1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2021-2022 Rubicon Communications, LLC (Netgate) 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 * 27 */ 28 #include "opt_inet.h" 29 #include "opt_inet6.h" 30 31 #include <sys/param.h> 32 #include <sys/systm.h> 33 #include <sys/buf_ring.h> 34 #include <sys/epoch.h> 35 #include <sys/file.h> 36 #include <sys/filedesc.h> 37 #include <sys/jail.h> 38 #include <sys/kernel.h> 39 #include <sys/malloc.h> 40 #include <sys/mbuf.h> 41 #include <sys/module.h> 42 #include <sys/nv.h> 43 #include <sys/osd.h> 44 #include <sys/priv.h> 45 #include <sys/protosw.h> 46 #include <sys/rmlock.h> 47 #include <sys/sdt.h> 48 #include <sys/smp.h> 49 #include <sys/socket.h> 50 #include <sys/socketvar.h> 51 #include <sys/sockio.h> 52 #include <sys/sysctl.h> 53 #include <sys/time.h> 54 55 #include <machine/atomic.h> 56 57 #include <net/bpf.h> 58 #include <net/if.h> 59 #include <net/if_clone.h> 60 #include <net/if_types.h> 61 #include <net/if_var.h> 62 #include <net/if_private.h> 63 #include <net/netisr.h> 64 #include <net/route/nhop.h> 65 66 #include <netinet/in.h> 67 #include <netinet/in_fib.h> 68 #include <netinet/ip.h> 69 #include <netinet/ip6.h> 70 #include <netinet/ip_var.h> 71 #include <netinet/udp.h> 72 #include <netinet/udp_var.h> 73 74 #include <netinet6/ip6_var.h> 75 #include <netinet6/in6_fib.h> 76 77 #include <machine/in_cksum.h> 78 79 #include <opencrypto/cryptodev.h> 80 81 #include "if_ovpn.h" 82 83 struct ovpn_kkey_dir { 84 uint8_t key[32]; 85 uint8_t keylen; 86 uint8_t nonce[8]; 87 uint8_t noncelen; 88 enum ovpn_key_cipher cipher; 89 crypto_session_t cryptoid; 90 91 struct mtx replay_mtx; 92 /* 93 * Last seen gapless sequence number. New rx seq numbers must be 94 * strictly higher than this. 95 */ 96 uint32_t rx_seq; 97 uint64_t tx_seq; 98 99 /* Seen packets, relative to rx_seq. bit(0) will always be 0. */ 100 uint64_t rx_window; 101 }; 102 103 struct ovpn_kkey { 104 struct ovpn_kkey_dir *encrypt; 105 struct ovpn_kkey_dir *decrypt; 106 uint8_t keyid; 107 uint32_t peerid; 108 }; 109 110 struct ovpn_keepalive { 111 uint32_t interval; 112 uint32_t timeout; 113 }; 114 115 struct ovpn_wire_header { 116 uint32_t opcode; /* opcode, key id, peer id */ 117 uint32_t seq; 118 uint8_t auth_tag[16]; 119 }; 120 121 struct ovpn_peer_counters { 122 uint64_t pkt_in; 123 uint64_t pkt_out; 124 uint64_t bytes_in; 125 uint64_t bytes_out; 126 }; 127 #define OVPN_PEER_COUNTER_SIZE (sizeof(struct ovpn_peer_counters)/sizeof(uint64_t)) 128 129 struct ovpn_notification { 130 enum ovpn_notif_type type; 131 uint32_t peerid; 132 133 /* Delete notification */ 134 enum ovpn_del_reason del_reason; 135 struct ovpn_peer_counters counters; 136 137 /* Float notification */ 138 struct sockaddr_storage address; 139 }; 140 141 struct ovpn_softc; 142 143 struct ovpn_kpeer { 144 RB_ENTRY(ovpn_kpeer) tree; 145 int refcount; 146 uint32_t peerid; 147 148 struct ovpn_softc *sc; 149 struct sockaddr_storage local; 150 struct sockaddr_storage remote; 151 152 struct in_addr vpn4; 153 struct in6_addr vpn6; 154 155 struct ovpn_kkey keys[2]; 156 157 enum ovpn_del_reason del_reason; 158 struct ovpn_keepalive keepalive; 159 uint32_t *last_active; 160 struct callout ping_send; 161 struct callout ping_rcv; 162 163 counter_u64_t counters[OVPN_PEER_COUNTER_SIZE]; 164 }; 165 166 struct ovpn_counters { 167 uint64_t lost_ctrl_pkts_in; 168 uint64_t lost_ctrl_pkts_out; 169 uint64_t lost_data_pkts_in; 170 uint64_t lost_data_pkts_out; 171 uint64_t nomem_data_pkts_in; 172 uint64_t nomem_data_pkts_out; 173 uint64_t received_ctrl_pkts; 174 uint64_t received_data_pkts; 175 uint64_t sent_ctrl_pkts; 176 uint64_t sent_data_pkts; 177 178 uint64_t transport_bytes_sent; 179 uint64_t transport_bytes_received; 180 uint64_t tunnel_bytes_sent; 181 uint64_t tunnel_bytes_received; 182 }; 183 #define OVPN_COUNTER_SIZE (sizeof(struct ovpn_counters)/sizeof(uint64_t)) 184 185 RB_HEAD(ovpn_kpeers, ovpn_kpeer); 186 187 struct ovpn_softc { 188 int refcount; 189 struct rmlock lock; 190 struct ifnet *ifp; 191 struct socket *so; 192 int peercount; 193 struct ovpn_kpeers peers; 194 195 /* Pending notification */ 196 struct buf_ring *notifring; 197 198 counter_u64_t counters[OVPN_COUNTER_SIZE]; 199 200 struct epoch_context epoch_ctx; 201 }; 202 203 struct ovpn_mtag { 204 struct sockaddr_storage addr; 205 }; 206 207 static struct ovpn_kpeer *ovpn_find_peer(struct ovpn_softc *, uint32_t); 208 static bool ovpn_udp_input(struct mbuf *, int, struct inpcb *, 209 const struct sockaddr *, void *); 210 static int ovpn_transmit_to_peer(struct ifnet *, struct mbuf *, 211 struct ovpn_kpeer *, struct rm_priotracker *); 212 static int ovpn_encap(struct ovpn_softc *, uint32_t, struct mbuf *); 213 static int ovpn_get_af(struct mbuf *); 214 static void ovpn_free_kkey_dir(struct ovpn_kkey_dir *); 215 static bool ovpn_check_replay(struct ovpn_kkey_dir *, uint32_t); 216 static int ovpn_peer_compare(const struct ovpn_kpeer *, 217 const struct ovpn_kpeer *); 218 static bool ovpn_sockaddr_compare(const struct sockaddr *, 219 const struct sockaddr *); 220 221 static RB_PROTOTYPE(ovpn_kpeers, ovpn_kpeer, tree, ovpn_peer_compare); 222 static RB_GENERATE(ovpn_kpeers, ovpn_kpeer, tree, ovpn_peer_compare); 223 224 #define OVPN_MTU_MIN 576 225 #define OVPN_MTU_MAX (IP_MAXPACKET - sizeof(struct ip) - \ 226 sizeof(struct udphdr) - sizeof(struct ovpn_wire_header)) 227 228 #define OVPN_OP_DATA_V2 0x09 229 #define OVPN_OP_SHIFT 3 230 #define OVPN_SEQ_ROTATE 0x80000000 231 232 VNET_DEFINE_STATIC(struct if_clone *, ovpn_cloner); 233 #define V_ovpn_cloner VNET(ovpn_cloner) 234 235 #define OVPN_RLOCK_TRACKER struct rm_priotracker _ovpn_lock_tracker; \ 236 struct rm_priotracker *_ovpn_lock_trackerp = &_ovpn_lock_tracker 237 #define OVPN_RLOCK(sc) rm_rlock(&(sc)->lock, _ovpn_lock_trackerp) 238 #define OVPN_RUNLOCK(sc) rm_runlock(&(sc)->lock, _ovpn_lock_trackerp) 239 #define OVPN_WLOCK(sc) rm_wlock(&(sc)->lock) 240 #define OVPN_WUNLOCK(sc) rm_wunlock(&(sc)->lock) 241 #define OVPN_ASSERT(sc) rm_assert(&(sc)->lock, RA_LOCKED) 242 #define OVPN_RASSERT(sc) rm_assert(&(sc)->lock, RA_RLOCKED) 243 #define OVPN_WASSERT(sc) rm_assert(&(sc)->lock, RA_WLOCKED) 244 #define OVPN_UNLOCK_ASSERT(sc) rm_assert(&(sc)->lock, RA_UNLOCKED) 245 246 #define OVPN_COUNTER(sc, name) \ 247 ((sc)->counters[offsetof(struct ovpn_counters, name)/sizeof(uint64_t)]) 248 #define OVPN_PEER_COUNTER(peer, name) \ 249 ((peer)->counters[offsetof(struct ovpn_peer_counters, name) / \ 250 sizeof(uint64_t)]) 251 252 #define OVPN_COUNTER_ADD(sc, name, val) \ 253 counter_u64_add(OVPN_COUNTER(sc, name), val) 254 #define OVPN_PEER_COUNTER_ADD(p, name, val) \ 255 counter_u64_add(OVPN_PEER_COUNTER(p, name), val) 256 257 #define TO_IN(x) ((struct sockaddr_in *)(x)) 258 #define TO_IN6(x) ((struct sockaddr_in6 *)(x)) 259 260 SDT_PROVIDER_DEFINE(if_ovpn); 261 SDT_PROBE_DEFINE1(if_ovpn, tx, transmit, start, "struct mbuf *"); 262 SDT_PROBE_DEFINE2(if_ovpn, tx, route, ip4, "struct in_addr *", "struct ovpn_kpeer *"); 263 SDT_PROBE_DEFINE2(if_ovpn, tx, route, ip6, "struct in6_addr *", "struct ovpn_kpeer *"); 264 265 static const char ovpnname[] = "ovpn"; 266 static const char ovpngroupname[] = "openvpn"; 267 268 static MALLOC_DEFINE(M_OVPN, ovpnname, "OpenVPN DCO Interface"); 269 #define MTAG_OVPN_LOOP 0x6f76706e /* ovpn */ 270 271 SYSCTL_DECL(_net_link); 272 static SYSCTL_NODE(_net_link, IFT_OTHER, openvpn, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 273 "OpenVPN DCO Interface"); 274 VNET_DEFINE_STATIC(int, replay_protection) = 0; 275 #define V_replay_protection VNET(replay_protection) 276 SYSCTL_INT(_net_link_openvpn, OID_AUTO, replay_protection, CTLFLAG_VNET | CTLFLAG_RW, 277 &VNET_NAME(replay_protection), 0, "Validate sequence numbers"); 278 279 VNET_DEFINE_STATIC(int, async_crypto); 280 #define V_async_crypto VNET(async_crypto) 281 SYSCTL_INT(_net_link_openvpn, OID_AUTO, async_crypto, 282 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(async_crypto), 0, 283 "Use asynchronous mode to parallelize crypto jobs."); 284 285 VNET_DEFINE_STATIC(int, async_netisr_queue); 286 #define V_async_netisr_queue VNET(async_netisr_queue) 287 SYSCTL_INT(_net_link_openvpn, OID_AUTO, netisr_queue, 288 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(async_netisr_queue), 0, 289 "Use netisr_queue() rather than netisr_dispatch()."); 290 291 static int 292 ovpn_peer_compare(const struct ovpn_kpeer *a, const struct ovpn_kpeer *b) 293 { 294 return (a->peerid - b->peerid); 295 } 296 297 static bool 298 ovpn_sockaddr_compare(const struct sockaddr *a, 299 const struct sockaddr *b) 300 { 301 if (a->sa_family != b->sa_family) 302 return (false); 303 MPASS(a->sa_len == b->sa_len); 304 305 switch (a->sa_family) { 306 case AF_INET: { 307 const struct sockaddr_in *a4, *b4; 308 309 a4 = (const struct sockaddr_in *)a; 310 b4 = (const struct sockaddr_in *)b; 311 312 if (a4->sin_port != b4->sin_port) 313 return (false); 314 315 return (a4->sin_addr.s_addr == b4->sin_addr.s_addr); 316 } 317 case AF_INET6: { 318 const struct sockaddr_in6 *a6, *b6; 319 320 a6 = (const struct sockaddr_in6 *)a; 321 b6 = (const struct sockaddr_in6 *)b; 322 323 if (a6->sin6_port != b6->sin6_port) 324 return (false); 325 if (a6->sin6_scope_id != b6->sin6_scope_id) 326 return (false); 327 328 return (memcmp(&a6->sin6_addr, &b6->sin6_addr, 329 