1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3 * 4 * Copyright (c) 2021-2022 Rubicon Communications, LLC (Netgate) 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 * 27 */ 28 #include "opt_inet.h" 29 #include "opt_inet6.h" 30 31 #include <sys/param.h> 32 #include <sys/systm.h> 33 #include <sys/buf_ring.h> 34 #include <sys/epoch.h> 35 #include <sys/file.h> 36 #include <sys/filedesc.h> 37 #include <sys/kernel.h> 38 #include <sys/malloc.h> 39 #include <sys/mbuf.h> 40 #include <sys/module.h> 41 #include <sys/nv.h> 42 #include <sys/priv.h> 43 #include <sys/protosw.h> 44 #include <sys/rmlock.h> 45 #include <sys/sdt.h> 46 #include <sys/smp.h> 47 #include <sys/socket.h> 48 #include <sys/socketvar.h> 49 #include <sys/sockio.h> 50 #include <sys/sysctl.h> 51 #include <sys/time.h> 52 53 #include <machine/atomic.h> 54 55 #include <net/bpf.h> 56 #include <net/if.h> 57 #include <net/if_clone.h> 58 #include <net/if_types.h> 59 #include <net/if_var.h> 60 #include <net/netisr.h> 61 #include <net/route/nhop.h> 62 63 #include <netinet/in.h> 64 #include <netinet/in_fib.h> 65 #include <netinet/ip.h> 66 #include <netinet/ip6.h> 67 #include <netinet/ip_var.h> 68 #include <netinet/udp.h> 69 #include <netinet/udp_var.h> 70 71 #include <netinet6/ip6_var.h> 72 #include <netinet6/in6_fib.h> 73 74 #include <machine/in_cksum.h> 75 76 #include <opencrypto/cryptodev.h> 77 78 #include "if_ovpn.h" 79 80 struct ovpn_kkey_dir { 81 int refcount; 82 uint8_t key[32]; 83 uint8_t keylen; 84 uint8_t nonce[8]; 85 uint8_t noncelen; 86 enum ovpn_key_cipher cipher; 87 crypto_session_t cryptoid; 88 89 struct mtx replay_mtx; 90 /* 91 * Last seen gapless sequence number. New rx seq numbers must be 92 * strictly higher than this. 93 */ 94 uint32_t rx_seq; 95 /* Seen packets, relative to rx_seq. bit(0) will always be 0. */ 96 uint64_t rx_window; 97 }; 98 99 struct ovpn_kkey { 100 struct ovpn_kkey_dir *encrypt; 101 struct ovpn_kkey_dir *decrypt; 102 uint8_t keyid; 103 uint32_t peerid; 104 }; 105 106 struct ovpn_keepalive { 107 uint32_t interval; 108 uint32_t timeout; 109 }; 110 111 struct ovpn_wire_header { 112 uint32_t opcode; /* opcode, key id, peer id */ 113 uint32_t seq; 114 uint8_t auth_tag[16]; 115 }; 116 117 struct ovpn_notification { 118 enum ovpn_notif_type type; 119 uint32_t peerid; 120 }; 121 122 struct ovpn_softc; 123 124 struct ovpn_kpeer { 125 RB_ENTRY(ovpn_kpeer) tree; 126 int refcount; 127 uint32_t peerid; 128 129 struct ovpn_softc *sc; 130 struct sockaddr_storage local; 131 struct sockaddr_storage remote; 132 133 struct in_addr vpn4; 134 struct in6_addr vpn6; 135 136 struct ovpn_kkey keys[2]; 137 uint32_t tx_seq; 138 139 struct ovpn_keepalive keepalive; 140 uint32_t *last_active; 141 struct callout ping_send; 142 struct callout ping_rcv; 143 }; 144 145 struct ovpn_counters { 146 uint64_t lost_ctrl_pkts_in; 147 uint64_t lost_ctrl_pkts_out; 148 uint64_t lost_data_pkts_in; 149 uint64_t lost_data_pkts_out; 150 uint64_t nomem_data_pkts_in; 151 uint64_t nomem_data_pkts_out; 152 uint64_t received_ctrl_pkts; 153 uint64_t received_data_pkts; 154 uint64_t sent_ctrl_pkts; 155 uint64_t sent_data_pkts; 156 157 uint64_t transport_bytes_sent; 158 uint64_t transport_bytes_received; 159 uint64_t tunnel_bytes_sent; 160 uint64_t tunnel_bytes_received; 161 }; 162 #define OVPN_COUNTER_SIZE (sizeof(struct ovpn_counters)/sizeof(uint64_t)) 163 164 RB_HEAD(ovpn_kpeers, ovpn_kpeer); 165 166 struct ovpn_softc { 167 int refcount; 168 struct rmlock lock; 169 struct ifnet *ifp; 170 struct socket *so; 171 int peercount; 172 struct ovpn_kpeers peers; 173 174 /* Pending notification */ 175 struct buf_ring *notifring; 176 177 counter_u64_t counters[OVPN_COUNTER_SIZE]; 178 179 struct epoch_context epoch_ctx; 180 }; 181 182 static struct ovpn_kpeer *ovpn_find_peer(struct ovpn_softc *, uint32_t); 183 static bool ovpn_udp_input(struct mbuf *, int, struct inpcb *, 184 const struct sockaddr *, void *); 185 static int ovpn_transmit_to_peer(struct ifnet *, struct mbuf *, 186 struct ovpn_kpeer *, struct rm_priotracker *); 187 static int ovpn_encap(struct ovpn_softc *, uint32_t, struct mbuf *); 188 static int ovpn_get_af(struct mbuf *); 189 static void ovpn_free_kkey_dir(struct ovpn_kkey_dir *); 190 static bool ovpn_check_replay(struct ovpn_kkey_dir *, uint32_t); 191 static int ovpn_peer_compare(struct ovpn_kpeer *, struct ovpn_kpeer *); 192 193 static RB_PROTOTYPE(ovpn_kpeers, ovpn_kpeer, tree, ovpn_peer_compare); 194 static RB_GENERATE(ovpn_kpeers, ovpn_kpeer, tree, ovpn_peer_compare); 195 196 #define OVPN_MTU_MIN 576 197 #define OVPN_MTU_MAX (IP_MAXPACKET - sizeof(struct ip) - \ 198 sizeof(struct udphdr) - sizeof(struct ovpn_wire_header)) 199 200 #define OVPN_OP_DATA_V2 0x09 201 #define OVPN_OP_SHIFT 3 202 203 VNET_DEFINE_STATIC(struct if_clone *, ovpn_cloner); 204 #define V_ovpn_cloner VNET(ovpn_cloner) 205 206 #define OVPN_RLOCK_TRACKER struct rm_priotracker _ovpn_lock_tracker; \ 207 struct rm_priotracker *_ovpn_lock_trackerp = &_ovpn_lock_tracker 208 #define OVPN_RLOCK(sc) rm_rlock(&(sc)->lock, _ovpn_lock_trackerp) 209 #define OVPN_RUNLOCK(sc) rm_runlock(&(sc)->lock, _ovpn_lock_trackerp) 210 #define OVPN_WLOCK(sc) rm_wlock(&(sc)->lock) 211 #define OVPN_WUNLOCK(sc) rm_wunlock(&(sc)->lock) 212 #define OVPN_ASSERT(sc) rm_assert(&(sc)->lock, RA_LOCKED) 213 #define OVPN_RASSERT(sc) rm_assert(&(sc)->lock, RA_RLOCKED) 214 #define OVPN_WASSERT(sc) rm_assert(&(sc)->lock, RA_WLOCKED) 215 #define OVPN_UNLOCK_ASSERT(sc) rm_assert(&(sc)->lock, RA_UNLOCKED) 216 217 #define OVPN_COUNTER_ADD(sc, name, val) \ 218 counter_u64_add(sc->counters[offsetof(struct ovpn_counters, name) / \ 219 sizeof(uint64_t)], val) 220 221 #define TO_IN(x) ((struct sockaddr_in *)(x)) 222 #define TO_IN6(x) ((struct sockaddr_in6 *)(x)) 223 224 SDT_PROVIDER_DEFINE(if_ovpn); 225 SDT_PROBE_DEFINE1(if_ovpn, tx, transmit, start, "struct mbuf *"); 226 SDT_PROBE_DEFINE2(if_ovpn, tx, route, ip4, "struct in_addr *", "struct ovpn_kpeer *"); 227 SDT_PROBE_DEFINE2(if_ovpn, tx, route, ip6, "struct in6_addr *", "struct ovpn_kpeer *"); 228 229 static const char ovpnname[] = "ovpn"; 230 static const char ovpngroupname[] = "openvpn"; 231 232 static MALLOC_DEFINE(M_OVPN, ovpnname, "OpenVPN DCO Interface"); 233 234 SYSCTL_DECL(_net_link); 235 static SYSCTL_NODE(_net_link, IFT_OTHER, openvpn, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 236 "OpenVPN DCO Interface"); 237 VNET_DEFINE_STATIC(int, replay_protection) = 0; 238 #define V_replay_protection VNET(replay_protection) 239 SYSCTL_INT(_net_link_openvpn, OID_AUTO, replay_protection, CTLFLAG_VNET | CTLFLAG_RW, 240 &VNET_NAME(replay_protection), 0, "Validate sequence numbers"); 241 242 VNET_DEFINE_STATIC(int, async_crypto); 243 #define V_async_crypto VNET(async_crypto) 244 SYSCTL_INT(_net_link_openvpn, OID_AUTO, async_crypto, 245 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(async_crypto), 0, 246 "Use asynchronous mode to parallelize crypto jobs."); 247 248 VNET_DEFINE_STATIC(int, async_netisr_queue); 249 #define V_async_netisr_queue VNET(async_netisr_queue) 250 SYSCTL_INT(_net_link_openvpn, OID_AUTO, netisr_queue, 251 CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(async_netisr_queue), 0, 252 "Use netisr_queue() rather than netisr_dispatch()."); 253 254 static int 255 ovpn_peer_compare(struct ovpn_kpeer *a, struct ovpn_kpeer *b) 256 { 257 return (a->peerid - b->peerid); 258 } 259 260 static struct ovpn_kpeer * 261 ovpn_find_peer(struct ovpn_softc *sc, uint32_t peerid) 262 { 263 struct ovpn_kpeer p; 264 265 OVPN_ASSERT(sc); 266 267 p.peerid = peerid; 268 269 return (RB_FIND(ovpn_kpeers, &sc->peers, &p)); 270 } 271 272 static struct ovpn_kpeer * 273 ovpn_find_only_peer(struct ovpn_softc *sc) 274 { 275 OVPN_ASSERT(sc); 276 277 return (RB_ROOT(&sc->peers)); 278 } 279 280 static uint16_t 281 ovpn_get_port(struct sockaddr_storage *s) 282 { 283 switch (s->ss_family) { 284 case AF_INET: { 285 struct sockaddr_in *in = (struct sockaddr_in *)s; 286 return (in->sin_port); 287 } 288 case AF_INET6: { 289 struct sockaddr_in6 *in6 = (struct sockaddr_in6 *)s; 290 return (in6->sin6_port); 291 } 292 default: 293 panic("Unsupported address family %d", s->ss_family); 294 } 295 } 296 297 static int 298 ovpn_nvlist_to_sockaddr(const nvlist_t *nvl, struct sockaddr_storage *sa) 299 { 300 int af; 301 302 if (! nvlist_exists_number(nvl, "af")) 303 return (EINVAL); 304 if (! nvlist_exists_binary(nvl, "address")) 305 return (EINVAL); 306 if (! nvlist_exists_number(nvl, "port")) 307 return (EINVAL); 308 309 af = nvlist_get_number(nvl, "af"); 310 311 switch (af) { 312 #ifdef INET 313 case AF_INET: { 314 struct sockaddr_in *in = (struct sockaddr_in *)sa; 315 size_t len; 316 const void *addr = nvlist_get_binary(nvl, "address", &len); 317 in->sin_family = af; 318 if (len != sizeof(in->sin_addr)) 319 return (EINVAL); 320 321 memcpy(&in->sin_addr, addr, sizeof(in->sin_addr)); 322 in->sin_port = nvlist_get_number(nvl, "port"); 323 break; 324 } 325 #endif 326 #ifdef INET6 327 case AF_INET6: { 328 struct sockaddr_in6 *in6 = (struct sockaddr_in6 *)sa; 329 size_t len; 330 const void *addr = nvlist_get_binary(nvl, "address", &len); 331 in6->sin6_family = af; 332 if (len != sizeof(in6->sin6_addr)) 333 return (EINVAL); 334 335 memcpy(&in6->sin6_addr, addr, sizeof(in6->sin6_addr)); 336 in6->sin6_port = nvlist_get_number(nvl, "port"); 337 break; 338 } 339 #endif 340 default: 341 return (EINVAL); 342 } 343 344 return (0); 345 } 346 347 static bool 348 ovpn_has_peers(struct ovpn_softc *sc) 349 { 350 OVPN_ASSERT(sc); 351 352 return (sc->peercount > 0); 353 } 354 355 static void 356 ovpn_rele_so(struct ovpn_softc *sc, struct ovpn_kpeer *peer) 357 { 358 bool has_peers; 359 360 OVPN_WASSERT(sc); 361 362 if (sc->so == NULL) 363 return; 364 365 has_peers = ovpn_has_peers(sc); 366 367 /* Only remove the tunnel function if we're releasing the socket for 368 * the last peer. */ 369 if (! has_peers) 370 (void)udp_set_kernel_tunneling(sc->so, NULL, NULL, NULL); 371 372 sorele(sc->so); 373 374 if (! has_peers) 375 sc->so = NULL; 376 } 377 378 static void 379 ovpn_notify_del_peer(struct ovpn_softc *sc, struct ovpn_kpeer *peer) 380 { 381 struct ovpn_notification *n; 382 383 OVPN_WASSERT(sc); 384 385 n = malloc(sizeof(*n), M_OVPN, M_NOWAIT); 386 if (n == NULL) 387 return; 388 389 n->peerid = peer->peerid; 390 n->type = OVPN_NOTIF_DEL_PEER; 391 if (buf_ring_enqueue(sc->notifring, n) != 0) { 392 free(n, M_OVPN); 393 } else if (sc->so != NULL) { 394 /* Wake up userspace */ 395 sc->so->so_error = EAGAIN; 396 sorwakeup(sc->so); 397 sowwakeup(sc->so); 398 } 399 } 400 401 static void 402 ovpn_peer_release_ref(struct ovpn_kpeer *peer, bool locked) 403 { 404 struct ovpn_softc *sc; 405 406 CURVNET_ASSERT_SET(); 407 408 atomic_add_int(&peer->refcount, -1); 409 410 if (atomic_load_int(&peer->refcount) > 0) 411 return; 412 413 sc = peer->sc; 414 415 if (! locked) { 416 OVPN_WLOCK(sc); 417 418 /* Might have changed before we acquired the lock. */ 419 if (atomic_load_int(&peer->refcount) > 0) { 420 OVPN_WUNLOCK(sc); 421 return; 422 } 423 } 424 425 OVPN_ASSERT(sc); 426 427 /* The peer should have been removed from the list already. */ 428 MPASS(ovpn_find_peer(sc, peer->peerid) == NULL); 429 430 ovpn_notify_del_peer(sc, peer); 431 432 for (int i = 0; i < 2; i++) { 433 ovpn_free_kkey_dir(peer->keys[i].encrypt); 434 ovpn_free_kkey_dir(peer->keys[i].decrypt); 435 } 436 437 ovpn_rele_so(sc, peer); 438 439 callout_stop(&peer->ping_send); 440 callout_stop(&peer->ping_rcv); 441 uma_zfree_pcpu(pcpu_zone_4, peer->last_active); 442 free(peer, M_OVPN); 443 444 if (! locked) 445 OVPN_WUNLOCK(sc); 446 } 447 448 static int 449 ovpn_new_peer(struct ifnet *ifp, const nvlist_t *nvl) 450 { 451 #ifdef INET6 452 struct epoch_tracker et; 453 #endif 454 struct sockaddr_storage remote; 455 struct ovpn_kpeer *peer = NULL; 456 struct file *fp = NULL; 457 struct sockaddr *name = NULL; 458 struct ovpn_softc *sc = ifp->if_softc; 459 struct thread *td = curthread; 460 struct socket *so = NULL; 461 int fd; 462 uint32_t peerid; 463 int ret = 0; 464 465 if (nvl == NULL) 466 return (EINVAL); 467 468 if (! nvlist_exists_number(nvl, "peerid")) 469 return (EINVAL); 470 471 if (! nvlist_exists_number(nvl, "fd")) 472 return (EINVAL); 473 474 if (! nvlist_exists_nvlist(nvl, "remote")) 475 return (EINVAL); 476 477 peerid = nvlist_get_number(nvl, "peerid"); 478 479 ret = ovpn_nvlist_to_sockaddr(nvlist_get_nvlist(nvl, "remote"), 480 &remote); 481 if (ret != 0) 482 return (ret); 483 484 fd = nvlist_get_number(nvl, "fd"); 485 486 /* Look up the userspace process and use the fd to find the socket. */ 487 ret = getsock(td, fd, &cap_connect_rights, &fp); 488 if (ret != 0) 489 return (ret); 490 491 so = fp->f_data; 492 493 peer = malloc(sizeof(*peer), M_OVPN, M_WAITOK | M_ZERO); 494 peer->peerid = peerid; 495 peer->sc = sc; 496 peer->tx_seq = 1; 497 peer->refcount = 1; 498 peer->last_active = uma_zalloc_pcpu(pcpu_zone_4, M_WAITOK | M_ZERO); 499 500 if (nvlist_exists_binary(nvl, "vpn_ipv4")) { 501 size_t len; 502 const void *addr = nvlist_get_binary(nvl, "vpn_ipv4", &len); 503 if (len != sizeof(peer->vpn4)) { 504 ret = EINVAL; 505 goto error; 506 } 507 memcpy(&peer->vpn4, addr, len); 508 } 509 510 if (nvlist_exists_binary(nvl, "vpn_ipv6")) { 511 size_t len; 512 const void *addr = nvlist_get_binary(nvl, "vpn_ipv6", &len); 513 if (len != sizeof(peer->vpn6)) { 514 ret = EINVAL; 515 goto error; 516 } 517 memcpy(&peer->vpn6, addr, len); 518 } 519 520 callout_init_rm(&peer->ping_send, &sc->lock, CALLOUT_SHAREDLOCK); 521 callout_init_rm(&peer->ping_rcv, &sc->lock, 0); 522 523 ret = so->so_proto->pr_sockaddr(so, &name); 524 if (ret) 525 goto error; 526 527 if (ovpn_get_port((struct sockaddr_storage *)name) == 0) { 528 ret = EINVAL; 529 goto error; 530 } 531 if (name->sa_family != remote.ss_family) { 532 ret = EINVAL; 533 goto error; 534 } 535 536 memcpy(&peer->local, name, name->sa_len); 537 memcpy(&peer->remote, &remote, sizeof(remote)); 538 free(name, M_SONAME); 539 name = NULL; 540 541 if (peer->local.ss_family == AF_INET6 && 542 IN6_IS_ADDR_V4MAPPED(&TO_IN6(&peer->remote)->sin6_addr)) { 543 /* V4 mapped address, so treat this as v4, not v6. */ 544 in6_sin6_2_sin_in_sock((struct sockaddr *)&peer->local); 545 in6_sin6_2_sin_in_sock((struct sockaddr *)&peer->remote); 546 } 547 548 #ifdef INET6 549 if (peer->local.ss_family == AF_INET6 && 550 IN6_IS_ADDR_UNSPECIFIED(&TO_IN6(&peer->local)->sin6_addr)) { 551 NET_EPOCH_ENTER(et); 552 ret = in6_selectsrc_addr(curthread->td_proc->p_fibnum, 553 &TO_IN6(&peer->remote)->sin6_addr, 554 0, NULL, &TO_IN6(&peer->local)->sin6_addr, NULL); 555 NET_EPOCH_EXIT(et); 556 if (ret != 0) { 557 goto error; 558 } 559 } 560 #endif 561 OVPN_WLOCK(sc); 562 563 /* Disallow peer id re-use. */ 564 if (ovpn_find_peer(sc, peerid) != NULL) { 565 ret = EEXIST; 566 goto error_locked; 567 } 568 569 /* Make sure this is really a UDP socket. */ 570 if (so->so_type != SOCK_DGRAM || so->so_proto->pr_type != SOCK_DGRAM) { 571 ret = EPROTOTYPE; 572 goto error_locked; 573 } 574 575 /* Must be the same socket as for other peers on this interface. */ 576 if (sc->so != NULL && so != sc->so) 577 goto error_locked; 578 579 if (sc->so == NULL) 580 sc->so = so; 581 582 /* Insert the peer into the list. */ 583 RB_INSERT(ovpn_kpeers, &sc->peers, peer); 584 sc->peercount++; 585 soref(sc->so); 586 587 ret = udp_set_kernel_tunneling(sc->so, ovpn_udp_input, NULL, sc); 588 if (ret == EBUSY) { 589 /* Fine, another peer already set the input function. */ 590 ret = 0; 591 } 592 if (ret != 0) { 593 RB_REMOVE(ovpn_kpeers, &sc->peers, peer); 594 sc->peercount--; 595 goto error_locked; 596 } 597 598 OVPN_WUNLOCK(sc); 599 600 goto done; 601 602 