULL)
2078 OVPN_RUNLOCK(sc);
2079 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1);
2080 return (ENOBUFS);
2081 }
2082 ohdr = mtod(m, struct ovpn_wire_header *);
2083 ohdr->opcode = (OVPN_OP_DATA_V2 << OVPN_OP_SHIFT) | key->keyid;
2084 ohdr->opcode <<= 24;
2085 ohdr->opcode |= key->peerid;
2086 ohdr->opcode = htonl(ohdr->opcode);
2087
2088 seq64 = atomic_fetchadd_64(&peer->keys[OVPN_KEY_SLOT_PRIMARY].encrypt->tx_seq, 1);
2089 if (seq64 == OVPN_SEQ_ROTATE) {
2090 ovpn_notify_key_rotation(sc, peer);
2091 } else if (seq64 > UINT32_MAX) {
2092 /* We've wrapped, give up on this packet. */
2093 if (_ovpn_lock_trackerp != NULL)
2094 OVPN_RUNLOCK(sc);
2095 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1);
2096
2097 /* Let's avoid (very unlikely, but still) wraparounds of the
2098 * 64-bit counter taking us back to 0. */
2099 atomic_store_64(&peer->keys[OVPN_KEY_SLOT_PRIMARY].encrypt->tx_seq,
2100 UINT32_MAX);
2101
2102 return (ENOBUFS);
2103 }
2104
2105 seq = htonl(seq64 & UINT32_MAX);
2106 ohdr->seq = seq;
2107
2108 OVPN_PEER_COUNTER_ADD(peer, pkt_out, 1);
2109 OVPN_PEER_COUNTER_ADD(peer, bytes_out, len);
2110
2111 if (key->encrypt->cipher == OVPN_CIPHER_ALG_NONE) {
2112 ret = ovpn_encap(sc, peer->peerid, m);
2113 if (_ovpn_lock_trackerp != NULL)
2114 OVPN_RUNLOCK(sc);
2115 if (ret == 0) {
2116 OVPN_COUNTER_ADD(sc, sent_data_pkts, 1);
2117 OVPN_COUNTER_ADD(sc, tunnel_bytes_sent, tunnel_len);
2118 }
2119 return (ret);
2120 }
2121
2122 crp = crypto_getreq(key->encrypt->cryptoid, M_NOWAIT);
2123 if (crp == NULL) {
2124 if (_ovpn_lock_trackerp != NULL)
2125 OVPN_RUNLOCK(sc);
2126 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1);
2127 m_freem(m);
2128 return (ENOBUFS);
2129 }
2130
2131 /* Encryption covers only the payload, not the header. */
2132 crp->crp_payload_start = sizeof(*ohdr);
2133 crp->crp_payload_length = len;
2134 crp->crp_op = CRYPTO_OP_ENCRYPT;
2135
2136 /*
2137 * AAD data covers the ovpn_wire_header minus the auth
2138 * tag.
2139 */
2140 crp->crp_aad_length = sizeof(*ohdr) - sizeof(ohdr->auth_tag);
2141 crp->crp_aad = ohdr;
2142 crp->crp_aad_start = 0;
2143 crp->crp_op |= CRYPTO_OP_COMPUTE_DIGEST;
2144 crp->crp_digest_start = offsetof(struct ovpn_wire_header, auth_tag);
2145
2146 crp->crp_flags |= CRYPTO_F_IV_SEPARATE;
2147 memcpy(crp->crp_iv, &seq, sizeof(seq));
2148 memcpy(crp->crp_iv + sizeof(seq), key->encrypt->nonce,
2149 key->encrypt->noncelen);
2150
2151 crypto_use_mbuf(crp, m);
2152 crp->crp_flags |= CRYPTO_F_CBIFSYNC;
2153 crp->crp_callback = ovpn_encrypt_tx_cb;
2154 crp->crp_opaque = peer;
2155
2156 atomic_add_int(&peer->refcount, 1);
2157 if (_ovpn_lock_trackerp != NULL)
2158 OVPN_RUNLOCK(sc);
2159 if (V_async_crypto)
2160 ret = crypto_dispatch_async(crp, CRYPTO_ASYNC_ORDERED);
2161 else
2162 ret = crypto_dispatch(crp);
2163 if (ret) {
2164 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1);
2165 }
2166
2167 return (ret);
2168 }
2169
2170 /*
2171 * Note: Expects to hold the read lock on entry, and will release it itself.