sizeof(a6->sin6_addr)) == 0); 330 } 331 default: 332 panic("Unknown address family %d", a->sa_family); 333 } 334 } 335 336 static struct ovpn_kpeer * 337 ovpn_find_peer(struct ovpn_softc *sc, uint32_t peerid) 338 { 339 struct ovpn_kpeer p; 340 341 OVPN_ASSERT(sc); 342 343 p.peerid = peerid; 344 345 return (RB_FIND(ovpn_kpeers, &sc->peers, &p)); 346 } 347 348 static struct ovpn_kpeer * 349 ovpn_find_only_peer(struct ovpn_softc *sc) 350 { 351 OVPN_ASSERT(sc); 352 353 return (RB_ROOT(&sc->peers)); 354 } 355 356 static uint16_t 357 ovpn_get_port(const struct sockaddr_storage *s) 358 { 359 switch (s->ss_family) { 360 case AF_INET: { 361 const struct sockaddr_in *in = (const struct sockaddr_in *)s; 362 return (in->sin_port); 363 } 364 case AF_INET6: { 365 const struct sockaddr_in6 *in6 = (const struct sockaddr_in6 *)s; 366 return (in6->sin6_port); 367 } 368 default: 369 panic("Unsupported address family %d", s->ss_family); 370 } 371 } 372 373 static void 374 ovpn_set_port(struct sockaddr_storage *s, unsigned short port) 375 { 376 switch (s->ss_family) { 377 case AF_INET: { 378 struct sockaddr_in *in = (struct sockaddr_in *)s; 379 in->sin_port = port; 380 break; 381 } 382 case AF_INET6: { 383 struct sockaddr_in6 *in6 = (struct sockaddr_in6 *)s; 384 in6->sin6_port = port; 385 break; 386 } 387 default: 388 panic("Unsupported address family %d", s->ss_family); 389 } 390 } 391 392 static int 393 ovpn_nvlist_to_sockaddr(const nvlist_t *nvl, struct sockaddr_storage *sa) 394 { 395 int af; 396 397 memset(sa, 0, sizeof(*sa)); 398 399 if (! nvlist_exists_number(nvl, "af")) 400 return (EINVAL); 401 if (! nvlist_exists_binary(nvl, "address")) 402 return (EINVAL); 403 if (! nvlist_exists_number(nvl, "port")) 404 return (EINVAL); 405 406 af = nvlist_get_number(nvl, "af"); 407 switch (af) { 408 #ifdef INET 409 case AF_INET: { 410 struct sockaddr_in *in = (struct sockaddr_in *)sa; 411 size_t len; 412 const void *addr = nvlist_get_binary(nvl, "address", &len); 413 414 memset(in, 0, sizeof(*in)); 415 in->sin_family = af; 416 in->sin_len = sizeof(*in); 417 if (len != sizeof(in->sin_addr)) 418 return (EINVAL); 419 420 memcpy(&in->sin_addr, addr, sizeof(in->sin_addr)); 421 in->sin_port = nvlist_get_number(nvl, "port"); 422 break; 423 } 424 #endif 425 #ifdef INET6 426 case AF_INET6: { 427 struct sockaddr_in6 *in6 = (struct sockaddr_in6 *)sa; 428 size_t len; 429 const void *addr = nvlist_get_binary(nvl, "address", &len); 430 431 memset(in6, 0, sizeof(*in6)); 432 in6->sin6_family = af; 433 in6->sin6_len = sizeof(*in6); 434 if (len != sizeof(in6->sin6_addr)) 435 return (EINVAL); 436 437 memcpy(&in6->sin6_addr, addr, sizeof(in6->sin6_addr)); 438 in6->sin6_port = nvlist_get_number(nvl, "port"); 439 440 if (nvlist_exists_number(nvl, "scopeid")) 441 in6->sin6_scope_id = nvlist_get_number(nvl, "scopeid"); 442 443 break; 444 } 445 #endif 446 default: 447 return (EINVAL); 448 } 449 450 return (0); 451 } 452 453 static int 454 ovpn_add_sockaddr(nvlist_t *parent, const char *name, const struct sockaddr *s) 455 { 456 nvlist_t *nvl; 457 458 nvl = nvlist_create(0); 459 if (nvl == NULL) 460 return (ENOMEM); 461 462 nvlist_add_number(nvl, "af", s->sa_family); 463 464 switch (s->sa_family) { 465 case AF_INET: { 466 const struct sockaddr_in *s4 = (const struct sockaddr_in *)s; 467 468 nvlist_add_number(nvl, "port", s4->sin_port); 469 nvlist_add_binary(nvl, "address", &s4->sin_addr, 470 sizeof(s4->sin_addr)); 471 break; 472 } 473 case AF_INET6: { 474 const struct sockaddr_in6 *s6 = (const struct sockaddr_in6 *)s; 475 476 nvlist_add_number(nvl, "port", s6->sin6_port); 477 nvlist_add_binary(nvl, "address", &s6->sin6_addr, 478 sizeof(s6->sin6_addr)); 479 nvlist_add_number(nvl, "scopeid", s6->sin6_scope_id); 480 break; 481 } 482 default: 483 nvlist_destroy(nvl); 484 return (EINVAL); 485 } 486 487 nvlist_move_nvlist(parent, name, nvl); 488 489 return (0); 490 } 491 492 static void 493 ovpn_notify_del_peer(struct ovpn_softc *sc, struct ovpn_kpeer *peer) 494 { 495 struct ovpn_notification *n; 496 497 OVPN_WASSERT(sc); 498 499 n = malloc(sizeof(*n), M_OVPN, M_NOWAIT); 500 if (n == NULL) 501 return; 502 503 n->peerid = peer->peerid; 504 n->type = OVPN_NOTIF_DEL_PEER; 505 n->del_reason = peer->del_reason; 506 507 n->counters.pkt_in = counter_u64_fetch(OVPN_PEER_COUNTER(peer, pkt_in)); 508 n->counters.pkt_out = counter_u64_fetch(OVPN_PEER_COUNTER(peer, pkt_out)); 509 n->counters.bytes_in = counter_u64_fetch(OVPN_PEER_COUNTER(peer, bytes_in)); 510 n->counters.bytes_out = counter_u64_fetch(OVPN_PEER_COUNTER(peer, bytes_out)); 511 512 if (buf_ring_enqueue(sc->notifring, n) != 0) { 513 free(n, M_OVPN); 514 } else if (sc->so != NULL) { 515 /* Wake up userspace */ 516 sc->so->so_error = EAGAIN; 517 sorwakeup(sc->so); 518 sowwakeup(sc->so); 519 } 520 } 521 522 static void 523 ovpn_notify_key_rotation(struct ovpn_softc *sc, struct ovpn_kpeer *peer) 524 { 525 struct ovpn_notification *n; 526 527 n = malloc(sizeof(*n), M_OVPN, M_NOWAIT | M_ZERO); 528 if (n == NULL) 529 return; 530 531 n->peerid = peer->peerid; 532 n->type = OVPN_NOTIF_ROTATE_KEY; 533 534 if (buf_ring_enqueue(sc->notifring, n) != 0) { 535 free(n, M_OVPN); 536 } else if (sc->so != NULL) { 537 /* Wake up userspace */ 538 sc->so->so_error = EAGAIN; 539 sorwakeup(sc->so); 540 sowwakeup(sc->so); 541 } 542 } 543 544 static int 545 ovpn_notify_float(struct ovpn_softc *sc, uint32_t peerid, 546 const struct sockaddr_storage *remote) 547 { 548 struct ovpn_notification *n; 549 550 n = malloc(sizeof(*n), M_OVPN, M_NOWAIT | M_ZERO); 551 if (n == NULL) 552 return (ENOMEM); 553 554 n->peerid = peerid; 555 n->type = OVPN_NOTIF_FLOAT; 556 memcpy(&n->address, remote, sizeof(n->address)); 557 558 if (buf_ring_enqueue(sc->notifring, n) != 0) { 559 free(n, M_OVPN); 560 return (ENOMEM); 561 } else if (sc->so != NULL) { 562 /* Wake up userspace */ 563 sc->so->so_error = EAGAIN; 564 sorwakeup(sc->so); 565 sowwakeup(sc->so); 566 } 567 568 return (0); 569 } 570 571 static void 572 ovpn_peer_release_ref(struct ovpn_kpeer *peer, bool locked) 573 { 574 struct ovpn_softc *sc; 575 576 CURVNET_ASSERT_SET(); 577 578 atomic_add_int(&peer->refcount, -1); 579 580 if (atomic_load_int(&peer->refcount) > 0) 581 return; 582 583 sc = peer->sc; 584 585 if (! locked) { 586 OVPN_WLOCK(sc); 587 588 /* Might have changed before we acquired the lock. */ 589 if (atomic_load_int(&peer->refcount) > 0) { 590 OVPN_WUNLOCK(sc); 591 return; 592 } 593 } 594 595 OVPN_ASSERT(sc); 596 597 /* The peer should have been removed from the list already. */ 598 MPASS(ovpn_find_peer(sc, peer->peerid) == NULL); 599 600 ovpn_notify_del_peer(sc, peer); 601 602 for (int i = 0; i < 2; i++) { 603 ovpn_free_kkey_dir(peer->keys[i].encrypt); 604 ovpn_free_kkey_dir(peer->keys[i].decrypt); 605 } 606 607 callout_stop(&peer->ping_send); 608 callout_stop(&peer->ping_rcv); 609 uma_zfree_pcpu(pcpu_zone_4, peer->last_active); 610 free(peer, M_OVPN); 611 612 if (! locked) 613 OVPN_WUNLOCK(sc); 614 } 615 616 static int 617 ovpn_new_peer(struct ifnet *ifp, const nvlist_t *nvl) 618 { 619 #ifdef INET6 620 struct epoch_tracker et; 621 #endif 622 struct sockaddr_storage local, remote; 623 struct ovpn_kpeer *peer = NULL; 624 struct file *fp = NULL; 625 struct ovpn_softc *sc = ifp->if_softc; 626 struct thread *td = curthread; 627 struct socket *so = NULL; 628 int fd; 629 uint32_t peerid; 630 int ret = 0; 631 bool setcb = false; 632 633 if (nvl == NULL) 634 return (EINVAL); 635 636 if (! nvlist_exists_number(nvl, "peerid")) 637 return (EINVAL); 638 639 if (! nvlist_exists_number(nvl, "fd")) 640 return (EINVAL); 641 642 if (! nvlist_exists_nvlist(nvl, "remote")) 643 return (EINVAL); 644 645 peerid = nvlist_get_number(nvl, "peerid"); 646 647 ret = ovpn_nvlist_to_sockaddr(nvlist_get_nvlist(nvl, "remote"), 648 &remote); 649 if (ret != 0) 650 return (ret); 651 652 fd = nvlist_get_number(nvl, "fd"); 653 654 /* Look up the userspace process and use the fd to find the socket. */ 655 ret = getsock(td, fd, &cap_connect_rights, &fp); 656 if (ret != 0) 657 return (ret); 658 659 so = fp->f_data; 660 661 peer = malloc(sizeof(*peer), M_OVPN, M_WAITOK | M_ZERO); 662 peer->peerid = peerid; 663 peer->sc = sc; 664 peer->refcount = 1; 665 peer->last_active = uma_zalloc_pcpu(pcpu_zone_4, M_WAITOK | M_ZERO); 666 COUNTER_ARRAY_ALLOC(peer->counters, OVPN_PEER_COUNTER_SIZE, M_WAITOK); 667 668 if (nvlist_exists_binary(nvl, "vpn_ipv4")) { 669 size_t len; 670 const void *addr = nvlist_get_binary(nvl, "vpn_ipv4", &len); 671 if (len != sizeof(peer->vpn4)) { 672 ret = EINVAL; 673 goto error; 674 } 675 memcpy(&peer->vpn4, addr, len); 676 } 677 678 if (nvlist_exists_binary(nvl, "vpn_ipv6")) { 679 size_t len; 680 const void *addr = nvlist_get_binary(nvl, "vpn_ipv6", &len); 681 if (len != sizeof(peer->vpn6)) { 682 ret = EINVAL; 683 goto error; 684 } 685 memcpy(&peer->vpn6, addr, len); 686 } 687 688 callout_init_rm(&peer->ping_send, &sc->lock, CALLOUT_SHAREDLOCK); 689 callout_init_rm(&peer->ping_rcv, &sc->lock, 0); 690 691 memset(&local, 0, sizeof(local)); 692 local.ss_len = sizeof(local); 693 ret = sosockaddr(so, (struct sockaddr *)&local); 694 if (ret != 0) 695 goto error; 696 if (nvlist_exists_nvlist(nvl, "local")) { 697 struct sockaddr_storage local1; 698 699 ret = ovpn_nvlist_to_sockaddr(nvlist_get_nvlist(nvl, "local"), 700 &local1); 701 if (ret != 0) 702 goto error; 703 704 /* 705 * openvpn