error_locked: 603 OVPN_WUNLOCK(sc); 604 error: 605 free(name, M_SONAME); 606 uma_zfree_pcpu(pcpu_zone_4, peer->last_active); 607 free(peer, M_OVPN); 608 done: 609 if (fp != NULL) 610 fdrop(fp, td); 611 612 return (ret); 613 } 614 615 static int 616 _ovpn_del_peer(struct ovpn_softc *sc, uint32_t peerid) 617 { 618 struct ovpn_kpeer *peer; 619 620 OVPN_WASSERT(sc); 621 CURVNET_ASSERT_SET(); 622 623 peer = ovpn_find_peer(sc, peerid); 624 if (peer == NULL) 625 return (ENOENT); 626 peer = RB_REMOVE(ovpn_kpeers, &sc->peers, peer); 627 MPASS(peer != NULL); 628 629 sc->peercount--; 630 631 ovpn_peer_release_ref(peer, true); 632 633 return (0); 634 } 635 636 static int 637 ovpn_del_peer(struct ifnet *ifp, nvlist_t *nvl) 638 { 639 struct ovpn_softc *sc = ifp->if_softc; 640 uint32_t peerid; 641 int ret; 642 643 OVPN_WASSERT(sc); 644 645 if (nvl == NULL) 646 return (EINVAL); 647 648 if (! nvlist_exists_number(nvl, "peerid")) 649 return (EINVAL); 650 651 peerid = nvlist_get_number(nvl, "peerid"); 652 653 ret = _ovpn_del_peer(sc, peerid); 654 655 return (ret); 656 } 657 658 static int 659 ovpn_create_kkey_dir(struct ovpn_kkey_dir **kdirp, 660 const nvlist_t *nvl) 661 { 662 struct crypto_session_params csp; 663 struct ovpn_kkey_dir *kdir; 664 const char *ciphername; 665 enum ovpn_key_cipher cipher; 666 const void *key, *iv; 667 size_t keylen = 0, ivlen = 0; 668 int error; 669 670 if (! nvlist_exists_string(nvl, "cipher")) 671 return (EINVAL); 672 ciphername = nvlist_get_string(nvl, "cipher"); 673 674 if (strcmp(ciphername, "none") == 0) 675 cipher = OVPN_CIPHER_ALG_NONE; 676 else if (strcmp(ciphername, "AES-256-GCM") == 0 || 677 strcmp(ciphername, "AES-192-GCM") == 0 || 678 strcmp(ciphername, "AES-128-GCM") == 0) 679 cipher = OVPN_CIPHER_ALG_AES_GCM; 680 else if (strcmp(ciphername, "CHACHA20-POLY1305") == 0) 681 cipher = OVPN_CIPHER_ALG_CHACHA20_POLY1305; 682 else 683 return (EINVAL); 684 685 if (cipher != OVPN_CIPHER_ALG_NONE) { 686 if (! nvlist_exists_binary(nvl, "key")) 687 return (EINVAL); 688 key = nvlist_get_binary(nvl, "key", &keylen); 689 if (keylen > sizeof(kdir->key)) 690 return (E2BIG); 691 692 if (! nvlist_exists_binary(nvl, "iv")) 693 return (EINVAL); 694 iv = nvlist_get_binary(nvl, "iv", &ivlen); 695 if (ivlen != 8) 696 return (E2BIG); 697 } 698 699 kdir = malloc(sizeof(struct ovpn_kkey_dir), M_OVPN, 700 M_WAITOK | M_ZERO); 701 702 kdir->cipher = cipher; 703 kdir->keylen = keylen; 704 memcpy(kdir->key, key, keylen); 705 kdir->noncelen = ivlen; 706 memcpy(kdir->nonce, iv, ivlen); 707 708 if (kdir->cipher != OVPN_CIPHER_ALG_NONE) { 709 /* Crypto init */ 710 bzero(&csp, sizeof(csp)); 711 csp.csp_mode = CSP_MODE_AEAD; 712 713 if (kdir->cipher == OVPN_CIPHER_ALG_CHACHA20_POLY1305) 714 csp.csp_cipher_alg = CRYPTO_CHACHA20_POLY1305; 715 else 716 csp.csp_cipher_alg = CRYPTO_AES_NIST_GCM_16; 717 718 csp.csp_flags |= CSP_F_SEPARATE_AAD; 719 720 csp.csp_cipher_klen = kdir->keylen; 721 csp.csp_cipher_key = kdir->key; 722 csp.csp_ivlen = 96 / 8; 723 724 error = crypto_newsession(&kdir->cryptoid, &csp, 725 CRYPTOCAP_F_HARDWARE | CRYPTOCAP_F_SOFTWARE); 726 if (error) { 727 free(kdir, M_OVPN); 728 return (error); 729 } 730 } 731 732 mtx_init(&kdir->replay_mtx, "if_ovpn rx replay", NULL, MTX_DEF); 733 *kdirp = kdir; 734 735 return (0); 736 } 737 738 static void 739 ovpn_free_kkey_dir(struct ovpn_kkey_dir *kdir) 740 { 741 if (kdir == NULL) 742 return; 743 744 mtx_destroy(&kdir->replay_mtx); 745 746 crypto_freesession(kdir->cryptoid); 747 free(kdir, M_OVPN); 748 } 749 750 static int 751 ovpn_set_key(struct ifnet *ifp, const nvlist_t *nvl) 752 { 753 struct ovpn_softc *sc = ifp->if_softc; 754 struct ovpn_kkey_dir *enc, *dec; 755 struct ovpn_kpeer *peer; 756 int slot, keyid, peerid; 757 int error; 758 759 if (nvl == NULL) 760 return (EINVAL); 761 762 if (! nvlist_exists_number(nvl, "slot")) 763 return (EINVAL); 764 slot = nvlist_get_number(nvl, "slot"); 765 766 if (! nvlist_exists_number(nvl, "keyid")) 767 return (EINVAL); 768 keyid = nvlist_get_number(nvl, "keyid"); 769 770 if (! nvlist_exists_number(nvl, "peerid")) 771 return (EINVAL); 772 peerid = nvlist_get_number(nvl, "peerid"); 773 774 if (slot != OVPN_KEY_SLOT_PRIMARY && 775 slot != OVPN_KEY_SLOT_SECONDARY) 776 return (EINVAL); 777 778 if (! nvlist_exists_nvlist(nvl, "encrypt") || 779 ! nvlist_exists_nvlist(nvl, "decrypt")) 780 return (EINVAL); 781 782 error = ovpn_create_kkey_dir(&enc, nvlist_get_nvlist(nvl, "encrypt")); 783 if (error) 784 return (error); 785 786 error = ovpn_create_kkey_dir(&dec, nvlist_get_nvlist(nvl, "decrypt")); 787 if (error) { 788 ovpn_free_kkey_dir(enc); 789 return (error); 790 } 791 792 OVPN_WLOCK(sc); 793 794 peer = ovpn_find_peer(sc, peerid); 795 if (peer == NULL) { 796 ovpn_free_kkey_dir(dec); 797 ovpn_free_kkey_dir(enc); 798 OVPN_WUNLOCK(sc); 799 return (ENOENT); 800 } 801 802 ovpn_free_kkey_dir(peer->keys[slot].encrypt); 803 ovpn_free_kkey_dir(peer->keys[slot].decrypt); 804 805 peer->keys[slot].encrypt = enc; 806 peer->keys[slot].decrypt = dec; 807 808 peer->keys[slot].keyid = keyid; 809 peer->keys[slot].peerid = peerid; 810 811 OVPN_WUNLOCK(sc); 812 813 return (0); 814 } 815 816 static int 817 ovpn_check_key(struct ovpn_softc *sc, struct ovpn_kpeer *peer, enum ovpn_key_slot slot) 818 { 819 OVPN_ASSERT(sc); 820 821 if (peer->keys[slot].encrypt == NULL) 822 return (ENOLINK); 823 824 if (peer->keys[slot].decrypt == NULL) 825 return (ENOLINK); 826 827 return (0); 828 } 829 830 static int 831 ovpn_start(struct ifnet *ifp) 832 { 833 struct ovpn_softc *sc = ifp->if_softc; 834 835 OVPN_WLOCK(sc); 836 837 ifp->if_flags |= IFF_UP; 838 ifp->if_drv_flags |= IFF_DRV_RUNNING; 839 if_link_state_change(ifp, LINK_STATE_UP); 840 841 OVPN_WUNLOCK(sc); 842 843 return (0); 844 } 845 846 static int 847 ovpn_swap_keys(struct ifnet *ifp, nvlist_t *nvl) 848 { 849 struct ovpn_softc *sc = ifp->if_softc; 850 struct ovpn_kpeer *peer; 851 struct ovpn_kkey tmpkey; 852 int error; 853 854 if (nvl == NULL) 855 return (EINVAL); 856 857 if (! nvlist_exists_number(nvl, "peerid")) 858 return (EINVAL); 859 860 OVPN_WLOCK(sc); 861 862 peer = ovpn_find_peer(sc, nvlist_get_number(nvl, "peerid")); 863 if (peer == NULL) { 864 OVPN_WUNLOCK(sc); 865 return (ENOENT); 866 } 867 868 /* Check that we have a second key to swap to. */ 869 error = ovpn_check_key(sc, peer, OVPN_KEY_SLOT_SECONDARY); 870 if (error) { 871 OVPN_WUNLOCK(sc); 872 return (error); 873 } 874 875 tmpkey = peer->keys[0]; 876 peer->keys[0] = peer->keys[1]; 877 peer->keys[1] = tmpkey; 878 879 OVPN_WUNLOCK(sc); 880 881 return (0); 882 } 883 884 static int 885 ovpn_del_key(struct ifnet *ifp, const nvlist_t *nvl) 886 { 887 enum ovpn_key_slot slot; 888 struct ovpn_kpeer *peer; 889 struct ovpn_softc *sc = ifp->if_softc; 890 891 if (nvl == NULL) 892 return (EINVAL); 893 894 if (! nvlist_exists_number(nvl, "peerid")) 895 return (EINVAL); 896 897 if (! nvlist_exists_number(nvl, "slot")) 898 return (EINVAL); 899 slot = nvlist_get_number(nvl, "slot"); 900 901 if (slot != OVPN_KEY_SLOT_PRIMARY && 902 slot != OVPN_KEY_SLOT_SECONDARY) 903 return (EINVAL); 904 905 OVPN_WLOCK(sc); 906 907 peer = ovpn_find_peer(sc, nvlist_get_number(nvl, "peerid")); 908 if (peer == NULL) { 909 OVPN_WUNLOCK(sc); 910 return (ENOENT); 911 } 912 913 ovpn_free_kkey_dir(peer->keys[slot].encrypt); 914 ovpn_free_kkey_dir(peer->keys[slot].decrypt); 915 916 peer->keys[slot].encrypt = NULL; 917 peer->keys[slot].decrypt = NULL; 918 919 peer->keys[slot].keyid = 0; 920 peer->keys[slot].peerid = 0; 921 922 OVPN_WUNLOCK(sc); 923 924 return (0); 925 } 926 927 static int 928 ovpn_send_pkt(struct ifnet *ifp, const nvlist_t *nvl) 929 { 930 struct epoch_tracker et; 931 struct ovpn_softc *sc = ifp->if_softc; 932 struct mbuf *m; 933 const uint8_t *pkt; 934 size_t pktlen; 935 uint32_t peerid; 936 int ret; 937 938 if (nvl == NULL) 939 return (EINVAL); 