2172 */
2173 static int
ovpn_encap(struct ovpn_softc * sc,uint32_t peerid,struct mbuf * m)2174 ovpn_encap(struct ovpn_softc *sc, uint32_t peerid, struct mbuf *m)
2175 {
2176 struct udphdr *udp;
2177 struct ovpn_kpeer *peer;
2178 int len;
2179
2180 OVPN_RLOCK_TRACKER;
2181
2182 OVPN_RLOCK(sc);
2183 NET_EPOCH_ASSERT();
2184
2185 peer = ovpn_find_peer(sc, peerid);
2186 if (peer == NULL || sc->ifp->if_link_state != LINK_STATE_UP) {
2187 OVPN_RUNLOCK(sc);
2188 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1);
2189 m_freem(m);
2190 return (ENETDOWN);
2191 }
2192
2193 len = m->m_pkthdr.len;
2194
2195 M_PREPEND(m, sizeof(struct udphdr), M_NOWAIT);
2196 if (m == NULL) {
2197 OVPN_RUNLOCK(sc);
2198 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1);
2199 m_freem(m);
2200 return (ENOBUFS);
2201 }
2202 udp = mtod(m, struct udphdr *);
2203
2204 MPASS(peer->local.ss_family == peer->remote.ss_family);
2205
2206 udp->uh_sport = ovpn_get_port(&peer->local);
2207 udp->uh_dport = ovpn_get_port(&peer->remote);
2208 udp->uh_ulen = htons(sizeof(struct udphdr) + len);
2209
2210 switch (peer->remote.ss_family) {
2211 #ifdef INET
2212 case AF_INET: {
2213 struct sockaddr_in *in_local = TO_IN(&peer->local);
2214 struct sockaddr_in *in_remote = TO_IN(&peer->remote);
2215 struct ip *ip;
2216
2217 /*
2218 * This requires knowing the source IP, which we don't. Happily
2219 * we're allowed to keep this at 0, and the checksum won't do
2220 * anything the crypto won't already do.
2221 */
2222 udp->uh_sum = 0;
2223
2224 /* Set the checksum flags so we recalculate checksums. */
2225 m->m_pkthdr.csum_flags |= CSUM_IP;
2226 m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
2227
2228 M_PREPEND(m, sizeof(struct ip), M_NOWAIT);
2229 if (m == NULL) {
2230 OVPN_RUNLOCK(sc);
2231 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1);
2232 return (ENOBUFS);
2233 }
2234 ip = mtod(m, struct ip *);
2235
2236 ip->ip_tos = 0;
2237 ip->ip_len = htons(sizeof(struct ip) + sizeof(struct udphdr) +
2238 len);
2239 ip->ip_off = 0;
2240 ip->ip_ttl = V_ip_defttl;
2241 ip->ip_p = IPPROTO_UDP;
2242 ip->ip_sum = 0;
2243 if (in_local->sin_port != 0)
2244 ip->ip_src = in_local->sin_addr;
2245 else
2246 ip->ip_src.s_addr = INADDR_ANY;
2247 ip->ip_dst = in_remote->sin_addr;
2248
2249 OVPN_RUNLOCK(sc);
2250 OVPN_COUNTER_ADD(sc, transport_bytes_sent, m->m_pkthdr.len);
2251
2252 return (ip_output(m, NULL, NULL, 0, NULL, NULL));
2253 }
2254 #endif
2255 #ifdef INET6
2256 case AF_INET6: {
2257 struct sockaddr_in6 *in6_local = TO_IN6(&peer->local);
2258 struct sockaddr_in6 *in6_remote = TO_IN6(&peer->remote);
2259 struct ip6_hdr *ip6;
2260
2261 M_PREPEND(m, sizeof(struct ip6_hdr), M_NOWAIT);
2262 if (m == NULL) {
2263 OVPN_RUNLOCK(sc);
2264 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1);