doesn't provide a port here when in multihome mode, 706 * just steal the one the socket is bound to. 707 */ 708 if (ovpn_get_port(&local1) == 0) 709 ovpn_set_port(&local1, ovpn_get_port(&local)); 710 memcpy(&local, &local1, sizeof(local1)); 711 } 712 if (ovpn_get_port(&local) == 0) { 713 ret = EINVAL; 714 goto error; 715 } 716 if (local.ss_family != remote.ss_family) { 717 ret = EINVAL; 718 goto error; 719 } 720 721 memcpy(&peer->local, &local, sizeof(local)); 722 memcpy(&peer->remote, &remote, sizeof(remote)); 723 724 #ifdef INET6 725 if (peer->local.ss_family == AF_INET6 && 726 IN6_IS_ADDR_V4MAPPED(&TO_IN6(&peer->remote)->sin6_addr)) { 727 /* V4 mapped address, so treat this as v4, not v6. */ 728 in6_sin6_2_sin_in_sock((struct sockaddr *)&peer->local); 729 in6_sin6_2_sin_in_sock((struct sockaddr *)&peer->remote); 730 } 731 732 if (peer->local.ss_family == AF_INET6 && 733 IN6_IS_ADDR_UNSPECIFIED(&TO_IN6(&peer->local)->sin6_addr)) { 734 NET_EPOCH_ENTER(et); 735 ret = in6_selectsrc_addr(curthread->td_proc->p_fibnum, 736 &TO_IN6(&peer->remote)->sin6_addr, 737 TO_IN6(&peer->remote)->sin6_scope_id, NULL, 738 &TO_IN6(&peer->local)->sin6_addr, NULL); 739 NET_EPOCH_EXIT(et); 740 if (ret != 0) { 741 goto error; 742 } 743 } 744 #endif 745 OVPN_WLOCK(sc); 746 747 /* Disallow peer id re-use. */ 748 if (ovpn_find_peer(sc, peerid) != NULL) { 749 ret = EEXIST; 750 goto error_locked; 751 } 752 753 /* Make sure this is really a UDP socket. */ 754 if (so->so_type != SOCK_DGRAM || so->so_proto->pr_type != SOCK_DGRAM) { 755 ret = EPROTOTYPE; 756 goto error_locked; 757 } 758 759 /* Must be the same socket as for other peers on this interface. */ 760 if (sc->so != NULL && so != sc->so) { 761 if (! RB_EMPTY(&sc->peers)) { 762 ret = EBUSY; 763 goto error_locked; 764 } 765 766 /* 767 * If we have no peers we can safely release the socket and accept 768 * a new one. 769 */ 770 ret = udp_set_kernel_tunneling(sc->so, NULL, NULL, NULL); 771 MPASS(ret == 0); 772 sorele(sc->so); 773 sc->so = NULL; 774 } 775 776 if (sc->so == NULL) { 777 sc->so = so; 778 /* 779 * Maintain one extra ref so the socket doesn't go away until 780 * we're destroying the ifp. 781 */ 782 soref(sc->so); 783 setcb = true; 784 } 785 786 /* Insert the peer into the list. */ 787 RB_INSERT(ovpn_kpeers, &sc->peers, peer); 788 sc->peercount++; 789 790 OVPN_WUNLOCK(sc); 791 792 if (setcb) { 793 ret = udp_set_kernel_tunneling(sc->so, ovpn_udp_input, NULL, sc); 794 MPASS(ret == 0); 795 } 796 797 goto done; 798 799 error_locked: 800 OVPN_WUNLOCK(sc); 801 error: 802 COUNTER_ARRAY_FREE(peer->counters, OVPN_PEER_COUNTER_SIZE); 803 uma_zfree_pcpu(pcpu_zone_4, peer->last_active); 804 free(peer, M_OVPN); 805 done: 806 if (fp != NULL) 807 fdrop(fp, td); 808 809 return (ret); 810 } 811 812 static int 813 _ovpn_del_peer(struct ovpn_softc *sc, struct ovpn_kpeer *peer) 814 { 815 struct ovpn_kpeer *tmp __diagused; 816 817 OVPN_WASSERT(sc); 818 CURVNET_ASSERT_SET(); 819 820 MPASS(RB_FIND(ovpn_kpeers, &sc->peers, peer) == peer); 821 822 tmp = RB_REMOVE(ovpn_kpeers, &sc->peers, peer); 823 MPASS(tmp != NULL); 824 825 sc->peercount--; 826 827 ovpn_peer_release_ref(peer, true); 828 829 return (0); 830 } 831 832 static int 833 ovpn_del_peer(struct ifnet *ifp, nvlist_t *nvl) 834 { 835 struct ovpn_softc *sc = ifp->if_softc; 836 struct ovpn_kpeer *peer; 837 uint32_t peerid; 838 int ret; 839 840 OVPN_WASSERT(sc); 841 842 if (nvl == NULL) 843 return (EINVAL); 844 845 if (! nvlist_exists_number(nvl, "peerid")) 846 return (EINVAL); 847 848 peerid = nvlist_get_number(nvl, "peerid"); 849 850 peer = ovpn_find_peer(sc, peerid); 851 if (peer == NULL) 852 return (ENOENT); 853 854 peer->del_reason = OVPN_DEL_REASON_REQUESTED; 855 ret = _ovpn_del_peer(sc, peer); 856 857 return (ret); 858 } 859 860 static int 861 ovpn_create_kkey_dir(struct ovpn_kkey_dir **kdirp, 862 const nvlist_t *nvl) 863 { 864 struct crypto_session_params csp; 865 struct ovpn_kkey_dir *kdir; 866 const char *ciphername; 867 enum ovpn_key_cipher cipher; 868 const void *key, *iv; 869 size_t keylen = 0, ivlen = 0; 870 int error; 871 872 if (! nvlist_exists_string(nvl, "cipher")) 873 return (EINVAL); 874 ciphername = nvlist_get_string(nvl, "cipher"); 875 876 if (strcmp(ciphername, "none") == 0) 877 cipher = OVPN_CIPHER_ALG_NONE; 878 else if (strcmp(ciphername, "AES-256-GCM") == 0 || 879 strcmp(ciphername, "AES-192-GCM") == 0 || 880 strcmp(ciphername, "AES-128-GCM") == 0) 881 cipher = OVPN_CIPHER_ALG_AES_GCM; 882 else if (strcmp(ciphername, "CHACHA20-POLY1305") == 0) 883 cipher = OVPN_CIPHER_ALG_CHACHA20_POLY1305; 884 else 885 return (EINVAL); 886 887 if (cipher != OVPN_CIPHER_ALG_NONE) { 888 if (! nvlist_exists_binary(nvl, "key")) 889 return (EINVAL); 890 key = nvlist_get_binary(nvl, "key", &keylen); 891 if (keylen > sizeof(kdir->key)) 892 return (E2BIG); 893 894 if (! nvlist_exists_binary(nvl, "iv")) 895 return (EINVAL); 896 iv = nvlist_get_binary(nvl, "iv", &ivlen); 897 if (ivlen != 8) 898 return (E2BIG); 899 } 900 901 kdir = malloc(sizeof(struct ovpn_kkey_dir), M_OVPN, 902 M_WAITOK | M_ZERO); 903 904 kdir->cipher = cipher; 905 kdir->keylen = keylen; 906 kdir->tx_seq = 1; 907 if (keylen != 0) 908 memcpy(kdir->key, key, keylen); 909 kdir->noncelen = ivlen; 910 if (ivlen != 0) 911 memcpy(kdir->nonce, iv, ivlen); 912 913 if (kdir->cipher != OVPN_CIPHER_ALG_NONE) { 914 /* Crypto init */ 915 bzero(&csp, sizeof(csp)); 916 csp.csp_mode = CSP_MODE_AEAD; 917 918 if (kdir->cipher == OVPN_CIPHER_ALG_CHACHA20_POLY1305) 919 csp.csp_cipher_alg = CRYPTO_CHACHA20_POLY1305; 920 else 921 csp.csp_cipher_alg = CRYPTO_AES_NIST_GCM_16; 922 923 csp.csp_flags |= CSP_F_SEPARATE_AAD; 924 925 csp.csp_cipher_klen = kdir->keylen; 926 csp.csp_cipher_key = kdir->key; 927 csp.csp_ivlen = 96 / 8; 928 929 error = crypto_newsession(&kdir->cryptoid, &csp, 930 CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE); 931 if (error) { 932 free(kdir, M_OVPN); 933 return (error); 934 } 935 } 936 937 mtx_init(&kdir->replay_mtx, "if_ovpn rx replay", NULL, MTX_DEF); 938 *kdirp = kdir; 939 940 return (0); 941 } 942 943 static void 944 ovpn_free_kkey_dir(struct ovpn_kkey_dir *kdir) 945 { 946 if (kdir == NULL) 947 return; 948 949 mtx_destroy(&kdir->replay_mtx); 950 951 crypto_freesession(kdir->cryptoid); 952 free(kdir, M_OVPN); 953 } 954 955 static int 956 ovpn_set_key(struct ifnet *ifp, const nvlist_t *nvl) 957 { 958 struct ovpn_softc *sc = ifp->if_softc; 959 struct ovpn_kkey_dir *enc, *dec; 960 struct ovpn_kpeer *peer; 961 int slot, keyid, peerid; 962 int error; 963 964 if (nvl == NULL) 965 return (EINVAL); 966 967 if (! nvlist_exists_number(nvl, "slot")) 968 return (EINVAL); 969 slot = nvlist_get_number(nvl, "slot"); 970 971 if (! nvlist_exists_number(nvl, "keyid")) 972 return (EINVAL); 973 keyid = nvlist_get_number(nvl, "keyid"); 974 975 if (! nvlist_exists_number(nvl, "peerid")) 976 return (EINVAL); 977 peerid = nvlist_get_number(nvl, "peerid"); 978 979 if (slot != OVPN_KEY_SLOT_PRIMARY && 980 slot != OVPN_KEY_SLOT_SECONDARY) 981 return (EINVAL); 982 983 if (! nvlist_exists_nvlist(nvl, "encrypt") || 984 ! nvlist_exists_nvlist(nvl, "decrypt")) 985 return (EINVAL); 986 987 error = ovpn_create_kkey_dir(&enc, nvlist_get_nvlist(nvl, "encrypt")); 988 if (error) 989 return (error); 990 991 error = ovpn_create_kkey_dir(&dec, nvlist_get_nvlist(nvl, "decrypt")); 992 if (error) { 993 ovpn_free_kkey_dir(enc); 994 return (error); 995 } 996 997 OVPN_WLOCK(sc); 998 999 peer = ovpn_find_peer(sc, peerid); 1000 if (peer == NULL) { 1001 ovpn_free_kkey_dir(dec); 1002 ovpn_free_kkey_dir(enc); 1003 OVPN_WUNLOCK(sc); 1004 return (ENOENT); 1005 } 1006 1007 ovpn_free_kkey_dir(peer->keys[slot].encrypt); 1008 ovpn_free_kkey_dir(peer->keys[slot].decrypt); 1009 1010 peer->keys[slot].encrypt = enc; 1011 peer->keys[slot].decrypt = dec; 1012 1013 peer->keys[slot].keyid = keyid; 1014 peer->keys[slot].peerid = peerid; 1015 1016 OVPN_WUNLOCK(sc); 1017 1018 return (0); 1019 } 1020 1021 static int 1022 ovpn_check_key(struct ovpn_softc *sc, struct ovpn_kpeer *peer, enum ovpn_key_slot slot) 1023 { 1024 OVPN_ASSERT(sc); 1025 1026 if (peer->keys[slot].encrypt == NULL) 1027 return (ENOLINK); 1028 1029 if (peer->keys[slot].decrypt == NULL) 1030 return (ENOLINK); 1031 1032 return (0); 1033 } 1034 1035 static int 1036 ovpn_start(struct ifnet *ifp) 1037 { 1038 struct ovpn_softc *sc = ifp->if_softc; 1039 1040 OVPN_WLOCK(sc); 1041 1042 ifp->if_flags |= IFF_UP; 1043 ifp->if_drv_flags |= IFF_DRV_RUNNING; 1044 if_link_state_change(ifp, LINK_STATE_UP); 1045 1046 OVPN_WUNLOCK(sc); 1047 1048 return (0); 1049 } 1050 1051 static int 1052 ovpn_swap_keys(struct ifnet *ifp, nvlist_t *nvl) 1053 { 1054 struct ovpn_softc *sc = ifp->if_softc; 1055 struct ovpn_kpeer *peer; 1056 struct ovpn_kkey tmpkey; 1057 int error; 1058 1059 if (nvl == NULL) 1060 return (EINVAL); 1061 1062 if (! nvlist_exists_number(nvl, "peerid")) 1063 return (EINVAL); 1064 1065 OVPN_WLOCK(sc); 1066 1067 peer = ovpn_find_peer(sc, nvlist_get_number(nvl, "peerid")); 1068 if (peer == NULL) { 1069 OVPN_WUNLOCK(sc); 1070 return (ENOENT); 1071 } 1072 1073 /* Check that we have a second key to swap to. */ 1074 error = ovpn_check_key(sc, peer, OVPN_KEY_SLOT_SECONDARY); 1075 if (error) { 1076 OVPN_WUNLOCK(sc); 1077 return (error); 1078 } 1079 1080 tmpkey = peer->keys[0]; 1081 peer->keys[0] = peer->keys[1]; 1082 peer->keys[1] = tmpkey; 1083 