940 941 if (! nvlist_exists_binary(nvl, "packet")) 942 return (EINVAL); 943 pkt = nvlist_get_binary(nvl, "packet", &pktlen); 944 945 if (! nvlist_exists_number(nvl, "peerid")) 946 return (EINVAL); 947 948 peerid = nvlist_get_number(nvl, "peerid"); 949 950 /* 951 * Check that userspace isn't giving us a data packet. That might lead 952 * to IV re-use, which would be bad. 953 */ 954 if ((pkt[0] >> OVPN_OP_SHIFT) == OVPN_OP_DATA_V2) 955 return (EINVAL); 956 957 m = m_get2(pktlen, M_WAITOK, MT_DATA, M_PKTHDR); 958 if (m == NULL) 959 return (ENOMEM); 960 961 m->m_len = m->m_pkthdr.len = pktlen; 962 m_copyback(m, 0, m->m_len, pkt); 963 964 /* Now prepend IP/UDP headers and transmit the mbuf. */ 965 NET_EPOCH_ENTER(et); 966 ret = ovpn_encap(sc, peerid, m); 967 NET_EPOCH_EXIT(et); 968 if (ret == 0) 969 OVPN_COUNTER_ADD(sc, sent_ctrl_pkts, 1); 970 else 971 OVPN_COUNTER_ADD(sc, lost_ctrl_pkts_out, 1); 972 973 return (ret); 974 } 975 976 static void 977 ovpn_send_ping(void *arg) 978 { 979 static const uint8_t ping_str[] = { 980 0x2a, 0x18, 0x7b, 0xf3, 0x64, 0x1e, 0xb4, 0xcb, 981 0x07, 0xed, 0x2d, 0x0a, 0x98, 0x1f, 0xc7, 0x48 982 }; 983 984 struct epoch_tracker et; 985 struct ovpn_kpeer *peer = arg; 986 struct ovpn_softc *sc = peer->sc; 987 struct mbuf *m; 988 989 OVPN_RASSERT(sc); 990 991 /* Ensure we repeat! */ 992 callout_reset(&peer->ping_send, peer->keepalive.interval * hz, 993 ovpn_send_ping, peer); 994 995 m = m_get2(sizeof(ping_str), M_NOWAIT, MT_DATA, M_PKTHDR); 996 if (m == NULL) 997 return; 998 999 m_copyback(m, 0, sizeof(ping_str), ping_str); 1000 m->m_len = m->m_pkthdr.len = sizeof(ping_str); 1001 1002 CURVNET_SET(sc->ifp->if_vnet); 1003 NET_EPOCH_ENTER(et); 1004 (void)ovpn_transmit_to_peer(sc->ifp, m, peer, NULL); 1005 NET_EPOCH_EXIT(et); 1006 CURVNET_RESTORE(); 1007 } 1008 1009 static void 1010 ovpn_timeout(void *arg) 1011 { 1012 struct ovpn_kpeer *peer = arg; 1013 struct ovpn_softc *sc = peer->sc; 1014 uint32_t last, _last_active; 1015 int ret __diagused; 1016 int cpu; 1017 1018 OVPN_WASSERT(sc); 1019 1020 last = 0; 1021 CPU_FOREACH(cpu) { 1022 _last_active = *zpcpu_get_cpu(peer->last_active, cpu); 1023 if (_last_active > last) 1024 last = _last_active; 1025 } 1026 1027 if (last + peer->keepalive.timeout > time_uptime) { 1028 callout_reset(&peer->ping_rcv, 1029 (peer->keepalive.timeout - (time_uptime - last)) * hz, 1030 ovpn_timeout, peer); 1031 return; 1032 } 1033 1034 CURVNET_SET(sc->ifp->if_vnet); 1035 ret = _ovpn_del_peer(sc, peer->peerid); 1036 MPASS(ret == 0); 1037 CURVNET_RESTORE(); 1038 } 1039 1040 static int 1041 ovpn_set_peer(struct ifnet *ifp, const nvlist_t *nvl) 1042 { 1043 struct ovpn_softc *sc = ifp->if_softc; 1044 struct ovpn_kpeer *peer; 1045 1046 if (nvl == NULL) 1047 return (EINVAL); 1048 1049 if (! nvlist_exists_number(nvl, "interval") || 1050 ! nvlist_exists_number(nvl, "timeout") || 1051 ! nvlist_exists_number(nvl, "peerid")) 1052 return (EINVAL); 1053 1054 OVPN_WLOCK(sc); 1055 1056 peer = ovpn_find_peer(sc, nvlist_get_number(nvl, "peerid")); 1057 if (peer == NULL) { 1058 OVPN_WUNLOCK(sc); 1059 return (ENOENT); 1060 } 1061 1062 peer->keepalive.interval = nvlist_get_number(nvl, "interval"); 1063 peer->keepalive.timeout = nvlist_get_number(nvl, "timeout"); 1064 1065 if (peer->keepalive.interval > 0) 1066 callout_reset(&peer->ping_send, peer->keepalive.interval * hz, 1067 ovpn_send_ping, peer); 1068 if (peer->keepalive.timeout > 0) 1069 callout_reset(&peer->ping_rcv, peer->keepalive.timeout * hz, 1070 ovpn_timeout, peer); 1071 1072 OVPN_WUNLOCK(sc); 1073 1074 return (0); 1075 } 1076 1077 static int 1078 ovpn_set_ifmode(struct ifnet *ifp, const nvlist_t *nvl) 1079 { 1080 struct ovpn_softc *sc = ifp->if_softc; 1081 int ifmode; 1082 1083 if (nvl == NULL) 1084 return (EINVAL); 1085 1086 if (! nvlist_exists_number(nvl, "ifmode") ) 1087 return (EINVAL); 1088 1089 ifmode = nvlist_get_number(nvl, "ifmode"); 1090 1091 OVPN_WLOCK(sc); 1092 1093 /* deny this if UP */ 1094 if (ifp->if_flags & IFF_UP) { 1095 OVPN_WUNLOCK(sc); 1096 return (EBUSY); 1097 } 1098 1099 switch (ifmode & ~IFF_MULTICAST) { 1100 case IFF_POINTOPOINT: 1101 case IFF_BROADCAST: 1102 ifp->if_flags &= 1103 ~(IFF_BROADCAST|IFF_POINTOPOINT|IFF_MULTICAST); 1104 ifp->if_flags |= ifmode; 1105 break; 1106 default: 1107 OVPN_WUNLOCK(sc); 1108 return (EINVAL); 1109 } 1110 1111 OVPN_WUNLOCK(sc); 1112 1113 return (0); 1114 } 1115 1116 static int 1117 ovpn_ioctl_set(struct ifnet *ifp, struct ifdrv *ifd) 1118 { 1119 struct ovpn_softc *sc = ifp->if_softc; 1120 uint8_t *buf = NULL; 1121 nvlist_t *nvl = NULL; 1122 int ret; 1123 1124 if (ifd->ifd_len != 0) { 1125 if (ifd->ifd_len > OVPN_MAX_REQUEST_SIZE) 1126 return (E2BIG); 1127 1128 buf = malloc(ifd->ifd_len, M_OVPN, M_WAITOK); 1129 1130 ret = copyin(ifd->ifd_data, buf, ifd->ifd_len); 1131 if (ret != 0) { 1132 free(buf, M_OVPN); 1133 return (ret); 1134 } 1135 1136 nvl = nvlist_unpack(buf, ifd->ifd_len, 0); 1137 free(buf, M_OVPN); 1138 if (nvl == NULL) { 1139 return (EINVAL); 1140 } 1141 } 1142 1143 switch (ifd->ifd_cmd) { 1144 case OVPN_NEW_PEER: 1145 ret = ovpn_new_peer(ifp, nvl); 1146 break; 1147 case OVPN_DEL_PEER: 1148 OVPN_WLOCK(sc); 1149 ret = ovpn_del_peer(ifp, nvl); 1150 OVPN_WUNLOCK(sc); 1151 break; 1152 case OVPN_NEW_KEY: 1153 ret = ovpn_set_key(ifp, nvl); 1154 break; 1155 case OVPN_START_VPN: 1156 ret = ovpn_start(ifp); 1157 break; 1158 case OVPN_SWAP_KEYS: 1159 ret = ovpn_swap_keys(ifp, nvl); 1160 break; 1161 case OVPN_DEL_KEY: 1162 ret = ovpn_del_key(ifp, nvl); 1163 break; 1164 case OVPN_SEND_PKT: 1165 ret = ovpn_send_pkt(ifp, nvl); 1166 break; 1167 case OVPN_SET_PEER: 1168 ret = ovpn_set_peer(ifp, nvl); 1169 break; 1170 case OVPN_SET_IFMODE: 1171 ret = ovpn_set_ifmode(ifp, nvl); 1172 break; 1173 default: 1174 ret = ENOTSUP; 1175 } 1176 1177 nvlist_destroy(nvl); 1178 return (ret); 1179 } 1180 1181 static int 1182 ovpn_add_counters(nvlist_t *parent, const char *name, counter_u64_t in, 1183 counter_u64_t out) 1184 { 1185 nvlist_t *nvl; 1186 1187 nvl = nvlist_create(0); 1188 if (nvl == NULL) 1189 return (ENOMEM); 1190 1191 nvlist_add_number(nvl, "in", counter_u64_fetch(in)); 1192 nvlist_add_number(nvl, "out", counter_u64_fetch(out)); 1193 1194 nvlist_add_nvlist(parent, name, nvl); 1195 1196 nvlist_destroy(nvl); 1197 1198 return (0); 1199 } 1200 1201 static int 1202 ovpn_get_stats(struct ovpn_softc *sc, nvlist_t **onvl) 1203 { 1204 nvlist_t *nvl; 1205 int ret; 1206 1207 nvl = nvlist_create(0); 1208 if (nvl == NULL) 1209 return (ENOMEM); 1210 1211 #define OVPN_COUNTER_OUT(name, in, out) \ 1212 do { \ 1213 ret = ovpn_add_counters(nvl, name, \ 1214 sc->counters[offsetof(struct ovpn_counters, in) / \ 1215 sizeof(uint64_t)], \ 1216 sc->counters[offsetof(struct ovpn_counters, out) / \ 1217 sizeof(uint64_t)]); \ 1218 if (ret != 0) \ 1219 goto error; \ 1220 } while(0) 1221 1222 OVPN_COUNTER_OUT("lost_ctrl", lost_ctrl_pkts_in, lost_ctrl_pkts_out); 1223 OVPN_COUNTER_OUT("lost_data", lost_data_pkts_in, lost_data_pkts_out); 1224 OVPN_COUNTER_OUT("nomem_data", nomem_data_pkts_in, 1225 nomem_data_pkts_out); 1226 OVPN_COUNTER_OUT("data", received_data_pkts, sent_data_pkts); 1227 OVPN_COUNTER_OUT("ctrl", received_ctrl_pkts, sent_ctrl_pkts); 1228 OVPN_COUNTER_OUT("tunnel", tunnel_bytes_received, 1229 tunnel_bytes_received); 1230 OVPN_COUNTER_OUT("transport", transport_bytes_received, 1231 transport_bytes_received); 1232 #undef OVPN_COUNTER_OUT 1233 1234 *onvl = nvl; 1235 1236 return (0); 1237 1238 error: 1239 nvlist_destroy(nvl); 1240 return (ret); 1241 } 1242 1243 static int 1244 ovpn_poll_pkt(struct ovpn_softc *sc, nvlist_t **onvl) 1245 { 1246 nvlist_t *nvl; 1247 1248 nvl = nvlist_create(0); 1249 if (nvl == NULL) 1250 return (ENOMEM); 1251 1252 nvlist_add_number(nvl, "pending", buf_ring_count(sc->notifring)); 1253 1254 *onvl = nvl; 1255 1256 return (0); 1257 } 1258 1259 