2265 return (ENOBUFS);
2266 }
2267 m = m_pullup(m, sizeof(*ip6) + sizeof(*udp));
2268 if (m == NULL) {
2269 OVPN_RUNLOCK(sc);
2270 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1);
2271 return (ENOBUFS);
2272 }
2273
2274 ip6 = mtod(m, struct ip6_hdr *);
2275
2276 ip6->ip6_vfc = IPV6_VERSION;
2277 ip6->ip6_flow &= ~IPV6_FLOWINFO_MASK;
2278 ip6->ip6_plen = htons(sizeof(*ip6) + sizeof(struct udphdr) +
2279 len);
2280 ip6->ip6_nxt = IPPROTO_UDP;
2281 ip6->ip6_hlim = V_ip6_defhlim;
2282
2283 memcpy(&ip6->ip6_src, &in6_local->sin6_addr,
2284 sizeof(ip6->ip6_src));
2285 memcpy(&ip6->ip6_dst, &in6_remote->sin6_addr,
2286 sizeof(ip6->ip6_dst));
2287
2288 if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src)) {
2289 /* Local and remote must have the same scope. */
2290 ip6->ip6_src.__u6_addr.__u6_addr16[1] =
2291 htons(in6_remote->sin6_scope_id & 0xffff);
2292 }
2293 if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst))
2294 ip6->ip6_dst.__u6_addr.__u6_addr16[1] =
2295 htons(in6_remote->sin6_scope_id & 0xffff);
2296
2297 udp = mtodo(m, sizeof(*ip6));
2298 udp->uh_sum = in6_cksum_pseudo(ip6,
2299 m->m_pkthdr.len - sizeof(struct ip6_hdr),
2300 IPPROTO_UDP, 0);
2301
2302 m->m_pkthdr.csum_flags |= CSUM_UDP_IPV6;
2303 m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
2304
2305 OVPN_RUNLOCK(sc);
2306 OVPN_COUNTER_ADD(sc, transport_bytes_sent, m->m_pkthdr.len);
2307
2308 return (ip6_output(m, NULL, NULL, IPV6_UNSPECSRC, NULL, NULL,
2309 NULL));
2310 }
2311 #endif
2312 default:
2313 panic("Unsupported address family %d",
2314 peer->remote.ss_family);
2315 }
2316 }
2317
2318 static int
ovpn_output(struct ifnet * ifp,struct mbuf * m,const struct sockaddr * dst,struct route * ro)2319 ovpn_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
2320 struct route *ro)
2321 {
2322 struct ovpn_softc *sc;
2323 struct ovpn_kpeer *peer;
2324
2325 OVPN_RLOCK_TRACKER;
2326
2327 sc = ifp->if_softc;
2328
2329 m = m_unshare(m, M_NOWAIT);
2330 if (m == NULL) {
2331 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1);
2332 return (ENOBUFS);
2333 }
2334
2335 OVPN_RLOCK(sc);
2336
2337 SDT_PROBE1(if_ovpn, tx, transmit, start, m);
2338
2339 if (__predict_false(ifp->if_link_state != LINK_STATE_UP)) {
2340 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1);
2341 OVPN_RUNLOCK(sc);
2342 m_freem(m);
2343 return (ENETDOWN);
2344 }
2345
2346 /**
2347 * Only obey 'dst' (i.e. the gateway) if no route is supplied.
2348 * That's our indication that we're being called through pf's route-to,
2349 * and we should route according to 'dst' instead. We can't do so
2350 * consistently, because the usual openvpn configuration sets the first
2351 * non-server IP in the subnet as the gateway. If we always use that
2352 * one we'd end up routing all traffic to the first client.