1084 OVPN_WUNLOCK(sc); 1085 1086 return (0); 1087 } 1088 1089 static int 1090 ovpn_del_key(struct ifnet *ifp, const nvlist_t *nvl) 1091 { 1092 enum ovpn_key_slot slot; 1093 struct ovpn_kpeer *peer; 1094 struct ovpn_softc *sc = ifp->if_softc; 1095 1096 if (nvl == NULL) 1097 return (EINVAL); 1098 1099 if (! nvlist_exists_number(nvl, "peerid")) 1100 return (EINVAL); 1101 1102 if (! nvlist_exists_number(nvl, "slot")) 1103 return (EINVAL); 1104 slot = nvlist_get_number(nvl, "slot"); 1105 1106 if (slot != OVPN_KEY_SLOT_PRIMARY && 1107 slot != OVPN_KEY_SLOT_SECONDARY) 1108 return (EINVAL); 1109 1110 OVPN_WLOCK(sc); 1111 1112 peer = ovpn_find_peer(sc, nvlist_get_number(nvl, "peerid")); 1113 if (peer == NULL) { 1114 OVPN_WUNLOCK(sc); 1115 return (ENOENT); 1116 } 1117 1118 ovpn_free_kkey_dir(peer->keys[slot].encrypt); 1119 ovpn_free_kkey_dir(peer->keys[slot].decrypt); 1120 1121 peer->keys[slot].encrypt = NULL; 1122 peer->keys[slot].decrypt = NULL; 1123 1124 peer->keys[slot].keyid = 0; 1125 peer->keys[slot].peerid = 0; 1126 1127 OVPN_WUNLOCK(sc); 1128 1129 return (0); 1130 } 1131 1132 static void 1133 ovpn_send_ping(void *arg) 1134 { 1135 static const uint8_t ping_str[] = { 1136 0x2a, 0x18, 0x7b, 0xf3, 0x64, 0x1e, 0xb4, 0xcb, 1137 0x07, 0xed, 0x2d, 0x0a, 0x98, 0x1f, 0xc7, 0x48 1138 }; 1139 1140 struct epoch_tracker et; 1141 struct ovpn_kpeer *peer = arg; 1142 struct ovpn_softc *sc = peer->sc; 1143 struct mbuf *m; 1144 1145 OVPN_RASSERT(sc); 1146 1147 /* Ensure we repeat! */ 1148 callout_reset(&peer->ping_send, peer->keepalive.interval * hz, 1149 ovpn_send_ping, peer); 1150 1151 m = m_get2(sizeof(ping_str), M_NOWAIT, MT_DATA, M_PKTHDR); 1152 if (m == NULL) 1153 return; 1154 1155 m_copyback(m, 0, sizeof(ping_str), ping_str); 1156 m->m_len = m->m_pkthdr.len = sizeof(ping_str); 1157 1158 CURVNET_SET(sc->ifp->if_vnet); 1159 NET_EPOCH_ENTER(et); 1160 (void)ovpn_transmit_to_peer(sc->ifp, m, peer, NULL); 1161 NET_EPOCH_EXIT(et); 1162 CURVNET_RESTORE(); 1163 } 1164 1165 static void 1166 ovpn_timeout(void *arg) 1167 { 1168 struct ovpn_kpeer *peer = arg; 1169 struct ovpn_softc *sc = peer->sc; 1170 uint32_t last, _last_active; 1171 int ret __diagused; 1172 int cpu; 1173 1174 OVPN_WASSERT(sc); 1175 1176 last = 0; 1177 CPU_FOREACH(cpu) { 1178 _last_active = *zpcpu_get_cpu(peer->last_active, cpu); 1179 if (_last_active > last) 1180 last = _last_active; 1181 } 1182 1183 if (last + peer->keepalive.timeout > time_uptime) { 1184 callout_reset(&peer->ping_rcv, 1185 (peer->keepalive.timeout - (time_uptime - last)) * hz, 1186 ovpn_timeout, peer); 1187 return; 1188 } 1189 1190 CURVNET_SET(sc->ifp->if_vnet); 1191 peer->del_reason = OVPN_DEL_REASON_TIMEOUT; 1192 ret = _ovpn_del_peer(sc, peer); 1193 MPASS(ret == 0); 1194 CURVNET_RESTORE(); 1195 } 1196 1197 static int 1198 ovpn_set_peer(struct ifnet *ifp, const nvlist_t *nvl) 1199 { 1200 struct ovpn_softc *sc = ifp->if_softc; 1201 struct ovpn_kpeer *peer; 1202 1203 if (nvl == NULL) 1204 return (EINVAL); 1205 1206 if (! nvlist_exists_number(nvl, "interval") || 1207 ! nvlist_exists_number(nvl, "timeout") || 1208 ! nvlist_exists_number(nvl, "peerid")) 1209 return (EINVAL); 1210 1211 OVPN_WLOCK(sc); 1212 1213 peer = ovpn_find_peer(sc, nvlist_get_number(nvl, "peerid")); 1214 if (peer == NULL) { 1215 OVPN_WUNLOCK(sc); 1216 return (ENOENT); 1217 } 1218 1219 peer->keepalive.interval = nvlist_get_number(nvl, "interval"); 1220 peer->keepalive.timeout = nvlist_get_number(nvl, "timeout"); 1221 1222 if (peer->keepalive.interval > 0) 1223 callout_reset(&peer->ping_send, peer->keepalive.interval * hz, 1224 ovpn_send_ping, peer); 1225 if (peer->keepalive.timeout > 0) 1226 callout_reset(&peer->ping_rcv, peer->keepalive.timeout * hz, 1227 ovpn_timeout, peer); 1228 1229 OVPN_WUNLOCK(sc); 1230 1231 return (0); 1232 } 1233 1234 static int 1235 ovpn_set_ifmode(struct ifnet *ifp, const nvlist_t *nvl) 1236 { 1237 struct ovpn_softc *sc = ifp->if_softc; 1238 int ifmode; 1239 1240 if (nvl == NULL) 1241 return (EINVAL); 1242 1243 if (! nvlist_exists_number(nvl, "ifmode") ) 1244 return (EINVAL); 1245 1246 ifmode = nvlist_get_number(nvl, "ifmode"); 1247 1248 OVPN_WLOCK(sc); 1249 1250 /* deny this if UP */ 1251 if (ifp->if_flags & IFF_UP) { 1252 OVPN_WUNLOCK(sc); 1253 return (EBUSY); 1254 } 1255 1256 switch (ifmode & ~IFF_MULTICAST) { 1257 case IFF_POINTOPOINT: 1258 case IFF_BROADCAST: 1259 ifp->if_flags &= 1260 ~(IFF_BROADCAST|IFF_POINTOPOINT|IFF_MULTICAST); 1261 ifp->if_flags |= ifmode; 1262 break; 1263 default: 1264 OVPN_WUNLOCK(sc); 1265 return (EINVAL); 1266 } 1267 1268 OVPN_WUNLOCK(sc); 1269 1270 return (0); 1271 } 1272 1273 static int 1274 ovpn_ioctl_set(struct ifnet *ifp, struct ifdrv *ifd) 1275 { 1276 struct ovpn_softc *sc = ifp->if_softc; 1277 uint8_t *buf = NULL; 1278 nvlist_t *nvl = NULL; 1279 int ret; 1280 1281 if (ifd->ifd_len != 0) { 1282 if (ifd->ifd_len > OVPN_MAX_REQUEST_SIZE) 1283 return (E2BIG); 1284 1285 buf = malloc(ifd->ifd_len, M_OVPN, M_WAITOK); 1286 1287 ret = copyin(ifd->ifd_data, buf, ifd->ifd_len); 1288 if (ret != 0) { 1289 free(buf, M_OVPN); 1290 return (ret); 1291 } 1292 1293 nvl = nvlist_unpack(buf, ifd->ifd_len, 0); 1294 free(buf, M_OVPN); 1295 if (nvl == NULL) { 1296 return (EINVAL); 1297 } 1298 } 1299 1300 switch (ifd->ifd_cmd) { 1301 case OVPN_NEW_PEER: 1302 ret = ovpn_new_peer(ifp, nvl); 1303 break; 1304 case OVPN_DEL_PEER: 1305 OVPN_WLOCK(sc); 1306 ret = ovpn_del_peer(ifp, nvl); 1307 OVPN_WUNLOCK(sc); 1308 break; 1309 case OVPN_NEW_KEY: 1310 ret = ovpn_set_key(ifp, nvl); 1311 break; 1312 case OVPN_START_VPN: 1313 ret = ovpn_start(ifp); 1314 break; 1315 case OVPN_SWAP_KEYS: 1316 ret = ovpn_swap_keys(ifp, nvl); 1317 break; 1318 case OVPN_DEL_KEY: 1319 ret = ovpn_del_key(ifp, nvl); 1320 break; 1321 case OVPN_SET_PEER: 1322 ret = ovpn_set_peer(ifp, nvl); 1323 break; 1324 case OVPN_SET_IFMODE: 1325 ret = ovpn_set_ifmode(ifp, nvl); 1326 break; 1327 default: 1328 ret = ENOTSUP; 1329 } 1330 1331 nvlist_destroy(nvl); 1332 return (ret); 1333 } 1334 1335 static int 1336 ovpn_add_counters(nvlist_t *parent, const char *name, counter_u64_t in, 1337 counter_u64_t out) 1338 { 1339 nvlist_t *nvl; 1340 1341 nvl = nvlist_create(0); 1342 if (nvl == NULL) 1343 return (ENOMEM); 1344 1345 nvlist_add_number(nvl, "in", counter_u64_fetch(in)); 1346 nvlist_add_number(nvl, "out", counter_u64_fetch(out)); 1347 1348 nvlist_add_nvlist(parent, name, nvl); 1349 1350 nvlist_destroy(nvl); 1351 1352 return (0); 1353 } 1354 1355 static int 1356 ovpn_get_stats(struct ovpn_softc *sc, nvlist_t **onvl) 1357 { 1358 nvlist_t *nvl; 1359 int ret; 1360 1361 nvl = nvlist_create(0); 1362 if (nvl == NULL) 1363 return (ENOMEM); 1364 1365 #define OVPN_COUNTER_OUT(name, in, out) \ 1366 do { \ 1367 ret = ovpn_add_counters(nvl, name, OVPN_COUNTER(sc, in), \ 1368 OVPN_COUNTER(sc, out)); \ 1369 if (ret != 0) \ 1370 goto error; \ 1371 } while(0) 1372 1373 OVPN_COUNTER_OUT("lost_ctrl", lost_ctrl_pkts_in, lost_ctrl_pkts_out); 1374 OVPN_COUNTER_OUT("lost_data", lost_data_pkts_in, lost_data_pkts_out); 1375 OVPN_COUNTER_OUT("nomem_data", nomem_data_pkts_in, 1376 nomem_data_pkts_out); 1377 OVPN_COUNTER_OUT("data", received_data_pkts, sent_data_pkts); 1378 OVPN_COUNTER_OUT("ctrl", received_ctrl_pkts, sent_ctrl_pkts); 1379 OVPN_COUNTER_OUT("tunnel", tunnel_bytes_received, 1380 tunnel_bytes_received); 1381 OVPN_COUNTER_OUT("transport", transport_bytes_received, 1382 transport_bytes_received); 1383 #undef OVPN_COUNTER_OUT 1384 1385 *onvl = nvl; 1386 1387 return (0); 1388 1389 error: 1390 nvlist_destroy(nvl); 1391 return (ret); 1392 } 1393 1394 static int 1395 ovpn_get_peer_stats(struct ovpn_softc *sc, nvlist_t **nvl) 1396 { 1397 struct ovpn_kpeer *peer; 1398 nvlist_t *nvpeer = NULL; 1399 int ret; 1400 1401 OVPN_RLOCK_TRACKER; 1402 1403 *nvl = nvlist_create(0); 1404 if (*nvl == NULL) 1405 return (ENOMEM); 1406 1407 #define OVPN_PEER_COUNTER_OUT(name, in, out) \ 1408 do { \ 1409 ret = ovpn_add_counters(nvpeer, name, \ 1410 OVPN_PEER_COUNTER(peer, in), OVPN_PEER_COUNTER(peer, out)); \ 1411 if (ret != 0) \ 1412 goto error; \ 1413 } while(0) 1414 1415 OVPN_RLOCK(sc); 1416 RB_FOREACH(peer, ovpn_kpeers, &sc->peers) { 1417 nvpeer = nvlist_create(0); 1418 if (nvpeer == NULL) { 1419 OVPN_RUNLOCK(sc); 1420 nvlist_destroy(*nvl); 1421 *nvl = NULL; 1422 return (ENOMEM); 1423 } 1424 1425 nvlist_add_number(nvpeer, "peerid", peer->peerid); 1426 1427 OVPN_PEER_COUNTER_OUT("packets", pkt_in, pkt_out); 1428 OVPN_PEER_COUNTER_OUT("bytes", bytes_in, bytes_out); 1429 1430 nvlist_append_nvlist_array(*nvl, "peers", nvpeer); 1431 nvlist_destroy(nvpeer); 1432 } 1433 #undef OVPN_PEER_COUNTER_OUT 1434 OVPN_RUNLOCK(sc); 1435 1436 return (0); 1437 1438 error: 1439 nvlist_destroy(nvpeer); 1440 nvlist_destroy(*nvl); 1441 *nvl = NULL; 1442 return (ret); 1443 } 1444 1445 static int 1446 ovpn_poll_pkt(struct ovpn_softc *sc, nvlist_t **onvl) 1447 { 1448 nvlist_t *nvl; 1449 1450 nvl = nvlist_create(0); 1451 if (nvl == NULL) 1452 return (ENOMEM); 1453 1454 nvlist_add_number(nvl, "pending", buf_ring_count(sc->notifring)); 1455 1456 *onvl = nvl; 1457 1458 return (0); 1459 } 1460 1461 static void 1462 ovpn_notif_add_counters(nvlist_t *parent, struct ovpn_notification *n) 1463 { 1464 nvlist_t *nvl; 1465 1466 nvl = nvlist_create(0); 1467 if (nvl == NULL) 1468 return; 1469 1470 nvlist_add_number(nvl, "in", n->counters.pkt_in); 1471 