static int 1260 opvn_get_pkt(struct ovpn_softc *sc, nvlist_t **onvl) 1261 { 1262 struct ovpn_notification *n; 1263 nvlist_t *nvl; 1264 1265 /* Check if we have notifications pending. */ 1266 n = buf_ring_dequeue_mc(sc->notifring); 1267 if (n == NULL) 1268 return (ENOENT); 1269 1270 nvl = nvlist_create(0); 1271 if (nvl == NULL) { 1272 free(n, M_OVPN); 1273 return (ENOMEM); 1274 } 1275 nvlist_add_number(nvl, "peerid", n->peerid); 1276 nvlist_add_number(nvl, "notification", n->type); 1277 free(n, M_OVPN); 1278 1279 *onvl = nvl; 1280 1281 return (0); 1282 } 1283 1284 static int 1285 ovpn_ioctl_get(struct ifnet *ifp, struct ifdrv *ifd) 1286 { 1287 struct ovpn_softc *sc = ifp->if_softc; 1288 nvlist_t *nvl = NULL; 1289 int error; 1290 1291 switch (ifd->ifd_cmd) { 1292 case OVPN_GET_STATS: 1293 error = ovpn_get_stats(sc, &nvl); 1294 break; 1295 case OVPN_POLL_PKT: 1296 error = ovpn_poll_pkt(sc, &nvl); 1297 break; 1298 case OVPN_GET_PKT: 1299 error = opvn_get_pkt(sc, &nvl); 1300 break; 1301 default: 1302 error = ENOTSUP; 1303 break; 1304 } 1305 1306 if (error == 0) { 1307 void *packed = NULL; 1308 size_t len; 1309 1310 MPASS(nvl != NULL); 1311 1312 packed = nvlist_pack(nvl, &len); 1313 if (! packed) { 1314 nvlist_destroy(nvl); 1315 return (ENOMEM); 1316 } 1317 1318 if (len > ifd->ifd_len) { 1319 free(packed, M_NVLIST); 1320 nvlist_destroy(nvl); 1321 return (ENOSPC); 1322 } 1323 1324 error = copyout(packed, ifd->ifd_data, len); 1325 ifd->ifd_len = len; 1326 1327 free(packed, M_NVLIST); 1328 nvlist_destroy(nvl); 1329 } 1330 1331 return (error); 1332 } 1333 1334 static int 1335 ovpn_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data) 1336 { 1337 struct ifdrv *ifd; 1338 int error; 1339 1340 CURVNET_ASSERT_SET(); 1341 1342 switch (cmd) { 1343 case SIOCSDRVSPEC: 1344 case SIOCGDRVSPEC: 1345 error = priv_check(curthread, PRIV_NET_OVPN); 1346 if (error) 1347 return (error); 1348 break; 1349 } 1350 1351 switch (cmd) { 1352 case SIOCSDRVSPEC: 1353 ifd = (struct ifdrv *)data; 1354 error = ovpn_ioctl_set(ifp, ifd); 1355 break; 1356 case SIOCGDRVSPEC: 1357 ifd = (struct ifdrv *)data; 1358 error = ovpn_ioctl_get(ifp, ifd); 1359 break; 1360 case SIOCSIFMTU: { 1361 struct ifreq *ifr = (struct ifreq *)data; 1362 if (ifr->ifr_mtu < OVPN_MTU_MIN || ifr->ifr_mtu > OVPN_MTU_MAX) 1363 return (EINVAL); 1364 1365 ifp->if_mtu = ifr->ifr_mtu; 1366 return (0); 1367 } 1368 case SIOCSIFADDR: 1369 case SIOCADDMULTI: 1370 case SIOCDELMULTI: 1371 case SIOCGIFMTU: 1372 case SIOCSIFFLAGS: 1373 return (0); 1374 default: 1375 error = EINVAL; 1376 } 1377 1378 return (error); 1379 } 1380 1381 static int 1382 ovpn_encrypt_tx_cb(struct cryptop *crp) 1383 { 1384 struct epoch_tracker et; 1385 struct ovpn_kpeer *peer = crp->crp_opaque; 1386 struct ovpn_softc *sc = peer->sc; 1387 struct mbuf *m = crp->crp_buf.cb_mbuf; 1388 int tunnel_len; 1389 int ret; 1390 1391 CURVNET_SET(sc->ifp->if_vnet); 1392 NET_EPOCH_ENTER(et); 1393 1394 if (crp->crp_etype != 0) { 1395 crypto_freereq(crp); 1396 ovpn_peer_release_ref(peer, false); 1397 NET_EPOCH_EXIT(et); 1398 CURVNET_RESTORE(); 1399 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1); 1400 m_freem(m); 1401 return (0); 1402 } 1403 1404 MPASS(crp->crp_buf.cb_type == CRYPTO_BUF_MBUF); 1405 1406 tunnel_len = m->m_pkthdr.len - sizeof(struct ovpn_wire_header); 1407 ret = ovpn_encap(sc, peer->peerid, m); 1408 if (ret == 0) { 1409 OVPN_COUNTER_ADD(sc, sent_data_pkts, 1); 1410 OVPN_COUNTER_ADD(sc, tunnel_bytes_sent, tunnel_len); 1411 } 1412 1413 crypto_freereq(crp); 1414 ovpn_peer_release_ref(peer, false); 1415 1416 NET_EPOCH_EXIT(et); 1417 CURVNET_RESTORE(); 1418 1419 return (0); 1420 } 1421 1422 static void 1423 ovpn_finish_rx(struct ovpn_softc *sc, struct mbuf *m, 1424 struct ovpn_kpeer *peer, struct ovpn_kkey *key, uint32_t seq, 1425 struct rm_priotracker *_ovpn_lock_trackerp) 1426 { 1427 uint32_t af; 1428 1429 OVPN_RASSERT(sc); 1430 NET_EPOCH_ASSERT(); 1431 1432 /* Replay protection. */ 1433 if (V_replay_protection && ! ovpn_check_replay(key->decrypt, seq)) { 1434 OVPN_RUNLOCK(sc); 1435 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1); 1436 m_freem(m); 1437 return; 1438 } 1439 1440 critical_enter(); 1441 *zpcpu_get(peer->last_active) = time_uptime; 1442 critical_exit(); 1443 1444 OVPN_RUNLOCK(sc); 1445 1446 OVPN_COUNTER_ADD(sc, received_data_pkts, 1); 1447 OVPN_COUNTER_ADD(sc, tunnel_bytes_received, m->m_pkthdr.len); 1448 1449 /* Receive the packet on our interface. */ 1450 m->m_pkthdr.rcvif = sc->ifp; 1451 1452 /* Clear checksum flags in case the real hardware set them. */ 1453 m->m_pkthdr.csum_flags = 0; 1454 1455 /* Ensure we can read the first byte. */ 1456 m = m_pullup(m, 1); 1457 if (m == NULL) { 1458 OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1); 1459 return; 1460 } 1461 1462 /* 1463 * Check for address family, and disregard any control packets (e.g. 1464 * keepalive). 1465 */ 1466 af = ovpn_get_af(m); 1467 if (af != 0) { 1468 BPF_MTAP2(sc->ifp, &af, sizeof(af), m); 1469 if (V_async_netisr_queue) 1470 netisr_queue(af == AF_INET ? NETISR_IP : NETISR_IPV6, m); 1471 else 1472 netisr_dispatch(af == AF_INET ? NETISR_IP : NETISR_IPV6, m); 1473 } else { 1474 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1); 1475 m_freem(m); 1476 } 1477 } 1478 1479 static struct ovpn_kkey * 1480 ovpn_find_key(struct ovpn_softc *sc, struct ovpn_kpeer *peer, 1481 const struct ovpn_wire_header *ohdr) 1482 { 1483 struct ovpn_kkey *key = NULL; 1484 uint8_t keyid; 1485 1486 OVPN_RASSERT(sc); 1487 1488 keyid = (ntohl(ohdr->opcode) >> 24) & 0x07; 1489 1490 if (peer->keys[0].keyid == keyid) 1491 key = &peer->keys[0]; 1492 else if (peer->keys[1].keyid == keyid) 1493 key = &peer->keys[1]; 1494 1495 return (key); 1496 } 1497 1498 static int 1499 ovpn_decrypt_rx_cb(struct cryptop *crp) 1500 { 1501 struct epoch_tracker et; 1502 struct ovpn_softc *sc = crp->crp_opaque; 1503 struct mbuf *m = crp->crp_buf.cb_mbuf; 1504 struct ovpn_kkey *key; 1505 struct ovpn_kpeer *peer; 1506 struct ovpn_wire_header *ohdr; 1507 uint32_t peerid; 1508 1509 OVPN_RLOCK_TRACKER; 1510 1511 OVPN_RLOCK(sc); 1512 1513 MPASS(crp->crp_buf.cb_type == CRYPTO_BUF_MBUF); 1514 1515 if (crp->crp_etype != 0) { 1516 crypto_freereq(crp); 1517 atomic_add_int(&sc->refcount, -1); 1518 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1); 1519 OVPN_RUNLOCK(sc); 1520 m_freem(m); 1521 return (0); 1522 } 1523 1524 CURVNET_SET(sc->ifp->if_vnet); 1525 1526 ohdr = mtodo(m, sizeof(struct udphdr)); 1527 1528 peerid = ntohl(ohdr->opcode) & 0x00ffffff; 1529 peer = ovpn_find_peer(sc, peerid); 1530 if (peer == NULL) { 1531 /* No such peer. Drop packet. */ 1532 crypto_freereq(crp); 1533 atomic_add_int(&sc->refcount, -1); 1534 OVPN_RUNLOCK(sc); 1535 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1); 1536 m_freem(m); 1537 CURVNET_RESTORE(); 1538 return (0); 1539 } 1540 1541 key = ovpn_find_key(sc, peer, ohdr); 1542 if (key == NULL) { 1543 crypto_freereq(crp); 1544 atomic_add_int(&sc->refcount, -1); 1545 /* 1546 * Has this key been removed between us starting the decrypt 1547 * and finishing it? 1548 */ 1549 OVPN_RUNLOCK(sc); 1550 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1); 1551 m_freem(m); 1552 CURVNET_RESTORE(); 1553 return (0); 1554 } 1555 1556 /* Now remove the outer headers */ 1557 m_adj_decap(m, sizeof(struct udphdr) + 1558 sizeof(struct ovpn_wire_header)); 1559 1560 NET_EPOCH_ENTER(et); 1561 ovpn_finish_rx(sc, m, peer, key, ntohl(ohdr->seq), _ovpn_lock_trackerp); 1562 NET_EPOCH_EXIT(et); 1563 OVPN_UNLOCK_ASSERT(sc); 1564 1565 CURVNET_RESTORE(); 1566 1567 crypto_freereq(crp); 1568 atomic_add_int(&sc->refcount, -1); 1569 1570 return (0); 1571 } 1572 1573 static int 1574 ovpn_get_af(struct mbuf *m) 1575 { 1576 struct ip *ip; 1577 struct ip6_hdr *ip6; 1578 1579 /* 1580 * We should pullup, but we're only interested in the first byte, so 1581 * that'll always be contiguous. 