2353 * tl;dr: 'ro == NULL' tells us pf is doing a route-to, and then but
2354 * only then, we should treat 'dst' as the destination. */
2355 peer = ovpn_route_peer(sc, &m, ro == NULL ? dst : NULL);
2356 if (peer == NULL) {
2357 /* No destination. */
2358 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1);
2359 OVPN_RUNLOCK(sc);
2360 m_freem(m);
2361 return (ENETDOWN);
2362 }
2363
2364 return (ovpn_transmit_to_peer(ifp, m, peer, _ovpn_lock_trackerp));
2365 }
2366
2367 static bool
ovpn_check_replay(struct ovpn_kkey_dir * key,uint32_t seq)2368 ovpn_check_replay(struct ovpn_kkey_dir *key, uint32_t seq)
2369 {
2370 uint32_t d;
2371
2372 mtx_lock(&key->replay_mtx);
2373
2374 /* Sequence number must be strictly greater than rx_seq */
2375 if (seq <= key->rx_seq) {
2376 mtx_unlock(&key->replay_mtx);
2377 return (false);
2378 }
2379
2380 /* Large jump. The packet authenticated okay, so just accept that. */
2381 if (seq > (key->rx_seq + (sizeof(key->rx_window) * 8))) {
2382 key->rx_seq = seq;
2383 key->rx_window = 0;
2384 mtx_unlock(&key->replay_mtx);
2385 return (true);
2386 }
2387
2388 /* Happy case. */
2389 if ((seq == key->rx_seq + 1) && key->rx_window == 0) {
2390 key->rx_seq++;
2391 mtx_unlock(&key->replay_mtx);
2392 return (true);
2393 }
2394
2395 d = seq - key->rx_seq - 1;
2396
2397 if (key->rx_window & ((uint64_t)1 << d)) {
2398 /* Dupe! */
2399 mtx_unlock(&key->replay_mtx);
2400 return (false);
2401 }
2402
2403 key->rx_window |= (uint64_t)1 << d;
2404
2405 while (key->rx_window & 1) {
2406 key->rx_seq++;
2407 key->rx_window >>= 1;
2408 }
2409
2410 mtx_unlock(&key->replay_mtx);
2411
2412 return (true);
2413 }
2414
2415 static struct ovpn_kpeer *
ovpn_peer_from_mbuf(struct ovpn_softc * sc,struct mbuf * m,int off)2416 ovpn_peer_from_mbuf(struct ovpn_softc *sc, struct mbuf *m, int off)
2417 {
2418 struct ovpn_wire_header ohdr;
2419 uint32_t peerid;
2420 const size_t hdrlen = sizeof(ohdr) - sizeof(ohdr.auth_tag);
2421
2422 OVPN_RASSERT(sc);
2423
2424 if (m_length(m, NULL) < (off + sizeof(struct udphdr) + hdrlen))
2425 return (NULL);
2426
2427 m_copydata(m, off + sizeof(struct udphdr), hdrlen, (caddr_t)&ohdr);
2428
2429 peerid = ntohl(ohdr.opcode) & 0x00ffffff;
2430
2431 return (ovpn_find_peer(sc, peerid));
2432 }
2433
2434 static bool
ovpn_udp_input(struct mbuf * m,int off,struct inpcb * inp,const struct sockaddr * sa,void * ctx)2435 ovpn_udp_input(struct mbuf *m, int off, struct inpcb *inp,
2436 const struct sockaddr *sa, void *ctx)
2437 {
2438 struct ovpn_softc *sc = ctx;
2439 struct ovpn_wire_header tmphdr;
2440 struct ovpn_wire_header *ohdr;
2441 struct udphdr *uhdr;
2442 struct ovpn_kkey *key;
2443 struct cryptop *crp;
2444 struct ovpn_kpeer *peer;
2445 size_t ohdrlen;
2446 int ret;
2447 uint8_t op;
2448
2449 OVPN_RLOCK_TRACKER;
2450
2451 M_ASSERTPKTHDR(m);
2452
2453 OVPN_COUNTER_ADD(sc, transport_bytes_received, m->m_pkthdr.len - off);
2454
2455 ohdrlen = sizeof(*ohdr) - sizeof(ohdr->auth_tag);
2456
2457 OVPN_RLOCK(sc);
2458
2459 peer = ovpn_peer_from_mbuf(sc, m, off);
2460 if (peer == NULL) {
2461 OVPN_RUNLOCK(sc);
2462 return (false);
2463 }
2464
2465 if (m_length(m, NULL) < (off + sizeof(*uhdr) + ohdrlen)) {
2466 /* Short packet. */
2467 OVPN_RUNLOCK(sc);
2468 return (false);
2469 }
2470
2471 m_copydata(m, off + sizeof(*uhdr), ohdrlen, (caddr_t)&tmphdr);
2472
2473 op = ntohl(tmphdr.opcode) >> 24 >> OVPN_OP_SHIFT;
2474 if (op != OVPN_OP_DATA_V2) {
2475 /* Control packet? */
2476 OVPN_RUNLOCK(sc);
2477 return (false);
2478 }
2479
2480 m = m_unshare(m, M_NOWAIT);
2481 if (m == NULL) {
2482 OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1);
2483 return (true);
2484 }
2485
2486 m = m_pullup(m, off + sizeof(*uhdr) + ohdrlen);
2487 if (m == NULL) {
2488 OVPN_RUNLOCK(sc);
2489 OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1);
2490 return (true);
2491 }
2492
2493 /*
2494 * Simplify things by getting rid of the preceding headers, we don't
2495 * care about them.