nvlist_add_number(nvl, "out", n->counters.pkt_out); 1472 1473 nvlist_add_nvlist(parent, "packets", nvl); 1474 nvlist_destroy(nvl); 1475 1476 nvl = nvlist_create(0); 1477 if (nvl == NULL) 1478 return; 1479 1480 nvlist_add_number(nvl, "in", n->counters.bytes_in); 1481 nvlist_add_number(nvl, "out", n->counters.bytes_out); 1482 1483 nvlist_add_nvlist(parent, "bytes", nvl); 1484 nvlist_destroy(nvl); 1485 } 1486 1487 static int 1488 opvn_get_pkt(struct ovpn_softc *sc, nvlist_t **onvl) 1489 { 1490 struct ovpn_notification *n; 1491 nvlist_t *nvl; 1492 1493 /* Check if we have notifications pending. */ 1494 n = buf_ring_dequeue_mc(sc->notifring); 1495 if (n == NULL) 1496 return (ENOENT); 1497 1498 nvl = nvlist_create(0); 1499 if (nvl == NULL) { 1500 free(n, M_OVPN); 1501 return (ENOMEM); 1502 } 1503 nvlist_add_number(nvl, "peerid", n->peerid); 1504 nvlist_add_number(nvl, "notification", n->type); 1505 switch (n->type) { 1506 case OVPN_NOTIF_DEL_PEER: { 1507 nvlist_add_number(nvl, "del_reason", n->del_reason); 1508 1509 /* No error handling, because we want to send the notification 1510 * even if we can't attach the counters. */ 1511 ovpn_notif_add_counters(nvl, n); 1512 break; 1513 } 1514 case OVPN_NOTIF_FLOAT: { 1515 int ret; 1516 1517 ret = ovpn_add_sockaddr(nvl, "address", 1518 (struct sockaddr *)&n->address); 1519 1520 if (ret) { 1521 /* 1522 * Try to re-enqueue the notification. Maybe we'll 1523 * have better luck next time. No error handling, 1524 * because if we fail to re-enqueue there's nothing we can do. 1525 */ 1526 (void)ovpn_notify_float(sc, n->peerid, &n->address); 1527 nvlist_destroy(nvl); 1528 free(n, M_OVPN); 1529 return (ret); 1530 } 1531 break; 1532 } 1533 default: 1534 break; 1535 } 1536 free(n, M_OVPN); 1537 1538 *onvl = nvl; 1539 1540 return (0); 1541 } 1542 1543 static int 1544 ovpn_ioctl_get(struct ifnet *ifp, struct ifdrv *ifd) 1545 { 1546 struct ovpn_softc *sc = ifp->if_softc; 1547 nvlist_t *nvl = NULL; 1548 int error; 1549 1550 switch (ifd->ifd_cmd) { 1551 case OVPN_GET_STATS: 1552 error = ovpn_get_stats(sc, &nvl); 1553 break; 1554 case OVPN_GET_PEER_STATS: 1555 error = ovpn_get_peer_stats(sc, &nvl); 1556 break; 1557 case OVPN_POLL_PKT: 1558 error = ovpn_poll_pkt(sc, &nvl); 1559 break; 1560 case OVPN_GET_PKT: 1561 error = opvn_get_pkt(sc, &nvl); 1562 break; 1563 default: 1564 error = ENOTSUP; 1565 break; 1566 } 1567 1568 if (error == 0) { 1569 void *packed = NULL; 1570 size_t len; 1571 1572 MPASS(nvl != NULL); 1573 1574 packed = nvlist_pack(nvl, &len); 1575 if (! packed) { 1576 nvlist_destroy(nvl); 1577 return (ENOMEM); 1578 } 1579 1580 if (len > ifd->ifd_len) { 1581 free(packed, M_NVLIST); 1582 nvlist_destroy(nvl); 1583 return (ENOSPC); 1584 } 1585 1586 error = copyout(packed, ifd->ifd_data, len); 1587 ifd->ifd_len = len; 1588 1589 free(packed, M_NVLIST); 1590 nvlist_destroy(nvl); 1591 } 1592 1593 return (error); 1594 } 1595 1596 static int 1597 ovpn_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data) 1598 { 1599 struct ifdrv *ifd; 1600 int error; 1601 1602 CURVNET_ASSERT_SET(); 1603 1604 switch (cmd) { 1605 case SIOCSDRVSPEC: 1606 case SIOCGDRVSPEC: 1607 error = priv_check(curthread, PRIV_NET_OVPN); 1608 if (error) 1609 return (error); 1610 break; 1611 } 1612 1613 switch (cmd) { 1614 case SIOCSDRVSPEC: 1615 ifd = (struct ifdrv *)data; 1616 error = ovpn_ioctl_set(ifp, ifd); 1617 break; 1618 case SIOCGDRVSPEC: 1619 ifd = (struct ifdrv *)data; 1620 error = ovpn_ioctl_get(ifp, ifd); 1621 break; 1622 case SIOCSIFMTU: { 1623 struct ifreq *ifr = (struct ifreq *)data; 1624 if (ifr->ifr_mtu < OVPN_MTU_MIN || ifr->ifr_mtu > OVPN_MTU_MAX) 1625 return (EINVAL); 1626 1627 ifp->if_mtu = ifr->ifr_mtu; 1628 return (0); 1629 } 1630 case SIOCSIFADDR: 1631 case SIOCADDMULTI: 1632 case SIOCDELMULTI: 1633 case SIOCGIFMTU: 1634 case SIOCSIFFLAGS: 1635 return (0); 1636 default: 1637 error = EINVAL; 1638 } 1639 1640 return (error); 1641 } 1642 1643 static int 1644 ovpn_encrypt_tx_cb(struct cryptop *crp) 1645 { 1646 struct epoch_tracker et; 1647 struct ovpn_kpeer *peer = crp->crp_opaque; 1648 struct ovpn_softc *sc = peer->sc; 1649 struct mbuf *m = crp->crp_buf.cb_mbuf; 1650 int tunnel_len; 1651 int ret; 1652 1653 CURVNET_SET(sc->ifp->if_vnet); 1654 NET_EPOCH_ENTER(et); 1655 1656 if (crp->crp_etype != 0) { 1657 crypto_freereq(crp); 1658 ovpn_peer_release_ref(peer, false); 1659 NET_EPOCH_EXIT(et); 1660 CURVNET_RESTORE(); 1661 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1); 1662 m_freem(m); 1663 return (0); 1664 } 1665 1666 MPASS(crp->crp_buf.cb_type == CRYPTO_BUF_MBUF); 1667 1668 tunnel_len = m->m_pkthdr.len - sizeof(struct ovpn_wire_header); 1669 ret = ovpn_encap(sc, peer->peerid, m); 1670 if (ret == 0) { 1671 OVPN_COUNTER_ADD(sc, sent_data_pkts, 1); 1672 OVPN_COUNTER_ADD(sc, tunnel_bytes_sent, tunnel_len); 1673 } 1674 1675 crypto_freereq(crp); 1676 ovpn_peer_release_ref(peer, false); 1677 1678 NET_EPOCH_EXIT(et); 1679 CURVNET_RESTORE(); 1680 1681 return (0); 1682 } 1683 1684 static void 1685 ovpn_finish_rx(struct ovpn_softc *sc, struct mbuf *m, 1686 struct ovpn_kpeer *peer, struct ovpn_kkey *key, uint32_t seq, 1687 struct rm_priotracker *_ovpn_lock_trackerp) 1688 { 1689 uint32_t af; 1690 struct m_tag *mtag; 1691 1692 OVPN_RASSERT(sc); 1693 NET_EPOCH_ASSERT(); 1694 1695 /* Replay protection. */ 1696 if (V_replay_protection && ! ovpn_check_replay(key->decrypt, seq)) { 1697 OVPN_RUNLOCK(sc); 1698 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1); 1699 m_freem(m); 1700 return; 1701 } 1702 1703 critical_enter(); 1704 *zpcpu_get(peer->last_active) = time_uptime; 1705 critical_exit(); 1706 1707 OVPN_RUNLOCK(sc); 1708 1709 /* Check if the peer changed to a new source address. */ 1710 mtag = m_tag_find(m, PACKET_TAG_OVPN, NULL); 1711 if (mtag != NULL) { 1712 struct ovpn_mtag *ot = (struct ovpn_mtag *)(mtag + 1); 1713 1714 OVPN_WLOCK(sc); 1715 1716 /* 1717 * Check the address against the peer's remote again, because we may race 1718 * against ourselves (i.e. we may have tagged multiple packets to indicate we 1719 * floated). 1720 */ 1721 if (ovpn_sockaddr_compare((struct sockaddr *)&ot->addr, 1722 (struct sockaddr *)&peer->remote)) { 1723 OVPN_WUNLOCK(sc); 1724 goto skip_float; 1725 } 1726 1727 /* And notify userspace. */ 1728 if (ovpn_notify_float(sc, peer->peerid, &ot->addr) == 0) { 1729 /* 1730 * Update the 'remote' for this peer, but only if 1731 * we've actually enqueued the notification. 1732 * Otherwise we can try again later. 1733 */ 1734 memcpy(&peer->remote, &ot->addr, sizeof(peer->remote)); 1735 } 1736 1737 OVPN_WUNLOCK(sc); 1738 } 1739 1740 skip_float: 1741 OVPN_COUNTER_ADD(sc, received_data_pkts, 1); 1742 OVPN_COUNTER_ADD(sc, tunnel_bytes_received, m->m_pkthdr.len); 1743 OVPN_PEER_COUNTER_ADD(peer, pkt_in, 1); 1744 OVPN_PEER_COUNTER_ADD(peer, bytes_in, m->m_pkthdr.len); 1745 1746 /* Receive the packet on our interface. */ 1747 m->m_pkthdr.rcvif = sc->ifp; 1748 1749 /* Clear checksum flags in case the real hardware set them. */ 1750 m->m_pkthdr.csum_flags = 0; 1751 1752 /* Clear mbuf tags & flags */ 1753 m_tag_delete_nonpersistent(m); 1754 m_clrprotoflags(m); 1755 1756 /* Ensure we can read the first byte. */ 1757 m = m_pullup(m, 1); 1758 if (m == NULL) { 1759 OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1); 1760 return; 1761 } 1762 1763 /* 1764 * Check for address family, and disregard any control packets (e.g. 1765 * keepalive). 1766 */ 1767 af = ovpn_get_af(m); 1768 if (af != 0) { 1769 BPF_MTAP2(sc->ifp, &af, sizeof(af), m); 1770 if (V_async_netisr_queue) 1771 netisr_queue(af == AF_INET ? NETISR_IP : NETISR_IPV6, m); 1772 else 1773 netisr_dispatch(af == AF_INET ? NETISR_IP : NETISR_IPV6, m); 1774 } else { 1775 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1); 1776 m_freem(m); 1777 } 1778 } 1779 1780 static struct ovpn_kkey * 1781 ovpn_find_key(struct ovpn_softc *sc, struct ovpn_kpeer *peer, 1782 const struct ovpn_wire_header *ohdr) 1783 { 1784 struct ovpn_kkey *key = NULL; 1785 uint8_t keyid; 1786 1787 OVPN_RASSERT(sc); 1788 1789 keyid = (ntohl(ohdr->opcode) >> 24) & 0x07; 1790 1791 if (peer->keys[0].keyid == keyid) 1792 key = &peer->keys[0]; 1793 else if (peer->keys[1].keyid == keyid) 1794 key = &peer->keys[1]; 1795 1796 return (key); 1797 } 1798 1799 static int 1800 ovpn_decrypt_rx_cb(struct cryptop *crp) 1801 { 1802 struct epoch_tracker et; 1803 struct ovpn_softc *sc = crp->crp_opaque; 1804 struct mbuf *m = crp->crp_buf.cb_mbuf; 1805 struct ovpn_kkey *key; 1806 struct ovpn_kpeer *peer; 1807 struct ovpn_wire_header *ohdr; 1808 uint32_t peerid; 1809 1810 OVPN_RLOCK_TRACKER; 1811 1812 OVPN_RLOCK(sc); 1813 1814 MPASS(crp->crp_buf.cb_type == CRYPTO_BUF_MBUF); 1815 1816 if (crp->crp_etype != 0) { 1817 crypto_freereq(crp); 1818 atomic_add_int(&sc->refcount, -1); 1819 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1); 1820 OVPN_RUNLOCK(sc); 1821 m_freem(m); 1822 return (0); 1823 } 1824 1825 CURVNET_SET(sc->ifp->if_vnet); 1826 1827 ohdr = mtodo(m, sizeof(struct udphdr)); 1828 1829 peerid = ntohl(ohdr->opcode) & 0x00ffffff; 1830 peer = ovpn_find_peer(sc, peerid); 1831 if (peer == NULL) { 1832 /* No such peer. Drop packet. */ 1833 crypto_freereq(crp); 1834 atomic_add_int(&sc->refcount, -1); 1835 OVPN_RUNLOCK(sc); 1836 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1); 1837 m_freem(m); 1838 CURVNET_RESTORE(); 1839 return (0); 1840 } 1841 1842 key = ovpn_find_key(sc, peer, ohdr); 1843 if (key == NULL) { 1844 crypto_freereq(crp); 1845 atomic_add_int(&sc->refcount, -1); 1846 /* 1847 * Has this key been removed between us starting the decrypt 1848 * and finishing it? 1849 */ 1850 OVPN_RUNLOCK(sc); 1851 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1); 1852 m_freem(m); 1853 CURVNET_RESTORE(); 1854 return (0); 1855 } 1856 1857 /* Now remove the outer headers */ 1858 m_adj_decap(m, sizeof(struct udphdr) + 1859 sizeof(struct ovpn_wire_header)); 1860 1861 NET_EPOCH_ENTER(et); 1862 ovpn_finish_rx(sc, m, peer, key, ntohl(ohdr->seq), _ovpn_lock_trackerp); 1863 NET_EPOCH_EXIT(et); 1864 OVPN_UNLOCK_ASSERT(sc); 1865 1866 CURVNET_RESTORE(); 1867 1868 crypto_freereq(crp); 1869 atomic_add_int(&sc->refcount, -1); 1870 1871 return (0); 1872 } 1873 1874 static int 1875 ovpn_get_af(struct mbuf *m) 1876 { 1877 struct ip *ip; 1878 struct ip6_hdr *ip6; 1879 1880 /* 1881 * We should pullup, but we're only interested in the first byte, so 1882 * that'll always be contiguous. 