1582 */ 1583 ip = mtod(m, struct ip *); 1584 if (ip->ip_v == IPVERSION) 1585 return (AF_INET); 1586 1587 ip6 = mtod(m, struct ip6_hdr *); 1588 if ((ip6->ip6_vfc & IPV6_VERSION_MASK) == IPV6_VERSION) 1589 return (AF_INET6); 1590 1591 return (0); 1592 } 1593 1594 #ifdef INET 1595 static struct ovpn_kpeer * 1596 ovpn_find_peer_by_ip(struct ovpn_softc *sc, const struct in_addr addr) 1597 { 1598 struct ovpn_kpeer *peer = NULL; 1599 1600 OVPN_ASSERT(sc); 1601 1602 /* TODO: Add a second RB so we can look up by IP. */ 1603 RB_FOREACH(peer, ovpn_kpeers, &sc->peers) { 1604 if (addr.s_addr == peer->vpn4.s_addr) 1605 return (peer); 1606 } 1607 1608 return (peer); 1609 } 1610 #endif 1611 1612 #ifdef INET6 1613 static struct ovpn_kpeer * 1614 ovpn_find_peer_by_ip6(struct ovpn_softc *sc, const struct in6_addr *addr) 1615 { 1616 struct ovpn_kpeer *peer = NULL; 1617 1618 OVPN_ASSERT(sc); 1619 1620 /* TODO: Add a third RB so we can look up by IPv6 address. */ 1621 RB_FOREACH(peer, ovpn_kpeers, &sc->peers) { 1622 if (memcmp(addr, &peer->vpn6, sizeof(*addr)) == 0) 1623 return (peer); 1624 } 1625 1626 return (peer); 1627 } 1628 #endif 1629 1630 static struct ovpn_kpeer * 1631 ovpn_route_peer(struct ovpn_softc *sc, struct mbuf **m0, 1632 const struct sockaddr *dst) 1633 { 1634 struct ovpn_kpeer *peer = NULL; 1635 int af; 1636 1637 NET_EPOCH_ASSERT(); 1638 OVPN_ASSERT(sc); 1639 1640 /* Shortcut if we're a client (or are a server and have only one client). */ 1641 if (sc->peercount == 1) 1642 return (ovpn_find_only_peer(sc)); 1643 1644 if (dst != NULL) 1645 af = dst->sa_family; 1646 else 1647 af = ovpn_get_af(*m0); 1648 1649 switch (af) { 1650 #ifdef INET 1651 case AF_INET: { 1652 const struct sockaddr_in *sa = (const struct sockaddr_in *)dst; 1653 struct nhop_object *nh; 1654 const struct in_addr *ip_dst; 1655 1656 if (sa != NULL) { 1657 ip_dst = &sa->sin_addr; 1658 } else { 1659 struct ip *ip; 1660 1661 *m0 = m_pullup(*m0, sizeof(struct ip)); 1662 if (*m0 == NULL) 1663 return (NULL); 1664 ip = mtod(*m0, struct ip *); 1665 ip_dst = &ip->ip_dst; 1666 } 1667 1668 peer = ovpn_find_peer_by_ip(sc, *ip_dst); 1669 SDT_PROBE2(if_ovpn, tx, route, ip4, ip_dst, peer); 1670 if (peer == NULL) { 1671 nh = fib4_lookup(M_GETFIB(*m0), *ip_dst, 0, 1672 NHR_NONE, 0); 1673 if (nh && (nh->nh_flags & NHF_GATEWAY)) { 1674 peer = ovpn_find_peer_by_ip(sc, 1675 nh->gw4_sa.sin_addr); 1676 SDT_PROBE2(if_ovpn, tx, route, ip4, 1677 &nh->gw4_sa.sin_addr, peer); 1678 } 1679 } 1680 break; 1681 } 1682 #endif 1683 #ifdef INET6 1684 case AF_INET6: { 1685 const struct sockaddr_in6 *sa6 = 1686 (const struct sockaddr_in6 *)dst; 1687 struct nhop_object *nh; 1688 const struct in6_addr *ip6_dst; 1689 1690 if (sa6 != NULL) { 1691 ip6_dst = &sa6->sin6_addr; 1692 } else { 1693 struct ip6_hdr *ip6; 1694 1695 *m0 = m_pullup(*m0, sizeof(struct ip6_hdr)); 1696 if (*m0 == NULL) 1697 return (NULL); 1698 ip6 = mtod(*m0, struct ip6_hdr *); 1699 ip6_dst = &ip6->ip6_dst; 1700 } 1701 1702 peer = ovpn_find_peer_by_ip6(sc, ip6_dst); 1703 SDT_PROBE2(if_ovpn, tx, route, ip6, ip6_dst, peer); 1704 if (peer == NULL) { 1705 nh = fib6_lookup(M_GETFIB(*m0), ip6_dst, 0, 1706 NHR_NONE, 0); 1707 if (nh && (nh->nh_flags & NHF_GATEWAY)) { 1708 peer = ovpn_find_peer_by_ip6(sc, 1709 &nh->gw6_sa.sin6_addr); 1710 SDT_PROBE2(if_ovpn, tx, route, ip6, 1711 &nh->gw6_sa.sin6_addr, peer); 1712 } 1713 } 1714 break; 1715 } 1716 #endif 1717 } 1718 1719 return (peer); 1720 } 1721 1722 static int 1723 ovpn_transmit(struct ifnet *ifp, struct mbuf *m) 1724 { 1725 return (ifp->if_output(ifp, m, NULL, NULL)); 1726 } 1727 1728 static int 1729 ovpn_transmit_to_peer(struct ifnet *ifp, struct mbuf *m, 1730 struct ovpn_kpeer *peer, struct rm_priotracker *_ovpn_lock_trackerp) 1731 { 1732 struct ovpn_wire_header *ohdr; 1733 struct ovpn_kkey *key; 1734 struct ovpn_softc *sc; 1735 struct cryptop *crp; 1736 uint32_t af, seq; 1737 size_t len, ovpn_hdr_len; 1738 int tunnel_len; 1739 int ret; 1740 1741 sc = ifp->if_softc; 1742 1743 OVPN_RASSERT(sc); 1744 1745 tunnel_len = m->m_pkthdr.len; 1746 1747 key = &peer->keys[OVPN_KEY_SLOT_PRIMARY]; 1748 if (key->encrypt == NULL) { 1749 if (_ovpn_lock_trackerp != NULL) 1750 OVPN_RUNLOCK(sc); 1751 m_freem(m); 1752 return (ENOLINK); 1753 } 1754 1755 af = ovpn_get_af(m); 1756 /* Don't capture control packets. */ 1757 if (af != 0) 1758 BPF_MTAP2(ifp, &af, sizeof(af), m); 1759 1760 len = m->m_pkthdr.len; 1761 MPASS(len <= ifp->if_mtu); 1762 1763 ovpn_hdr_len = sizeof(struct ovpn_wire_header); 1764 if (key->encrypt->cipher == OVPN_CIPHER_ALG_NONE) 1765 ovpn_hdr_len -= 16; /* No auth tag. */ 1766 1767 M_PREPEND(m, ovpn_hdr_len, M_NOWAIT); 1768 if (m == NULL) { 1769 if (_ovpn_lock_trackerp != NULL) 1770 OVPN_RUNLOCK(sc); 1771 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1); 1772 return (ENOBUFS); 1773 } 1774 ohdr = mtod(m, struct ovpn_wire_header *); 1775 ohdr->opcode = (OVPN_OP_DATA_V2 << OVPN_OP_SHIFT) | key->keyid; 1776 ohdr->opcode <<= 24; 1777 ohdr->opcode |= key->peerid; 1778 ohdr->opcode = htonl(ohdr->opcode); 1779 1780 seq = atomic_fetchadd_32(&peer->tx_seq, 1); 1781 seq = htonl(seq); 1782 ohdr->seq = seq; 1783 1784 if (key->encrypt->cipher == OVPN_CIPHER_ALG_NONE) { 1785 ret = ovpn_encap(sc, peer->peerid, m); 1786 if (_ovpn_lock_trackerp != NULL) 1787 OVPN_RUNLOCK(sc); 1788 if (ret == 0) { 1789 OVPN_COUNTER_ADD(sc, sent_data_pkts, 1); 1790 OVPN_COUNTER_ADD(sc, tunnel_bytes_sent, tunnel_len); 1791 } 1792 return (ret); 1793 } 1794 1795 crp = crypto_getreq(key->encrypt->cryptoid, M_NOWAIT); 1796 if (crp == NULL) { 1797 if (_ovpn_lock_trackerp != NULL) 1798 OVPN_RUNLOCK(sc); 1799 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1); 1800 m_freem(m); 1801 return (ENOBUFS); 1802 } 1803 1804 /* Encryption covers only the payload, not the header. */ 1805 crp->crp_payload_start = sizeof(*ohdr); 1806 crp->crp_payload_length = len; 1807 crp->crp_op = CRYPTO_OP_ENCRYPT; 1808 1809 /* 1810 * AAD data covers the ovpn_wire_header minus the auth 1811 * tag. 1812 */ 1813 crp->crp_aad_length = sizeof(*ohdr) - sizeof(ohdr->auth_tag); 1814 crp->crp_aad = ohdr; 1815 crp->crp_aad_start = 0; 1816 crp->crp_op |= CRYPTO_OP_COMPUTE_DIGEST; 1817 crp->crp_digest_start = offsetof(struct ovpn_wire_header, auth_tag); 1818 1819 crp->crp_flags |= CRYPTO_F_IV_SEPARATE; 1820 memcpy(crp->crp_iv, &seq, sizeof(seq)); 1821 memcpy(crp->crp_iv + sizeof(seq), key->encrypt->nonce, 1822 key->encrypt->noncelen); 1823 1824 crypto_use_mbuf(crp, m); 1825 crp->crp_flags |= CRYPTO_F_CBIFSYNC; 1826 crp->crp_callback = ovpn_encrypt_tx_cb; 1827 crp->crp_opaque = peer; 1828 1829 atomic_add_int(&peer->refcount, 1); 1830 if (_ovpn_lock_trackerp != NULL) 1831 OVPN_RUNLOCK(sc); 1832 if (V_async_crypto) 1833 ret = crypto_dispatch_async(crp, CRYPTO_ASYNC_ORDERED); 1834 else 1835 ret = crypto_dispatch(crp); 1836 if (ret) { 1837 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1); 1838 } 1839 1840 return (ret); 1841 } 1842 1843 /* 1844 * Note: Expects to hold the read lock on entry, and will release it itself. 