2496 */
2497 m_adj_decap(m, off);
2498
2499 uhdr = mtodo(m, 0);
2500 ohdr = mtodo(m, sizeof(*uhdr));
2501
2502 key = ovpn_find_key(sc, peer, ohdr);
2503 if (key == NULL || key->decrypt == NULL) {
2504 OVPN_RUNLOCK(sc);
2505 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1);
2506 m_freem(m);
2507 return (true);
2508 }
2509
2510 /*
2511 * If we got this from a different address than we expected tag the packet.
2512 * We'll deal with notifiying userspace later, after we've decrypted and
2513 * verified.
2514 */
2515 if (! ovpn_sockaddr_compare((struct sockaddr *)&peer->remote, sa)) {
2516 struct m_tag *mt;
2517 struct ovpn_mtag *ot;
2518
2519 MPASS(sa->sa_len <= sizeof(ot->addr));
2520 mt = m_tag_get(PACKET_TAG_OVPN, sizeof(*ot), M_NOWAIT);
2521 /*
2522 * If we fail to allocate here we'll just try again on the next
2523 * packet.
2524 */
2525 if (mt != NULL) {
2526 ot = (struct ovpn_mtag *)(mt + 1);
2527 memcpy(&ot->addr, sa, sa->sa_len);
2528
2529 m_tag_prepend(m, mt);
2530 }
2531 }
2532
2533 if (key->decrypt->cipher == OVPN_CIPHER_ALG_NONE) {
2534 /* Now remove the outer headers */
2535 m_adj_decap(m, sizeof(struct udphdr) + ohdrlen);
2536
2537 ohdr = mtodo(m, sizeof(*uhdr));
2538
2539 ovpn_finish_rx(sc, m, peer, key, ntohl(ohdr->seq),
2540 _ovpn_lock_trackerp);
2541 OVPN_UNLOCK_ASSERT(sc);
2542 return (true);
2543 }
2544
2545 ohdrlen += sizeof(ohdr->auth_tag);
2546
2547 m = m_pullup(m, sizeof(*uhdr) + ohdrlen);
2548 if (m == NULL) {
2549 OVPN_RUNLOCK(sc);
2550 OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1);
2551 return (true);
2552 }
2553 uhdr = mtodo(m, 0);
2554 ohdr = mtodo(m, sizeof(*uhdr));
2555
2556 /* Decrypt */
2557 crp = crypto_getreq(key->decrypt->cryptoid, M_NOWAIT);
2558 if (crp == NULL) {
2559 OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1);
2560 OVPN_RUNLOCK(sc);
2561 m_freem(m);
2562 return (true);
2563 }
2564
2565 crp->crp_payload_start = sizeof(struct udphdr) + sizeof(*ohdr);
2566 crp->crp_payload_length = ntohs(uhdr->uh_ulen) -
2567 sizeof(*uhdr) - sizeof(*ohdr);
2568 crp->crp_op = CRYPTO_OP_DECRYPT;
2569
2570 /* AAD validation. */
2571 crp->crp_aad_length = sizeof(*ohdr) - sizeof(ohdr->auth_tag);
2572 crp->crp_aad = ohdr;
2573 crp->crp_aad_start = 0;
2574 crp->crp_op |= CRYPTO_OP_VERIFY_DIGEST;
2575 crp->crp_digest_start = sizeof(struct udphdr) +
2576 offsetof(struct ovpn_wire_header, auth_tag);
2577
2578 crp->crp_flags |= CRYPTO_F_IV_SEPARATE;
2579 memcpy(crp->crp_iv, &ohdr->seq, sizeof(ohdr->seq));
2580 memcpy(crp->crp_iv + sizeof(ohdr->seq), key->decrypt->nonce,
2581 key->decrypt->noncelen);
2582