1883 */ 1884 ip = mtod(m, struct ip *); 1885 if (ip->ip_v == IPVERSION) 1886 return (AF_INET); 1887 1888 ip6 = mtod(m, struct ip6_hdr *); 1889 if ((ip6->ip6_vfc & IPV6_VERSION_MASK) == IPV6_VERSION) 1890 return (AF_INET6); 1891 1892 return (0); 1893 } 1894 1895 #ifdef INET 1896 static struct ovpn_kpeer * 1897 ovpn_find_peer_by_ip(struct ovpn_softc *sc, const struct in_addr addr) 1898 { 1899 struct ovpn_kpeer *peer = NULL; 1900 1901 OVPN_ASSERT(sc); 1902 1903 /* TODO: Add a second RB so we can look up by IP. */ 1904 RB_FOREACH(peer, ovpn_kpeers, &sc->peers) { 1905 if (addr.s_addr == peer->vpn4.s_addr) 1906 return (peer); 1907 } 1908 1909 return (peer); 1910 } 1911 #endif 1912 1913 #ifdef INET6 1914 static struct ovpn_kpeer * 1915 ovpn_find_peer_by_ip6(struct ovpn_softc *sc, const struct in6_addr *addr) 1916 { 1917 struct ovpn_kpeer *peer = NULL; 1918 1919 OVPN_ASSERT(sc); 1920 1921 /* TODO: Add a third RB so we can look up by IPv6 address. */ 1922 RB_FOREACH(peer, ovpn_kpeers, &sc->peers) { 1923 if (memcmp(addr, &peer->vpn6, sizeof(*addr)) == 0) 1924 return (peer); 1925 } 1926 1927 return (peer); 1928 } 1929 #endif 1930 1931 static struct ovpn_kpeer * 1932 ovpn_route_peer(struct ovpn_softc *sc, struct mbuf **m0, 1933 const struct sockaddr *dst) 1934 { 1935 struct ovpn_kpeer *peer = NULL; 1936 int af; 1937 1938 NET_EPOCH_ASSERT(); 1939 OVPN_ASSERT(sc); 1940 1941 /* Shortcut if we're a client (or are a server and have only one client). */ 1942 if (sc->peercount == 1) 1943 return (ovpn_find_only_peer(sc)); 1944 1945 if (dst != NULL) 1946 af = dst->sa_family; 1947 else 1948 af = ovpn_get_af(*m0); 1949 1950 switch (af) { 1951 #ifdef INET 1952 case AF_INET: { 1953 const struct sockaddr_in *sa = (const struct sockaddr_in *)dst; 1954 struct nhop_object *nh; 1955 const struct in_addr *ip_dst; 1956 1957 if (sa != NULL) { 1958 ip_dst = &sa->sin_addr; 1959 } else { 1960 struct ip *ip; 1961 1962 *m0 = m_pullup(*m0, sizeof(struct ip)); 1963 if (*m0 == NULL) 1964 return (NULL); 1965 ip = mtod(*m0, struct ip *); 1966 ip_dst = &ip->ip_dst; 1967 } 1968 1969 peer = ovpn_find_peer_by_ip(sc, *ip_dst); 1970 SDT_PROBE2(if_ovpn, tx, route, ip4, ip_dst, peer); 1971 if (peer == NULL) { 1972 nh = fib4_lookup(M_GETFIB(*m0), *ip_dst, 0, 1973 NHR_NONE, 0); 1974 if (nh && (nh->nh_flags & NHF_GATEWAY)) { 1975 peer = ovpn_find_peer_by_ip(sc, 1976 nh->gw4_sa.sin_addr); 1977 SDT_PROBE2(if_ovpn, tx, route, ip4, 1978 &nh->gw4_sa.sin_addr, peer); 1979 } 1980 } 1981 break; 1982 } 1983 #endif 1984 #ifdef INET6 1985 case AF_INET6: { 1986 const struct sockaddr_in6 *sa6 = 1987 (const struct sockaddr_in6 *)dst; 1988 struct nhop_object *nh; 1989 const struct in6_addr *ip6_dst; 1990 1991 if (sa6 != NULL) { 1992 ip6_dst = &sa6->sin6_addr; 1993 } else { 1994 struct ip6_hdr *ip6; 1995 1996 *m0 = m_pullup(*m0, sizeof(struct ip6_hdr)); 1997 if (*m0 == NULL) 1998 return (NULL); 1999 ip6 = mtod(*m0, struct ip6_hdr *); 2000 ip6_dst = &ip6->ip6_dst; 2001 } 2002 2003 peer = ovpn_find_peer_by_ip6(sc, ip6_dst); 2004 SDT_PROBE2(if_ovpn, tx, route, ip6, ip6_dst, peer); 2005 if (peer == NULL) { 2006 nh = fib6_lookup(M_GETFIB(*m0), ip6_dst, 0, 2007 NHR_NONE, 0); 2008 if (nh && (nh->nh_flags & NHF_GATEWAY)) { 2009 peer = ovpn_find_peer_by_ip6(sc, 2010 &nh->gw6_sa.sin6_addr); 2011 SDT_PROBE2(if_ovpn, tx, route, ip6, 2012 &nh->gw6_sa.sin6_addr, peer); 2013 } 2014 } 2015 break; 2016 } 2017 #endif 2018 } 2019 2020 return (peer); 2021 } 2022 2023 static int 2024 ovpn_transmit(struct ifnet *ifp, struct mbuf *m) 2025 { 2026 return (ifp->if_output(ifp, m, NULL, NULL)); 2027 } 2028 2029 static int 2030 ovpn_transmit_to_peer(struct ifnet *ifp, struct mbuf *m, 2031 struct ovpn_kpeer *peer, struct rm_priotracker *_ovpn_lock_trackerp) 2032 { 2033 struct ovpn_wire_header *ohdr; 2034 struct ovpn_kkey *key; 2035 struct ovpn_softc *sc; 2036 struct cryptop *crp; 2037 uint32_t af, seq; 2038 uint64_t seq64; 2039 size_t len, ovpn_hdr_len; 2040 int tunnel_len; 2041 int ret; 2042 2043 sc = ifp->if_softc; 2044 2045 OVPN_RASSERT(sc); 2046 2047 tunnel_len = m->m_pkthdr.len; 2048 2049 key = &peer->keys[OVPN_KEY_SLOT_PRIMARY]; 2050 if (key->encrypt == NULL) { 2051 if (_ovpn_lock_trackerp != NULL) 2052 OVPN_RUNLOCK(sc); 2053 m_freem(m); 2054 return (ENOLINK); 2055 } 2056 2057 af = ovpn_get_af(m); 2058 /* Don't capture control packets. */ 2059 if (af != 0) 2060 BPF_MTAP2(ifp, &af, sizeof(af), m); 2061 2062 if (__predict_false(if_tunnel_check_nesting(ifp, m, MTAG_OVPN_LOOP, 3))) { 2063 if (_ovpn_lock_trackerp != NULL) 2064 OVPN_RUNLOCK(sc); 2065 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1); 2066 m_freem(m); 2067 return (ELOOP); 2068 } 2069 2070 len = m->m_pkthdr.len; 2071 MPASS(len <= ifp->if_mtu); 2072 2073 ovpn_hdr_len = sizeof(struct ovpn_wire_header); 2074 if (key->encrypt->cipher == OVPN_CIPHER_ALG_NONE) 2075 ovpn_hdr_len -= 16; /* No auth tag. */ 2076 2077 M_PREPEND(m, ovpn_hdr_len, M_NOWAIT); 2078 if (m == NULL) { 2079 if (_ovpn_lock_trackerp != NULL) 2080 OVPN_RUNLOCK(sc); 2081 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1); 2082 return (ENOBUFS); 2083 } 2084 ohdr = mtod(m, struct ovpn_wire_header *); 2085 ohdr->opcode = (OVPN_OP_DATA_V2 << OVPN_OP_SHIFT) | key->keyid; 2086 ohdr->opcode <<= 24; 2087 ohdr->opcode |= key->peerid; 2088 ohdr->opcode = htonl(ohdr->opcode); 2089 2090 seq64 = atomic_fetchadd_64(&peer->keys[OVPN_KEY_SLOT_PRIMARY].encrypt->tx_seq, 1); 2091 if (seq64 == OVPN_SEQ_ROTATE) { 2092 ovpn_notify_key_rotation(sc, peer); 2093 } else if (seq64 > UINT32_MAX) { 2094 /* We've wrapped, give up on this packet. */ 2095 if (_ovpn_lock_trackerp != NULL) 2096 OVPN_RUNLOCK(sc); 2097 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1); 2098 2099 /* Let's avoid (very unlikely, but still) wraparounds of the 2100 * 64-bit counter taking us back to 0. */ 2101 atomic_store_64(&peer->keys[OVPN_KEY_SLOT_PRIMARY].encrypt->tx_seq, 2102 UINT32_MAX); 2103 2104 return (ENOBUFS); 2105 } 2106 2107 seq = htonl(seq64 & UINT32_MAX); 2108 ohdr->seq = seq; 2109 2110 OVPN_PEER_COUNTER_ADD(peer, pkt_out, 1); 2111 OVPN_PEER_COUNTER_ADD(peer, bytes_out, len); 2112 2113 if (key->encrypt->cipher == OVPN_CIPHER_ALG_NONE) { 2114 ret = ovpn_encap(sc, peer->peerid, m); 2115 if (_ovpn_lock_trackerp != NULL) 2116 OVPN_RUNLOCK(sc); 2117 if (ret == 0) { 2118 OVPN_COUNTER_ADD(sc, sent_data_pkts, 1); 2119 OVPN_COUNTER_ADD(sc, tunnel_bytes_sent, tunnel_len); 2120 } 2121 return (ret); 2122 } 2123 2124 crp = crypto_getreq(key->encrypt->cryptoid, M_NOWAIT); 2125 if (crp == NULL) { 2126 if (_ovpn_lock_trackerp != NULL) 2127 OVPN_RUNLOCK(sc); 2128 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1); 2129 m_freem(m); 2130 return (ENOBUFS); 2131 } 2132 2133 /* Encryption covers only the payload, not the header. */ 2134 crp->crp_payload_start = sizeof(*ohdr); 2135 crp->crp_payload_length = len; 2136 crp->crp_op = CRYPTO_OP_ENCRYPT; 2137 2138 /* 2139 * AAD data covers the ovpn_wire_header minus the auth 2140 * tag. 2141 */ 2142 crp->crp_aad_length = sizeof(*ohdr) - sizeof(ohdr->auth_tag); 2143 crp->crp_aad = ohdr; 2144 crp->crp_aad_start = 0; 2145 crp->crp_op |= CRYPTO_OP_COMPUTE_DIGEST; 2146 crp->crp_digest_start = offsetof(struct ovpn_wire_header, auth_tag); 2147 2148 crp->crp_flags |= CRYPTO_F_IV_SEPARATE; 2149 memcpy(crp->crp_iv, &seq, sizeof(seq)); 2150 memcpy(crp->crp_iv + sizeof(seq), key->encrypt->nonce, 2151 key->encrypt->noncelen); 2152 2153 crypto_use_mbuf(crp, m); 2154 crp->crp_flags |= CRYPTO_F_CBIFSYNC; 2155 crp->crp_callback = ovpn_encrypt_tx_cb; 2156 crp->crp_opaque = peer; 2157 2158 atomic_add_int(&peer->refcount, 1); 2159 if (_ovpn_lock_trackerp != NULL) 2160 OVPN_RUNLOCK(sc); 2161 if (V_async_crypto) 2162 ret = crypto_dispatch_async(crp, CRYPTO_ASYNC_ORDERED); 2163 else 2164 ret = crypto_dispatch(crp); 2165 if (ret) { 2166 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1); 2167 } 2168 2169 return (ret); 2170 } 2171 2172 /* 2173 * Note: Expects to hold the read lock on entry, and will release it itself. 