1845 */ 1846 static int 1847 ovpn_encap(struct ovpn_softc *sc, uint32_t peerid, struct mbuf *m) 1848 { 1849 struct udphdr *udp; 1850 struct ovpn_kpeer *peer; 1851 int len; 1852 1853 OVPN_RLOCK_TRACKER; 1854 1855 OVPN_RLOCK(sc); 1856 NET_EPOCH_ASSERT(); 1857 1858 peer = ovpn_find_peer(sc, peerid); 1859 if (peer == NULL || sc->ifp->if_link_state != LINK_STATE_UP) { 1860 OVPN_RUNLOCK(sc); 1861 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1); 1862 m_freem(m); 1863 return (ENETDOWN); 1864 } 1865 1866 len = m->m_pkthdr.len; 1867 1868 M_PREPEND(m, sizeof(struct udphdr), M_NOWAIT); 1869 if (m == NULL) { 1870 OVPN_RUNLOCK(sc); 1871 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1); 1872 m_freem(m); 1873 return (ENOBUFS); 1874 } 1875 udp = mtod(m, struct udphdr *); 1876 1877 MPASS(peer->local.ss_family == peer->remote.ss_family); 1878 1879 udp->uh_sport = ovpn_get_port(&peer->local); 1880 udp->uh_dport = ovpn_get_port(&peer->remote); 1881 udp->uh_ulen = htons(sizeof(struct udphdr) + len); 1882 1883 switch (peer->remote.ss_family) { 1884 #ifdef INET 1885 case AF_INET: { 1886 struct sockaddr_in *in_local = TO_IN(&peer->local); 1887 struct sockaddr_in *in_remote = TO_IN(&peer->remote); 1888 struct ip *ip; 1889 1890 /* 1891 * This requires knowing the source IP, which we don't. Happily 1892 * we're allowed to keep this at 0, and the checksum won't do 1893 * anything the crypto won't already do. 1894 */ 1895 udp->uh_sum = 0; 1896 1897 /* Set the checksum flags so we recalculate checksums. */ 1898 m->m_pkthdr.csum_flags |= CSUM_IP; 1899 m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum); 1900 1901 M_PREPEND(m, sizeof(struct ip), M_NOWAIT); 1902 if (m == NULL) { 1903 OVPN_RUNLOCK(sc); 1904 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1); 1905 return (ENOBUFS); 1906 } 1907 ip = mtod(m, struct ip *); 1908 1909 ip->ip_tos = 0; 1910 ip->ip_len = htons(sizeof(struct ip) + sizeof(struct udphdr) + 1911 len); 1912 ip->ip_off = 0; 1913 ip->ip_ttl = V_ip_defttl; 1914 ip->ip_p = IPPROTO_UDP; 1915 ip->ip_sum = 0; 1916 if (in_local->sin_port != 0) 1917 ip->ip_src = in_local->sin_addr; 1918 else 1919 ip->ip_src.s_addr = INADDR_ANY; 1920 ip->ip_dst = in_remote->sin_addr; 1921 1922 OVPN_RUNLOCK(sc); 1923 OVPN_COUNTER_ADD(sc, transport_bytes_sent, m->m_pkthdr.len); 1924 1925 return (ip_output(m, NULL, NULL, 0, NULL, NULL)); 1926 } 1927 #endif 1928 #ifdef INET6 1929 case AF_INET6: { 1930 struct sockaddr_in6 *in6_local = TO_IN6(&peer->local); 1931 struct sockaddr_in6 *in6_remote = TO_IN6(&peer->remote); 1932 struct ip6_hdr *ip6; 1933 1934 M_PREPEND(m, sizeof(struct ip6_hdr), M_NOWAIT); 1935 if (m == NULL) { 1936 OVPN_RUNLOCK(sc); 1937 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1); 1938 return (ENOBUFS); 1939 } 1940 m = m_pullup(m, sizeof(*ip6) + sizeof(*udp)); 1941 if (m == NULL) { 1942 OVPN_RUNLOCK(sc); 1943 OVPN_COUNTER_ADD(sc, nomem_data_pkts_out, 1); 1944 return (ENOBUFS); 1945 } 1946 1947 ip6 = mtod(m, struct ip6_hdr *); 1948 1949 ip6->ip6_vfc = IPV6_VERSION; 1950 ip6->ip6_flow &= ~IPV6_FLOWINFO_MASK; 1951 ip6->ip6_plen = htons(sizeof(*ip6) + sizeof(struct udphdr) + 1952 len); 1953 ip6->ip6_nxt = IPPROTO_UDP; 1954 ip6->ip6_hlim = V_ip6_defhlim; 1955 1956 memcpy(&ip6->ip6_src, &in6_local->sin6_addr, 1957 sizeof(ip6->ip6_src)); 1958 memcpy(&ip6->ip6_dst, &in6_remote->sin6_addr, 1959 sizeof(ip6->ip6_dst)); 1960 1961 udp = mtodo(m, sizeof(*ip6)); 1962 udp->uh_sum = in6_cksum_pseudo(ip6, 1963 m->m_pkthdr.len - sizeof(struct ip6_hdr), 1964 IPPROTO_UDP, 0); 1965 1966 m->m_pkthdr.csum_flags |= CSUM_UDP_IPV6; 1967 m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum); 1968 1969 OVPN_RUNLOCK(sc); 1970 OVPN_COUNTER_ADD(sc, transport_bytes_sent, m->m_pkthdr.len); 1971 1972 return (ip6_output(m, NULL, NULL, IPV6_UNSPECSRC, NULL, NULL, 1973 NULL)); 1974 } 1975 #endif 1976 default: 1977 panic("Unsupported address family %d", 1978 peer->remote.ss_family); 1979 } 1980 } 1981 1982 static int 1983 ovpn_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst, 1984 struct route *ro) 1985 { 1986 struct ovpn_softc *sc; 1987 struct ovpn_kpeer *peer; 1988 1989 OVPN_RLOCK_TRACKER; 1990 1991 sc = ifp->if_softc; 1992 1993 OVPN_RLOCK(sc); 1994 1995 SDT_PROBE1(if_ovpn, tx, transmit, start, m); 1996 1997 if (__predict_false(ifp->if_link_state != LINK_STATE_UP)) { 1998 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1); 1999 OVPN_RUNLOCK(sc); 2000 m_freem(m); 2001 return (ENETDOWN); 2002 } 2003 2004 /** 2005 * Only obey 'dst' (i.e. the gateway) if no route is supplied. 2006 * That's our indication that we're being called through pf's route-to, 2007 * and we should route according to 'dst' instead. We can't do so 2008 * consistently, because the usual openvpn configuration sets the first 2009 * non-server IP in the subnet as the gateway. If we always use that 2010 * one we'd end up routing all traffic to the first client. 2011 * tl;dr: 'ro == NULL' tells us pf is doing a route-to, and then but 2012 * only then, we should treat 'dst' as the destination. */ 2013 peer = ovpn_route_peer(sc, &m, ro == NULL ? dst : NULL); 2014 if (peer == NULL) { 2015 /* No destination. */ 2016 OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1); 2017 OVPN_RUNLOCK(sc); 2018 m_freem(m); 2019 return (ENETDOWN); 2020 } 2021 2022 return (ovpn_transmit_to_peer(ifp, m, peer, _ovpn_lock_trackerp)); 2023 } 2024 2025 static bool 2026 ovpn_check_replay(struct ovpn_kkey_dir *key, uint32_t seq) 2027 { 2028 uint32_t d; 2029 2030 mtx_lock(&key->replay_mtx); 2031 2032 /* Sequence number must be strictly greater than rx_seq */ 2033 if (seq <= key->rx_seq) { 2034 mtx_unlock(&key->replay_mtx); 2035 return (false); 2036 } 2037 2038 /* Large jump. The packet authenticated okay, so just accept that. */ 2039 if (seq > (key->rx_seq + (sizeof(key->rx_window) * 8))) { 2040 key->rx_seq = seq; 2041 key->rx_window = 0; 2042 mtx_unlock(&key->replay_mtx); 2043 return (true); 2044 } 2045 2046 /* Happy case. */ 2047 if ((seq == key->rx_seq + 1) && key->rx_window == 0) { 2048 key->rx_seq++; 2049 mtx_unlock(&key->replay_mtx); 2050 return (true); 2051 } 2052 2053 d = seq - key->rx_seq - 1; 2054 2055 if (key->rx_window & ((uint64_t)1 << d)) { 2056 /* Dupe! */ 2057 mtx_unlock(&key->replay_mtx); 2058 return (false); 2059 } 2060 2061 key->rx_window |= (uint64_t)1 << d; 2062 2063 while (key->rx_window & 1) { 2064 key->rx_seq++; 2065 key->rx_window >>= 1; 2066 } 2067 2068 mtx_unlock(&key->replay_mtx); 2069 2070 return (true); 2071 } 2072 2073 static struct ovpn_kpeer * 2074 ovpn_peer_from_mbuf(struct ovpn_softc *sc, struct mbuf *m, int off) 2075 { 2076 struct ovpn_wire_header ohdr; 2077 uint32_t peerid; 2078 const size_t hdrlen = sizeof(ohdr) - sizeof(ohdr.auth_tag); 2079 2080 OVPN_RASSERT(sc); 2081 2082 if (m_length(m, NULL) < (off + sizeof(struct udphdr) + hdrlen)) 2083 return (NULL); 2084 2085 m_copydata(m, off + sizeof(struct udphdr), hdrlen, (caddr_t)&ohdr); 2086 2087 peerid = ntohl(ohdr.opcode) & 0x00ffffff; 2088 2089 return (ovpn_find_peer(sc, peerid)); 2090 } 2091 2092 static bool 2093 ovpn_udp_input(struct mbuf *m, int off, struct inpcb *inp, 2094 const struct sockaddr *sa, void *ctx) 2095 { 2096 struct ovpn_softc *sc = ctx; 2097 struct ovpn_wire_header tmphdr; 2098 struct ovpn_wire_header *ohdr; 2099 struct udphdr *uhdr; 2100 struct ovpn_kkey *key; 2101 struct cryptop *crp; 2102 struct ovpn_kpeer *peer; 2103 size_t ohdrlen; 2104 int ret; 2105 uint8_t op; 2106 2107 OVPN_RLOCK_TRACKER; 2108 2109 M_ASSERTPKTHDR(m); 2110 2111 OVPN_COUNTER_ADD(sc, transport_bytes_received, m->m_pkthdr.len - off); 2112 2113 ohdrlen = sizeof(*ohdr) - sizeof(ohdr->auth_tag); 2114 2115 OVPN_RLOCK(sc); 2116 2117 peer = ovpn_peer_from_mbuf(sc, m, off); 2118 if (peer == NULL) { 2119 OVPN_RUNLOCK(sc); 2120 return (false); 2121 } 2122 2123 if (m_length(m, NULL) < (off + sizeof(*uhdr) + ohdrlen)) { 2124 /* Short packet. */ 2125 OVPN_RUNLOCK(sc); 2126 return (false); 2127 } 2128 2129 m_copydata(m, off + sizeof(*uhdr), ohdrlen, (caddr_t)&tmphdr); 2130 2131 op = ntohl(tmphdr.opcode) >> 24 >> OVPN_OP_SHIFT; 2132 if (op != OVPN_OP_DATA_V2) { 2133 /* Control packet? */ 2134 OVPN_RUNLOCK(sc); 2135 return (false); 2136 } 2137 2138 m = m_pullup(m, off + sizeof(*uhdr) + ohdrlen); 2139 if (m == NULL) { 2140 OVPN_RUNLOCK(sc); 2141 OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1); 2142 return (true); 2143 } 2144 2145 /* 2146 * Simplify things by getting rid of the preceding headers, we don't 2147 * care about them. 2148 */ 2149 m_adj_decap(m, off); 2150 2151 uhdr = mtodo(m, 0); 2152 ohdr = mtodo(m, sizeof(*uhdr)); 2153 2154 key = ovpn_find_key(sc, peer, ohdr); 2155 if (key == NULL || key->decrypt == NULL) { 2156 OVPN_RUNLOCK(sc); 2157 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1); 2158 m_freem(m); 2159 return (true); 2160 } 2161 2162 if (key->decrypt->cipher == OVPN_CIPHER_ALG_NONE) { 2163 /* Now remove the outer headers */ 2164 m_adj_decap(m, sizeof(struct udphdr) + ohdrlen); 2165 2166 ohdr = mtodo(m, sizeof(*uhdr)); 2167 2168 ovpn_finish_rx(sc, m, peer, key, ntohl(ohdr->seq), 2169 _ovpn_lock_trackerp); 2170 OVPN_UNLOCK_ASSERT(sc); 2171 return (true); 2172 } 2173 2174 ohdrlen += sizeof(ohdr->auth_tag); 2175 2176 m = m_pullup(m, sizeof(*uhdr) + ohdrlen); 2177 if (m == NULL) { 2178 OVPN_RUNLOCK(sc); 2179 OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1); 2180 return (true); 2181 } 2182 uhdr = mtodo(m, 0); 2183 ohdr = mtodo(m, sizeof(*uhdr)); 2184 2185 /* Decrypt */ 2186 crp = crypto_getreq(key->decrypt->cryptoid, M_NOWAIT); 2187 if (crp == NULL) { 2188 OVPN_COUNTER_ADD(sc, nomem_data_pkts_in, 1); 2189 OVPN_RUNLOCK(sc); 2190 m_freem(m); 2191 return (true); 2192 } 2193 2194 crp->crp_payload_start = sizeof(struct udphdr) + sizeof(*ohdr); 2195 crp->crp_payload_length = ntohs(uhdr->uh_ulen) - 2196 sizeof(*uhdr) - sizeof(*ohdr); 2197 crp->crp_op = CRYPTO_OP_DECRYPT; 2198 2199 /* AAD validation. */ 2200 crp->crp_aad_length = sizeof(*ohdr) - sizeof(ohdr->auth_tag); 2201 crp->crp_aad = ohdr; 2202 crp->crp_aad_start = 0; 2203 crp->crp_op |= CRYPTO_OP_VERIFY_DIGEST; 2204 crp->crp_digest_start = sizeof(struct udphdr) + 2205 offsetof(struct ovpn_wire_header, auth_tag); 2206 2207 crp->crp_flags |= CRYPTO_F_IV_SEPARATE; 2208 memcpy(crp->crp_iv, &ohdr->seq, sizeof(ohdr->seq)); 2209 memcpy(crp->crp_iv + sizeof(ohdr->seq), key->decrypt->nonce, 2210 key->decrypt->noncelen); 2211 2212 crypto_use_mbuf(crp, m); 2213 crp->crp_flags |= CRYPTO_F_CBIFSYNC; 2214 crp->crp_callback = ovpn_decrypt_rx_cb; 2215 crp->crp_opaque = sc; 2216 2217 atomic_add_int(&sc->refcount, 1); 2218 OVPN_RUNLOCK(sc); 2219 if (V_async_crypto) 2220 ret = crypto_dispatch_async(crp, CRYPTO_ASYNC_ORDERED); 2221 else 2222 ret = crypto_dispatch(crp); 2223 if (ret != 0) { 2224 OVPN_COUNTER_ADD(sc, lost_data_pkts_in, 1); 2225 } 2226 2227 return (true); 2228 } 2229 2230 static void 2231 ovpn_qflush(struct ifnet *ifp __unused) 2232 { 2233 2234 } 2235 2236 static void 2237 ovpn_flush_rxring(struct ovpn_softc *sc) 2238 { 2239 struct ovpn_notification *n; 2240 2241 OVPN_WASSERT(sc); 2242 2243 while (! buf_ring_empty(sc->notifring)) { 2244 n = buf_ring_dequeue_sc(sc->notifring); 2245 free(n, M_OVPN); 2246 } 2247 } 2248 2249 #ifdef VIMAGE 2250 static void 2251 ovpn_reassign(struct ifnet *ifp, struct vnet *new_vnet __unused, 2252 char *unused __unused) 2253 { 2254 struct ovpn_softc *sc = ifp->if_softc; 2255 struct ovpn_kpeer *peer, *tmppeer; 2256 int ret __diagused; 2257 2258 OVPN_WLOCK(sc); 2259 2260 /* Flush keys & configuration. */ 2261 RB_FOREACH_SAFE(peer, ovpn_kpeers, &sc->peers, tmppeer) { 2262 ret = _ovpn_del_peer(sc, peer->peerid); 2263 MPASS(ret == 0); 2264 } 2265 2266 ovpn_flush_rxring(sc); 2267 2268 OVPN_WUNLOCK(sc); 2269 } 2270 #endif 2271 2272 static int 2273 ovpn_clone_match(struct if_clone *ifc, const char *name) 2274 { 2275 /* 2276 * Allow all names that start with 'ovpn', specifically because pfSense 2277 * uses ovpnc1 / ovpns2 2278 */ 2279 return (strncmp(ovpnname, name, strlen(ovpnname)) == 0); 2280 } 2281 2282 static int 2283 ovpn_clone_create(struct if_clone *ifc, char *name, size_t len, 2284 struct ifc_data *ifd, struct ifnet **ifpp) 2285 { 2286 struct ovpn_softc *sc; 2287 struct ifnet *ifp; 2288 char *dp; 2289 int error, unit, wildcard; 2290 2291 /* Try to see if a special unit was requested. */ 2292 error = ifc_name2unit(name, &unit); 2293 if (error != 0) 2294 return (error); 2295 wildcard = (unit < 0); 2296 2297 error = ifc_alloc_unit(ifc, &unit); 2298 if (error != 0) 2299 return (error); 2300 2301 /* 2302 * If no unit had been given, we need to adjust the ifName. 2303 */ 2304 for (dp = name; *dp != '\0'; dp++); 2305 if (wildcard) { 2306 error = snprintf(dp, len - (dp - name), "%d", unit); 2307 if (error > len - (dp - name)) { 2308 /* ifName too long. */ 2309 ifc_free_unit(ifc, unit); 2310 return (ENOSPC); 2311 } 2312 dp += error; 2313 } 2314 2315 /* Make sure it doesn't already exist. */ 2316 if (ifunit(name) != NULL) 2317 return (EEXIST); 2318 2319 sc = malloc(sizeof(struct ovpn_softc), M_OVPN, M_WAITOK | M_ZERO); 2320 sc->ifp = if_alloc(IFT_ENC); 2321 rm_init_flags(&sc->lock, "if_ovpn_lock", RM_RECURSE); 2322 sc->refcount = 0; 2323 2324 sc->notifring = buf_ring_alloc(32, M_OVPN, M_WAITOK, NULL); 2325 2326 COUNTER_ARRAY_ALLOC(sc->counters, OVPN_COUNTER_SIZE, M_WAITOK); 2327 2328 ifp = sc->ifp; 2329 ifp->if_softc = sc; 2330 strlcpy(ifp->if_xname, name, IFNAMSIZ); 2331 ifp->if_dname = ovpngroupname; 2332 ifp->if_dunit = unit; 2333 2334 ifp->if_addrlen = 0; 2335 ifp->if_mtu = 1428; 2336 ifp->if_flags = IFF_POINTOPOINT | IFF_MULTICAST; 2337 ifp->if_ioctl = ovpn_ioctl; 2338 ifp->if_transmit = ovpn_transmit; 2339 ifp->if_output = ovpn_output; 2340 ifp->if_qflush = ovpn_qflush; 2341 #ifdef VIMAGE 2342 ifp->if_reassign = ovpn_reassign; 2343 #endif 2344 ifp->if_capabilities |= IFCAP_LINKSTATE; 2345 ifp->if_capenable |= IFCAP_LINKSTATE; 2346 2347 if_attach(ifp); 2348 bpfattach(ifp, DLT_NULL, sizeof(uint32_t)); 2349 *ifpp = ifp; 2350 2351 return (0); 2352 } 2353 2354 static void 2355 ovpn_clone_destroy_cb(struct epoch_context *ctx) 2356 { 2357 struct ovpn_softc *sc; 2358 2359 sc = __containerof(ctx, struct ovpn_softc, epoch_ctx); 2360 2361 MPASS(sc->peercount == 0); 2362 MPASS(RB_EMPTY(&sc->peers)); 2363 2364 COUNTER_ARRAY_FREE(sc->counters, OVPN_COUNTER_SIZE); 2365 2366 if_free(sc->ifp); 2367 free(sc, M_OVPN); 2368 } 2369 2370 static int 2371 ovpn_clone_destroy(struct if_clone *ifc, struct ifnet *ifp, uint32_t flags) 2372 { 2373 struct ovpn_softc *sc; 2374 struct ovpn_kpeer *peer, *tmppeer; 2375 int unit; 2376 int ret __diagused; 2377 2378 sc = ifp->if_softc; 2379 unit = ifp->if_dunit; 2380 2381 OVPN_WLOCK(sc); 2382 2383 if (atomic_load_int(&sc->refcount) > 0) { 2384 OVPN_WUNLOCK(sc); 2385 return (EBUSY); 2386 } 2387 2388 RB_FOREACH_SAFE(peer, ovpn_kpeers, &sc->peers, tmppeer) { 2389 ret = _ovpn_del_peer(sc, peer->peerid); 2390 MPASS(ret == 0); 2391 } 2392 2393 ovpn_flush_rxring(sc); 2394 buf_ring_free(sc->notifring, M_OVPN); 2395 2396 OVPN_WUNLOCK(sc); 2397 2398 bpfdetach(ifp); 2399 if_detach(ifp); 2400 ifp->if_softc = NULL; 2401 2402 NET_EPOCH_CALL(ovpn_clone_destroy_cb, &sc->epoch_ctx); 2403 2404 if (unit != IF_DUNIT_NONE) 2405 ifc_free_unit(ifc, unit); 2406 2407 NET_EPOCH_DRAIN_CALLBACKS(); 2408 2409 return (0); 2410 } 2411 2412 static void 2413 vnet_ovpn_init(const void *unused __unused) 2414 { 2415 struct if_clone_addreq req = { 2416 .match_f = ovpn_clone_match, 2417 .create_f = ovpn_clone_create, 2418 .destroy_f = ovpn_clone_destroy, 2419 }; 2420 V_ovpn_cloner = ifc_attach_cloner(ovpngroupname, &req); 2421 } 2422 VNET_SYSINIT(vnet_ovpn_init, SI_SUB_PSEUDO, SI_ORDER_ANY, 2423 vnet_ovpn_init, NULL); 2424 2425 static void 2426 vnet_ovpn_uninit(const void *unused __unused) 2427 { 2428 if_clone_detach(V_ovpn_cloner); 2429 } 2430 VNET_SYSUNINIT(vnet_ovpn_uninit, SI_SUB_PSEUDO, SI_ORDER_ANY, 2431 vnet_ovpn_uninit, NULL); 2432 2433 static int 2434 ovpnmodevent(module_t mod, int type, void *data) 2435 { 2436 switch (type) { 2437 case MOD_LOAD: 2438 /* Done in vnet_ovpn_init() */ 2439 break; 2440 case MOD_UNLOAD: 2441 /* Done in vnet_ovpn_uninit() */ 2442 break; 2443 default: 2444 return (EOPNOTSUPP); 2445 } 2446 2447 return (0); 2448 } 2449 2450 static moduledata_t ovpn_mod = { 2451 "if_ovpn", 2452 ovpnmodevent, 2453 0 2454 }; 2455 2456 DECLARE_MODULE(if_ovpn, ovpn_mod, SI_SUB_PSEUDO, SI_ORDER_ANY); 2457 MODULE_VERSION(if_ovpn, 1); 2458