2583 crypto_use_mbuf(crp, m);
2584 crp->crp_flags |= CRYPTO_F_CBIFSYNC;
2585 crp->crp_callback = ovpn_decrypt_rx_cb;
2586 crp->crp_opaque = sc;
2587
2588 atomic_add_int(&sc->refcount, 1);
2589 OVPN_RUNLOCK(sc);
2590 if (V_async_crypto)
2591 ret = crypto_dispatch_async(crp, CRYPTO_ASYNC_ORDERED);
2592 else
2593 ret = crypto_dispatch(crp);
2594 if (ret != 0) {
2595 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1);
2596 }
2597
2598 return (true);
2599 }
2600
2601 static void
ovpn_qflush(struct ifnet * ifp __unused)2602 ovpn_qflush(struct ifnet *ifp __unused)
2603 {
2604
2605 }
2606
2607 static void
ovpn_flush_rxring(struct ovpn_softc * sc)2608 ovpn_flush_rxring(struct ovpn_softc *sc)
2609 {
2610 struct ovpn_notification *n;
2611
2612 OVPN_WASSERT(sc);
2613
2614 while (! buf_ring_empty(sc->notifring)) {
2615 n = buf_ring_dequeue_sc(sc->notifring);
2616 free(n, M_OVPN);
2617 }
2618 }
2619
2620 #ifdef VIMAGE
2621 static void
ovpn_reassign(struct ifnet * ifp,struct vnet * new_vnet __unused,char * unused __unused)2622 ovpn_reassign(struct ifnet *ifp, struct vnet *new_vnet __unused,
2623 char *unused __unused)
2624 {
2625 struct ovpn_softc *sc = ifp->if_softc;
2626 struct ovpn_kpeer *peer, *tmppeer;
2627 int ret __diagused;
2628
2629 OVPN_WLOCK(sc);
2630
2631 /* Flush keys & configuration. */
2632 RB_FOREACH_SAFE(peer, ovpn_kpeers, &sc->peers, tmppeer) {
2633 peer->del_reason = OVPN_DEL_REASON_REQUESTED;
2634 ret = _ovpn_del_peer(sc, peer);
2635 MPASS(ret == 0);
2636 }
2637
2638 ovpn_flush_rxring(sc);
2639
2640 OVPN_WUNLOCK(sc);
2641 }
2642 #endif
2643
2644 static int
ovpn_clone_match(struct if_clone * ifc,const char * name)2645 ovpn_clone_match(struct if_clone *ifc, const char *name)
2646 {
2647 /*
2648 * Allow all names that start with 'ovpn', specifically because pfSense
2649 * uses ovpnc1 / ovpns2
2650 */
2651 return (strncmp(ovpnname, name, strlen(ovpnname)) == 0);
2652 }
2653
2654 static int
ovpn_clone_create(struct if_clone * ifc,char * name,size_t len,struct ifc_data * ifd,struct ifnet ** ifpp)2655 ovpn_clone_create(struct if_clone *ifc, char *name, size_t len,
2656 struct ifc_data *ifd, struct ifnet **ifpp)
2657 {
2658 struct ovpn_softc *sc;
2659 struct ifnet *ifp;
2660 char *dp;
2661 int error, unit, wildcard;
2662
2663 /* Try to see if a special unit was requested. */
2664 error = ifc_name2unit(name, &unit);
2665 if (error != 0)
2666 return (error);
2667 wildcard = (unit < 0);
2668
2669 error = ifc_alloc_unit(ifc, &unit);
2670 if (error != 0)
2671 return (error);
2672
2673 /*
2674 * If no unit had been given, we need to adjust the ifName.