2174 */ 2175 static int 2176 ovpn_encap(struct ovpn_softc *sc, uint32_t peerid, struct mbuf *m) 2177 { 2178 struct udphdr *udp; 2179 struct ovpn_kpeer *peer; 2180 int len; 2181 2182 OVPN_RLOCK_TRACKER; 2183 2184 OVPN_RLOCK(sc); 2185 NET_EPOCH_ASSERT(); 2186 2187 peer = ovpn_find_peer(sc, peerid); 2188 if (peer == NULL || sc->ifp->if_link_state != LINK_STATE_UP) { 2189 OVPN_RUNLOCK(sc); 2190 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1); 2191 m_freem(m); 2192 return (ENETDOWN); 2193 } 2194 2195 len = m->m_pkthdr.len; 2196 2197 M_PREPEND(m, sizeof(struct udphdr), M_NOWAIT); 2198 if (m == NULL) { 2199 OVPN_RUNLOCK(sc); 2200 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1); 2201 m_freem(m); 2202 return (ENOBUFS); 2203 } 2204 udp = mtod(m, struct udphdr *); 2205 2206 MPASS(peer->local.ss_family == peer->remote.ss_family); 2207 2208 udp->uh_sport = ovpn_get_port(&peer->local); 2209 udp->uh_dport = ovpn_get_port(&peer->remote); 2210 udp->uh_ulen = htons(sizeof(struct udphdr) + len); 2211 2212 switch (peer->remote.ss_family) { 2213 #ifdef INET 2214 case AF_INET: { 2215 struct sockaddr_in *in_local = TO_IN(&peer->local); 2216 struct sockaddr_in *in_remote = TO_IN(&peer->remote); 2217 struct ip *ip; 2218 2219 /* 2220 * This requires knowing the source IP, which we don't. Happily 2221 * we're allowed to keep this at 0, and the checksum won't do 2222 * anything the crypto won't already do. 2223 */ 2224 udp->uh_sum = 0; 2225 2226 /* Set the checksum flags so we recalculate checksums. */ 2227 m->m_pkthdr.csum_flags |= CSUM_IP; 2228 m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum); 2229 2230 M_PREPEND(m, sizeof(struct ip), M_NOWAIT); 2231 if (m == NULL) { 2232 OVPN_RUNLOCK(sc); 2233 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1); 2234 return (ENOBUFS); 2235 } 2236 ip = mtod(m, struct ip *); 2237 2238 ip->ip_tos = 0; 2239 ip->ip_len = htons(sizeof(struct ip) + sizeof(struct udphdr) + 2240 len); 2241 ip->ip_off = 0; 2242 ip->ip_ttl = V_ip_defttl; 2243 ip->ip_p = IPPROTO_UDP; 2244 ip->ip_sum = 0; 2245 if (in_local->sin_port != 0) 2246 ip->ip_src = in_local->sin_addr; 2247 else 2248 ip->ip_src.s_addr = INADDR_ANY; 2249 ip->ip_dst = in_remote->sin_addr; 2250 2251 OVPN_RUNLOCK(sc); 2252 OVPN_COUNTER_ADD(sc, transport_bytes_sent, m->m_pkthdr.len); 2253 2254 return (ip_output(m, NULL, NULL, 0, NULL, NULL)); 2255 } 2256 #endif 2257 #ifdef INET6 2258 case AF_INET6: { 2259 struct sockaddr_in6 *in6_local = TO_IN6(&peer->local); 2260 struct sockaddr_in6 *in6_remote = TO_IN6(&peer->remote); 2261 struct ip6_hdr *ip6; 2262 2263 M_PREPEND(m, sizeof(struct ip6_hdr), M_NOWAIT); 2264 if (m == NULL) { 2265 OVPN_RUNLOCK(sc); 2266 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1); 2267 return (ENOBUFS); 2268 } 2269 m = m_pullup(m, sizeof(*ip6) + sizeof(*udp)); 2270 if (m == NULL) { 2271 OVPN_RUNLOCK(sc); 2272 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1); 2273 return (ENOBUFS); 2274 } 2275 2276 ip6 = mtod(m, struct ip6_hdr *); 2277 2278 ip6->ip6_vfc = IPV6_VERSION; 2279 ip6->ip6_flow &= ~IPV6_FLOWINFO_MASK; 2280 ip6->ip6_plen = htons(sizeof(*ip6) + sizeof(struct udphdr) + 2281 len); 2282 ip6->ip6_nxt = IPPROTO_UDP; 2283 ip6->ip6_hlim = V_ip6_defhlim; 2284 2285 memcpy(&ip6->ip6_src, &in6_local->sin6_addr, 2286 sizeof(ip6->ip6_src)); 2287 memcpy(&ip6->ip6_dst, &in6_remote->sin6_addr, 2288 sizeof(ip6->ip6_dst)); 2289 2290 if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src)) { 2291 /* Local and remote must have the same scope. */ 2292 ip6->ip6_src.__u6_addr.__u6_addr16[1] = 2293 htons(in6_remote->sin6_scope_id & 0xffff); 2294 } 2295 if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst)) 2296 ip6->ip6_dst.__u6_addr.__u6_addr16[1] = 2297 htons(in6_remote->sin6_scope_id & 0xffff); 2298 2299 udp = mtodo(m, sizeof(*ip6)); 2300 udp->uh_sum = in6_cksum_pseudo(ip6, 2301 m->m_pkthdr.len - sizeof(struct ip6_hdr), 2302 IPPROTO_UDP, 0); 2303 2304 m->m_pkthdr.csum_flags |= CSUM_UDP_IPV6; 2305 m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum); 2306 2307 OVPN_RUNLOCK(sc); 2308 OVPN_COUNTER_ADD(sc, transport_bytes_sent, m->m_pkthdr.len); 2309 2310 return (ip6_output(m, NULL, NULL, IPV6_UNSPECSRC, NULL, NULL, 2311 NULL)); 2312 } 2313 #endif 2314 default: 2315 panic("Unsupported address family %d", 2316 peer->remote.ss_family); 2317 } 2318 } 2319 2320 static int 2321 ovpn_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst, 2322 struct route *ro) 2323 { 2324 struct ovpn_softc *sc; 2325 struct ovpn_kpeer *peer; 2326 2327 OVPN_RLOCK_TRACKER; 2328 2329 sc = ifp->if_softc; 2330 2331 m = m_unshare(m, M_NOWAIT); 2332 if (m == NULL) { 2333 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1); 2334 return (ENOBUFS); 2335 } 2336 2337 OVPN_RLOCK(sc); 2338 2339 SDT_PROBE1(if_ovpn, tx, transmit, start, m); 2340 2341 if (__predict_false(ifp->if_link_state != LINK_STATE_UP)) { 2342 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1); 2343 OVPN_RUNLOCK(sc); 2344 m_freem(m); 2345 return (ENETDOWN); 2346 } 2347 2348 /** 2349 * Only obey 'dst' (i.e. the gateway) if no route is supplied. 2350 * That's our indication that we're being called through pf's route-to, 2351 * and we should route according to 'dst' instead. We can't do so 2352 * consistently, because the usual openvpn configuration sets the first 2353 * non-server IP in the subnet as the gateway. If we always use that 2354 * one we'd end up routing all traffic to the first client. 2355 * tl;dr: 'ro == NULL' tells us pf is doing a route-to, and then but 2356 * only then, we should treat 'dst' as the destination. */ 2357 peer = ovpn_route_peer(sc, &m, ro == NULL ? dst : NULL); 2358 if (peer == NULL) { 2359 /* No destination. */ 2360 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1); 2361 OVPN_RUNLOCK(sc); 2362 m_freem(m); 2363 return (ENETDOWN); 2364 } 2365 2366 return (ovpn_transmit_to_peer(ifp, m, peer, _ovpn_lock_trackerp)); 2367 } 2368 2369 static bool 2370 ovpn_check_replay(struct ovpn_kkey_dir *key, uint32_t seq) 2371 { 2372 uint32_t d; 2373 2374 mtx_lock(&key->replay_mtx); 2375 2376 /* Sequence number must be strictly greater than rx_seq */ 2377 if (seq <= key->rx_seq) { 2378 mtx_unlock(&key->replay_mtx); 2379 return (false); 2380 } 2381 2382 /* Large jump. The packet authenticated okay, so just accept that. */ 2383 if (seq > (key->rx_seq + (sizeof(key->rx_window) * 8))) { 2384 key->rx_seq = seq; 2385 key->rx_window = 0; 2386 mtx_unlock(&key->replay_mtx); 2387 return (true); 2388 } 2389 2390 /* Happy case. */ 2391 if ((seq == key->rx_seq + 1) && key->rx_window == 0) { 2392 key->rx_seq++; 2393 mtx_unlock(&key->replay_mtx); 2394 return (true); 2395 } 2396 2397 d = seq - key->rx_seq - 1; 2398 2399 if (key->rx_window & ((uint64_t)1 << d)) { 2400 /* Dupe! */ 2401 mtx_unlock(&key->replay_mtx); 2402 return (false); 2403 } 2404 2405 key->rx_window |= (uint64_t)1 << d; 2406 2407 while (key->rx_window & 1) { 2408 key->rx_seq++; 2409 key->rx_window >>= 1; 2410 } 2411 2412 mtx_unlock(&key->replay_mtx); 2413 2414 return (true); 2415 } 2416 2417 static struct ovpn_kpeer * 2418 ovpn_peer_from_mbuf(struct ovpn_softc *sc, struct mbuf *m, int off) 2419 { 2420 struct ovpn_wire_header ohdr; 2421 uint32_t peerid; 2422 const size_t hdrlen = sizeof(ohdr) - sizeof(ohdr.auth_tag); 2423 2424 OVPN_RASSERT(sc); 2425 2426 if (m_length(m, NULL) < (off + sizeof(struct udphdr) + hdrlen)) 2427 return (NULL); 2428 2429 m_copydata(m, off + sizeof(struct udphdr), hdrlen, (caddr_t)&ohdr); 2430 2431 peerid = ntohl(ohdr.opcode) & 0x00ffffff; 2432 2433 return (ovpn_find_peer(sc, peerid)); 2434 } 2435 2436 static bool 2437 ovpn_udp_input(struct mbuf *m, int off, struct inpcb *inp, 2438 const struct sockaddr *sa, void *ctx) 2439 { 2440 struct ovpn_softc *sc = ctx; 2441 struct ovpn_wire_header tmphdr; 2442 struct ovpn_wire_header *ohdr; 2443 struct udphdr *uhdr; 2444 struct ovpn_kkey *key; 2445 struct cryptop *crp; 2446 struct ovpn_kpeer *peer; 2447 size_t ohdrlen; 2448 int ret; 2449 uint8_t op; 2450 2451 OVPN_RLOCK_TRACKER; 2452 2453 M_ASSERTPKTHDR(m); 2454 2455 OVPN_COUNTER_ADD(sc, transport_bytes_received, m->m_pkthdr.len - off); 2456 2457 ohdrlen = sizeof(*ohdr) - sizeof(ohdr->auth_tag); 2458 2459 OVPN_RLOCK(sc); 2460 2461 peer = ovpn_peer_from_mbuf(sc, m, off); 2462 if (peer == NULL) { 2463 OVPN_RUNLOCK(sc); 2464 return (false); 2465 } 2466 2467 if (m_length(m, NULL) < (off + sizeof(*uhdr) + ohdrlen)) { 2468 /* Short packet. */ 2469 OVPN_RUNLOCK(sc); 2470 return (false); 2471 } 2472 2473 m_copydata(m, off + sizeof(*uhdr), ohdrlen, (caddr_t)&tmphdr); 2474 2475 op = ntohl(tmphdr.opcode) >> 24 >> OVPN_OP_SHIFT; 2476 if (op != OVPN_OP_DATA_V2) { 2477 /* Control packet? */ 2478 OVPN_RUNLOCK(sc); 2479 return (false); 2480 } 2481 2482 m = m_unshare(m, M_NOWAIT); 2483 if (m == NULL) { 2484 OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1); 2485 return (true); 2486 } 2487 2488 m = m_pullup(m, off + sizeof(*uhdr) + ohdrlen); 2489 if (m == NULL) { 2490 OVPN_RUNLOCK(sc); 2491 OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1); 2492 return (true); 2493 } 2494 2495 /* 2496 * Simplify things by getting rid of the preceding headers, we don't 2497 * care about them. 2498 */ 2499 m_adj_decap(m, off); 2500 2501 uhdr = mtodo(m, 0); 2502 ohdr = mtodo(m, sizeof(*uhdr)); 2503 2504 key = ovpn_find_key(sc, peer, ohdr); 2505 if (key == NULL || key->decrypt == NULL) { 2506 OVPN_RUNLOCK(sc); 2507 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1); 2508 m_freem(m); 2509 return (true); 2510 } 2511 2512 /* 2513 * If we got this from a different address than we expected tag the packet. 2514 * We'll deal with notifiying userspace later, after we've decrypted and 2515 * verified. 