2675 */
2676 for (dp = name; *dp != '\0'; dp++);
2677 if (wildcard) {
2678 error = snprintf(dp, len - (dp - name), "%d", unit);
2679 if (error > len - (dp - name)) {
2680 /* ifName too long. */
2681 ifc_free_unit(ifc, unit);
2682 return (ENOSPC);
2683 }
2684 dp += error;
2685 }
2686
2687 /* Make sure it doesn't already exist. */
2688 if (ifunit(name) != NULL)
2689 return (EEXIST);
2690
2691 sc = malloc(sizeof(struct ovpn_softc), M_OVPN, M_WAITOK | M_ZERO);
2692 sc->ifp = if_alloc(IFT_ENC);
2693 rm_init_flags(&sc->lock, "if_ovpn_lock", RM_RECURSE);
2694 sc->refcount = 0;
2695
2696 sc->notifring = buf_ring_alloc(32, M_OVPN, M_WAITOK, NULL);
2697
2698 COUNTER_ARRAY_ALLOC(sc->counters, OVPN_COUNTER_SIZE, M_WAITOK);
2699
2700 ifp = sc->ifp;
2701 ifp->if_softc = sc;
2702 strlcpy(ifp->if_xname, name, IFNAMSIZ);
2703 ifp->if_dname = ovpngroupname;
2704 ifp->if_dunit = unit;
2705
2706 ifp->if_addrlen = 0;
2707 ifp->if_mtu = 1428;
2708 ifp->if_flags = IFF_POINTOPOINT | IFF_MULTICAST;
2709 ifp->if_ioctl = ovpn_ioctl;
2710 ifp->if_transmit = ovpn_transmit;
2711 ifp->if_output = ovpn_output;
2712 ifp->if_qflush = ovpn_qflush;
2713 #ifdef VIMAGE
2714 ifp->if_reassign = ovpn_reassign;
2715 #endif
2716 ifp->if_capabilities |= IFCAP_LINKSTATE;
2717 ifp->if_capenable |= IFCAP_LINKSTATE;
2718
2719 if_attach(ifp);
2720 bpfattach(ifp, DLT_NULL, sizeof(uint32_t));
2721 *ifpp = ifp;
2722
2723 return (0);
2724 }
2725
2726 static void
ovpn_clone_destroy_cb(struct epoch_context * ctx)2727 ovpn_clone_destroy_cb(struct epoch_context *ctx)
2728 {
2729 struct ovpn_softc *sc;
2730 int ret __diagused;
2731
2732 sc = __containerof(ctx, struct ovpn_softc, epoch_ctx);
2733
2734 MPASS(sc->peercount == 0);
2735 MPASS(RB_EMPTY(&sc->peers));
2736
2737 if (sc->so != NULL) {
2738 CURVNET_SET(sc->ifp->if_vnet);
2739 ret = udp_set_kernel_tunneling(sc->so, NULL, NULL, NULL);
2740 MPASS(ret == 0);
2741 sorele(sc->so);
2742 CURVNET_RESTORE();
2743 }
2744
2745 COUNTER_ARRAY_FREE(sc->counters, OVPN_COUNTER_SIZE);
2746
2747 rm_destroy(&sc->lock);
2748 if_free(sc->ifp);
2749 free(sc, M_OVPN);
2750 }
2751
2752 static int
ovpn_clone_destroy(struct if_clone * ifc,struct ifnet * ifp,uint32_t flags)2753 ovpn_clone_destroy(struct if_clone *ifc, struct ifnet *ifp, uint32_t flags)
2754 {
2755 struct ovpn_softc *sc;
2756 struct ovpn_kpeer *peer, *tmppeer;
2757 int unit;
2758 int ret __diagused;
2759
2760 sc = ifp->if_softc;
2761 unit = ifp->if_dunit;
2762
2763 OVPN_WLOCK(sc);
2764
2765 if (atomic_load_int(&sc->refcount) > 0) {
2766 OVPN_WUNLOCK(sc);
2767 return (EBUSY);
2768 }
2769
2770 RB_FOREACH_SAFE(peer, ovpn_kpeers, &sc->peers, tmppeer) {