2516 */ 2517 if (! ovpn_sockaddr_compare((struct sockaddr *)&peer->remote, sa)) { 2518 struct m_tag *mt; 2519 struct ovpn_mtag *ot; 2520 2521 MPASS(sa->sa_len <= sizeof(ot->addr)); 2522 mt = m_tag_get(PACKET_TAG_OVPN, sizeof(*ot), M_NOWAIT); 2523 /* 2524 * If we fail to allocate here we'll just try again on the next 2525 * packet. 2526 */ 2527 if (mt != NULL) { 2528 ot = (struct ovpn_mtag *)(mt + 1); 2529 memcpy(&ot->addr, sa, sa->sa_len); 2530 2531 m_tag_prepend(m, mt); 2532 } 2533 } 2534 2535 if (key->decrypt->cipher == OVPN_CIPHER_ALG_NONE) { 2536 /* Now remove the outer headers */ 2537 m_adj_decap(m, sizeof(struct udphdr) + ohdrlen); 2538 2539 ohdr = mtodo(m, sizeof(*uhdr)); 2540 2541 ovpn_finish_rx(sc, m, peer, key, ntohl(ohdr->seq), 2542 _ovpn_lock_trackerp); 2543 OVPN_UNLOCK_ASSERT(sc); 2544 return (true); 2545 } 2546 2547 ohdrlen += sizeof(ohdr->auth_tag); 2548 2549 m = m_pullup(m, sizeof(*uhdr) + ohdrlen); 2550 if (m == NULL) { 2551 OVPN_RUNLOCK(sc); 2552 OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1); 2553 return (true); 2554 } 2555 uhdr = mtodo(m, 0); 2556 ohdr = mtodo(m, sizeof(*uhdr)); 2557 2558 /* Decrypt */ 2559 crp = crypto_getreq(key->decrypt->cryptoid, M_NOWAIT); 2560 if (crp == NULL) { 2561 OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1); 2562 OVPN_RUNLOCK(sc); 2563 m_freem(m); 2564 return (true); 2565 } 2566 2567 crp->crp_payload_start = sizeof(struct udphdr) + sizeof(*ohdr); 2568 crp->crp_payload_length = ntohs(uhdr->uh_ulen) - 2569 sizeof(*uhdr) - sizeof(*ohdr); 2570 crp->crp_op = CRYPTO_OP_DECRYPT; 2571 2572 /* AAD validation. */ 2573 crp->crp_aad_length = sizeof(*ohdr) - sizeof(ohdr->auth_tag); 2574 crp->crp_aad = ohdr; 2575 crp->crp_aad_start = 0; 2576 crp->crp_op |= CRYPTO_OP_VERIFY_DIGEST; 2577 crp->crp_digest_start = sizeof(struct udphdr) + 2578 offsetof(struct ovpn_wire_header, auth_tag); 2579 2580 crp->crp_flags |= CRYPTO_F_IV_SEPARATE; 2581 memcpy(crp->crp_iv, &ohdr->seq, sizeof(ohdr->seq)); 2582 memcpy(crp->crp_iv + sizeof(ohdr->seq), key->decrypt->nonce, 2583 key->decrypt->noncelen); 2584 2585 crypto_use_mbuf(crp, m); 2586 crp->crp_flags |= CRYPTO_F_CBIFSYNC; 2587 crp->crp_callback = ovpn_decrypt_rx_cb; 2588 crp->crp_opaque = sc; 2589 2590 atomic_add_int(&sc->refcount, 1); 2591 OVPN_RUNLOCK(sc); 2592 if (V_async_crypto) 2593 ret = crypto_dispatch_async(crp, CRYPTO_ASYNC_ORDERED); 2594 else 2595 ret = crypto_dispatch(crp); 2596 if (ret != 0) { 2597 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1); 2598 } 2599 2600 return (true); 2601 } 2602 2603 static void 2604 ovpn_qflush(struct ifnet *ifp __unused) 2605 { 2606 2607 } 2608 2609 static void 2610 ovpn_flush_rxring(struct ovpn_softc *sc) 2611 { 2612 struct ovpn_notification *n; 2613 2614 OVPN_WASSERT(sc); 2615 2616 while (! buf_ring_empty(sc->notifring)) { 2617 n = buf_ring_dequeue_sc(sc->notifring); 2618 free(n, M_OVPN); 2619 } 2620 } 2621 2622 #ifdef VIMAGE 2623 static void 2624 ovpn_reassign(struct ifnet *ifp, struct vnet *new_vnet __unused, 2625 char *unused __unused) 2626 { 2627 struct ovpn_softc *sc = ifp->if_softc; 2628 struct ovpn_kpeer *peer, *tmppeer; 2629 int ret __diagused; 2630 2631 OVPN_WLOCK(sc); 2632 2633 /* Flush keys & configuration. */ 2634 RB_FOREACH_SAFE(peer, ovpn_kpeers, &sc->peers, tmppeer) { 2635 peer->del_reason = OVPN_DEL_REASON_REQUESTED; 2636 ret = _ovpn_del_peer(sc, peer); 2637 MPASS(ret == 0); 2638 } 2639 2640 ovpn_flush_rxring(sc); 2641 2642 OVPN_WUNLOCK(sc); 2643 } 2644 #endif 2645 2646 static int 2647 ovpn_clone_match(struct if_clone *ifc, const char *name) 2648 { 2649 /* 2650 * Allow all names that start with 'ovpn', specifically because pfSense 2651 * uses ovpnc1 / ovpns2 2652 */ 2653 return (strncmp(ovpnname, name, strlen(ovpnname)) == 0); 2654 } 2655 2656 static int 2657 ovpn_clone_create(struct if_clone *ifc, char *name, size_t len, 2658 struct ifc_data *ifd, struct ifnet **ifpp) 2659 { 2660 struct ovpn_softc *sc; 2661 struct ifnet *ifp; 2662 char *dp; 2663 int error, unit, wildcard; 2664 2665 /* Try to see if a special unit was requested. */ 2666 error = ifc_name2unit(name, &unit); 2667 if (error != 0) 2668 return (error); 2669 wildcard = (unit < 0); 2670 2671 error = ifc_alloc_unit(ifc, &unit); 2672 if (error != 0) 2673 return (error); 2674 2675 /* 2676 * If no unit had been given, we need to adjust the ifName. 2677 */ 2678 for (dp = name; *dp != '\0'; dp++); 2679 if (wildcard) { 2680 error = snprintf(dp, len - (dp - name), "%d", unit); 2681 if (error > len - (dp - name)) { 2682 /* ifName too long. */ 2683 ifc_free_unit(ifc, unit); 2684 return (ENOSPC); 2685 } 2686 dp += error; 2687 } 2688 2689 /* Make sure it doesn't already exist. */ 2690 if (ifunit(name) != NULL) 2691 return (EEXIST); 2692 2693 sc = malloc(sizeof(struct ovpn_softc), M_OVPN, M_WAITOK | M_ZERO); 2694 sc->ifp = if_alloc(IFT_ENC); 2695 rm_init_flags(&sc->lock, "if_ovpn_lock", RM_RECURSE); 2696 sc->refcount = 0; 2697 2698 sc->notifring = buf_ring_alloc(32, M_OVPN, M_WAITOK, NULL); 2699 2700 COUNTER_ARRAY_ALLOC(sc->counters, OVPN_COUNTER_SIZE, M_WAITOK); 2701 2702 ifp = sc->ifp; 2703 ifp->if_softc = sc; 2704 strlcpy(ifp->if_xname, name, IFNAMSIZ); 2705 ifp->if_dname = ovpngroupname; 2706 ifp->if_dunit = unit; 2707 2708 ifp->if_addrlen = 0; 2709 ifp->if_mtu = 1428; 2710 ifp->if_flags = IFF_POINTOPOINT | IFF_MULTICAST; 2711 ifp->if_ioctl = ovpn_ioctl; 2712 ifp->if_transmit = ovpn_transmit; 2713 ifp->if_output = ovpn_output; 2714 ifp->if_qflush = ovpn_qflush; 2715 #ifdef VIMAGE 2716 ifp->if_reassign = ovpn_reassign; 2717 #endif 2718 ifp->if_capabilities |= IFCAP_LINKSTATE; 2719 ifp->if_capenable |= IFCAP_LINKSTATE; 2720 2721 if_attach(ifp); 2722 bpfattach(ifp, DLT_NULL, sizeof(uint32_t)); 2723 *ifpp = ifp; 2724 2725 return (0); 2726 } 2727 2728 static void 2729 ovpn_clone_destroy_cb(struct epoch_context *ctx) 2730 { 2731 struct ovpn_softc *sc; 2732 int ret __diagused; 2733 2734 sc = __containerof(ctx, struct ovpn_softc, epoch_ctx); 2735 2736 MPASS(sc->peercount == 0); 2737 MPASS(RB_EMPTY(&sc->peers)); 2738 2739 if (sc->so != NULL) { 2740 CURVNET_SET(sc->ifp->if_vnet); 2741 ret = udp_set_kernel_tunneling(sc->so, NULL, NULL, NULL); 2742 MPASS(ret == 0); 2743 sorele(sc->so); 2744 CURVNET_RESTORE(); 2745 } 2746 2747 COUNTER_ARRAY_FREE(sc->counters, OVPN_COUNTER_SIZE); 2748 2749 rm_destroy(&sc->lock); 2750 if_free(sc->ifp); 2751 free(sc, M_OVPN); 2752 } 2753 2754 static int 2755 ovpn_clone_destroy(struct if_clone *ifc, struct ifnet *ifp, uint32_t flags) 2756 { 2757 struct ovpn_softc *sc; 2758 struct ovpn_kpeer *peer, *tmppeer; 2759 int unit; 2760 int ret __diagused; 2761 2762 sc = ifp->if_softc; 2763 unit = ifp->if_dunit; 2764 2765 OVPN_WLOCK(sc); 2766 2767 if (atomic_load_int(&sc->refcount) > 0) { 2768 OVPN_WUNLOCK(sc); 2769 return (EBUSY); 2770 } 2771 2772 RB_FOREACH_SAFE(peer, ovpn_kpeers, &sc->peers, tmppeer) { 2773 peer->del_reason = OVPN_DEL_REASON_REQUESTED; 2774 ret = _ovpn_del_peer(sc, peer); 2775 MPASS(ret == 0); 2776 } 2777 2778 ovpn_flush_rxring(sc); 2779 buf_ring_free(sc->notifring, M_OVPN); 2780 2781 OVPN_WUNLOCK(sc); 2782 2783 bpfdetach(ifp); 2784 if_detach(ifp); 2785 ifp->if_softc = NULL; 2786 2787 NET_EPOCH_CALL(ovpn_clone_destroy_cb, &sc->epoch_ctx); 2788 2789 if (unit != IF_DUNIT_NONE) 2790 ifc_free_unit(ifc, unit); 2791 2792 NET_EPOCH_DRAIN_CALLBACKS(); 2793 2794 return (0); 2795 } 2796 2797 static void 2798 vnet_ovpn_init(const void *unused __unused) 2799 { 2800 struct if_clone_addreq req = { 2801 .match_f = ovpn_clone_match, 2802 .create_f = ovpn_clone_create, 2803 .destroy_f = ovpn_clone_destroy, 2804 }; 2805 V_ovpn_cloner = ifc_attach_cloner(ovpngroupname, &req); 2806 } 2807 VNET_SYSINIT(vnet_ovpn_init, SI_SUB_PSEUDO, SI_ORDER_ANY, 2808 vnet_ovpn_init, NULL); 2809 2810 static int 2811 ovpn_prison_remove(void *obj, void *data __unused) 2812 { 2813 #ifdef VIMAGE 2814 struct prison *pr; 2815 2816 pr = obj; 2817 if (prison_owns_vnet(pr)) { 2818 CURVNET_SET(pr->pr_vnet); 2819 if (V_ovpn_cloner != NULL) { 2820 ifc_detach_cloner(V_ovpn_cloner); 2821 V_ovpn_cloner = NULL; 2822 } 2823 CURVNET_RESTORE(); 2824 } 2825 #endif 2826 return (0); 2827 } 2828 2829 static int 2830 ovpnmodevent(module_t mod, int type, void *data) 2831 { 2832 static int ovpn_osd_jail_slot; 2833 2834 switch (type) { 2835 case MOD_LOAD: { 2836 /* 2837 * Registration is handled in vnet_ovpn_init(), but cloned 2838 * interfaces must be destroyed via PR_METHOD_REMOVE since they 2839 * hold a reference to the prison via the UDP socket, which 2840 * prevents the prison from being destroyed. 2841 */ 2842 osd_method_t methods[PR_MAXMETHOD] = { 2843 [PR_METHOD_REMOVE] = ovpn_prison_remove, 2844 }; 2845 ovpn_osd_jail_slot = osd_jail_register(NULL, methods); 2846 break; 2847 } 2848 case MOD_UNLOAD: 2849 if (ovpn_osd_jail_slot != 0) 2850 osd_jail_deregister(ovpn_osd_jail_slot); 2851 CURVNET_SET(vnet0); 2852 if (V_ovpn_cloner != NULL) { 2853 ifc_detach_cloner(V_ovpn_cloner); 2854 V_ovpn_cloner = NULL; 2855 } 2856 CURVNET_RESTORE(); 2857 break; 2858 default: 2859 return (EOPNOTSUPP); 2860 } 2861 2862 return (0); 2863 } 2864 2865 static moduledata_t ovpn_mod = { 2866 "if_ovpn", 2867 ovpnmodevent, 2868 0 2869 }; 2870 2871 DECLARE_MODULE(if_ovpn, ovpn_mod, SI_SUB_PSEUDO, SI_ORDER_ANY); 2872 MODULE_VERSION(if_ovpn, 1); 2873 MODULE_DEPEND(if_ovpn, crypto, 1, 1, 1); 2874