2771 peer->del_reason = OVPN_DEL_REASON_REQUESTED;
2772 ret = _ovpn_del_peer(sc, peer);
2773 MPASS(ret == 0);
2774 }
2775
2776 ovpn_flush_rxring(sc);
2777 buf_ring_free(sc->notifring, M_OVPN);
2778
2779 OVPN_WUNLOCK(sc);
2780
2781 bpfdetach(ifp);
2782 if_detach(ifp);
2783 ifp->if_softc = NULL;
2784
2785 NET_EPOCH_CALL(ovpn_clone_destroy_cb, &sc->epoch_ctx);
2786
2787 if (unit != IF_DUNIT_NONE)
2788 ifc_free_unit(ifc, unit);
2789
2790 NET_EPOCH_DRAIN_CALLBACKS();
2791
2792 return (0);
2793 }
2794
2795 static void
vnet_ovpn_init(const void * unused __unused)2796 vnet_ovpn_init(const void *unused __unused)
2797 {
2798 struct if_clone_addreq req = {
2799 .match_f = ovpn_clone_match,
2800 .create_f = ovpn_clone_create,
2801 .destroy_f = ovpn_clone_destroy,
2802 };
2803 V_ovpn_cloner = ifc_attach_cloner(ovpngroupname, &req);
2804 }
2805 VNET_SYSINIT(vnet_ovpn_init, SI_SUB_PSEUDO, SI_ORDER_ANY,
2806 vnet_ovpn_init, NULL);
2807
2808 static int
ovpn_prison_remove(void * obj,void * data __unused)2809 ovpn_prison_remove(void *obj, void *data __unused)
2810 {
2811 #ifdef VIMAGE
2812 struct prison *pr;
2813
2814 pr = obj;
2815 if (prison_owns_vnet(pr)) {
2816 CURVNET_SET(pr->pr_vnet);
2817 if (V_ovpn_cloner != NULL) {
2818 ifc_detach_cloner(V_ovpn_cloner);
2819 V_ovpn_cloner = NULL;
2820 }
2821 CURVNET_RESTORE();
2822 }
2823 #endif
2824 return (0);
2825 }
2826
2827 static int
ovpnmodevent(module_t mod,int type,void * data)2828 ovpnmodevent(module_t mod, int type, void *data)
2829 {
2830 static int ovpn_osd_jail_slot;
2831
2832 switch (type) {
2833 case MOD_LOAD: {
2834 /*
2835 * Registration is handled in vnet_ovpn_init(), but cloned
2836 * interfaces must be destroyed via PR_METHOD_REMOVE since they
2837 * hold a reference to the prison via the UDP socket, which
2838 * prevents the prison from being destroyed.
2839 */
2840 osd_method_t methods[PR_MAXMETHOD] = {
2841 [PR_METHOD_REMOVE] = ovpn_prison_remove,
2842 };
2843 ovpn_osd_jail_slot = osd_jail_register(NULL, methods);
2844 break;
2845 }
2846 case MOD_UNLOAD:
2847 if (ovpn_osd_jail_slot != 0)
2848 osd_jail_deregister(ovpn_osd_jail_slot);
2849 CURVNET_SET(vnet0);
2850 if (V_ovpn_cloner != NULL) {
2851 ifc_detach_cloner(V_ovpn_cloner);
2852 V_ovpn_cloner = NULL;
2853 }
2854 CURVNET_RESTORE();
2855 break;
2856 default:
2857 return (EOPNOTSUPP);
2858 }
2859
2860 return (0);
2861 }
2862
2863 static moduledata_t ovpn_mod = {
2864 "if_ovpn",
2865 ovpnmodevent,
2866 0
2867 };
2868
2869 DECLARE_MODULE(if_ovpn, ovpn_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
2870 MODULE_VERSION(if_ovpn, 1);
2871 MODULE_DEPEND(if_ovpn, crypto, 1, 1, 1);
2872