FD.io VPP  v20.09-64-g4f7b92f0a
Vector Packet Processing
wireguard_send.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2020 Doc.ai and/or its affiliates.
3  * Licensed under the Apache License, Version 2.0 (the "License");
4  * you may not use this file except in compliance with the License.
5  * You may obtain a copy of the License at:
6  *
7  * http://www.apache.org/licenses/LICENSE-2.0
8  *
9  * Unless required by applicable law or agreed to in writing, software
10  * distributed under the License is distributed on an "AS IS" BASIS,
11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12  * See the License for the specific language governing permissions and
13  * limitations under the License.
14  */
15 
16 #include <vnet/vnet.h>
17 #include <vnet/ip/ip6_link.h>
18 #include <vnet/pg/pg.h>
19 #include <vnet/udp/udp.h>
20 #include <vppinfra/error.h>
21 #include <vlibmemory/api.h>
22 #include <wireguard/wireguard.h>
24 
25 static int
27 {
28  vlib_frame_t *f = 0;
29  u32 lookup_node_index =
30  is_ip6 ? ip6_lookup_node.index : ip4_lookup_node.index;
31 
32  f = vlib_get_frame_to_node (vm, lookup_node_index);
33  /* f can not be NULL here - frame allocation failure causes panic */
34 
35  u32 *to_next = vlib_frame_vector_args (f);
36  f->n_vectors = 1;
37  to_next[0] = bi0;
38 
39  vlib_put_frame_to_node (vm, lookup_node_index, f);
40 
41  return f->n_vectors;
42 }
43 
44 static void
46 {
47  ip4_udp_header_t *hdr;
48 
49  vlib_buffer_advance (b0, -sizeof (*hdr));
50 
51  hdr = vlib_buffer_get_current (b0);
52  clib_memcpy (hdr, peer->rewrite, vec_len (peer->rewrite));
53 
54  hdr->udp.length =
55  clib_host_to_net_u16 (b0->current_length - sizeof (ip4_header_t));
57  clib_host_to_net_u16 (b0->current_length));
58 }
59 
60 static bool
62  const wg_peer_t * peer,
63  const u8 * packet, u32 packet_len, u32 * bi)
64 {
65  u32 n_buf0 = 0;
66  vlib_buffer_t *b0;
67 
68  n_buf0 = vlib_buffer_alloc (vm, bi, 1);
69  if (!n_buf0)
70  return false;
71 
72  b0 = vlib_get_buffer (vm, *bi);
73 
74  u8 *payload = vlib_buffer_get_current (b0);
75  clib_memcpy (payload, packet, packet_len);
76 
77  b0->current_length = packet_len;
78 
79  wg_buffer_prepend_rewrite (b0, peer);
80 
81  return true;
82 }
83 
84 bool
86 {
87  ASSERT (vm->thread_index == 0);
88 
90 
91  if (!is_retry)
92  peer->timer_handshake_attempts = 0;
93 
95  REKEY_TIMEOUT) || peer->is_dead)
96  return true;
97 
99  &peer->remote,
100  &packet.sender_index,
101  packet.unencrypted_ephemeral,
102  packet.encrypted_static,
103  packet.encrypted_timestamp))
104  {
105  packet.header.type = MESSAGE_HANDSHAKE_INITIATION;
106  cookie_maker_mac (&peer->cookie_maker, &packet.macs, &packet,
107  sizeof (packet));
111 
112  peer->last_sent_handshake = vlib_time_now (vm);
113  }
114  else
115  return false;
116 
117  u32 bi0 = 0;
118  if (!wg_create_buffer (vm, peer, (u8 *) & packet, sizeof (packet), &bi0))
119  return false;
120 
121  ip46_enqueue_packet (vm, bi0, false);
122  return true;
123 }
124 
125 typedef struct
126 {
128  bool is_retry;
130 
131 static void *
133 {
134  wg_send_args_t *a = arg;
135 
136  wg_main_t *wmp = &wg_main;
138 
139  wg_send_handshake (wmp->vlib_main, peer, a->is_retry);
140  return 0;
141 }
142 
143 void
144 wg_send_handshake_from_mt (u32 peer_idx, bool is_retry)
145 {
146  wg_send_args_t a = {
147  .peer_idx = peer_idx,
148  .is_retry = is_retry,
149  };
150 
152  (u8 *) & a, sizeof (a));
153 }
154 
155 bool
157 {
158  ASSERT (vm->thread_index == 0);
159 
160  u32 size_of_packet = message_data_len (0);
161  message_data_t *packet =
163  u32 bi0 = 0;
164  bool ret = true;
166 
167  if (!peer->remote.r_current)
168  {
169  wg_send_handshake (vm, peer, false);
170  goto out;
171  }
172 
173  state =
175  &peer->remote,
176  &packet->receiver_index,
177  &packet->counter, NULL, 0, packet->encrypted_data);
178 
180  {
181  wg_send_handshake (vm, peer, false);
182  }
183  else if (PREDICT_FALSE (state == SC_FAILED))
184  {
185  ret = false;
186  goto out;
187  }
188 
189  packet->header.type = MESSAGE_DATA;
190 
191  if (!wg_create_buffer (vm, peer, (u8 *) packet, size_of_packet, &bi0))
192  {
193  ret = false;
194  goto out;
195  }
196 
197  ip46_enqueue_packet (vm, bi0, false);
198 
201 
202 out:
203  return ret;
204 }
205 
206 bool
208 {
210 
211  if (noise_create_response (vm,
212  &peer->remote,
213  &packet.sender_index,
214  &packet.receiver_index,
215  packet.unencrypted_ephemeral,
216  packet.encrypted_nothing))
217  {
218  packet.header.type = MESSAGE_HANDSHAKE_RESPONSE;
219  cookie_maker_mac (&peer->cookie_maker, &packet.macs, &packet,
220  sizeof (packet));
221 
222  if (noise_remote_begin_session (vm, &peer->remote))
223  {
227  peer->last_sent_handshake = vlib_time_now (vm);
228 
229  u32 bi0 = 0;
230  if (!wg_create_buffer (vm, peer, (u8 *) & packet,
231  sizeof (packet), &bi0))
232  return false;
233 
234  ip46_enqueue_packet (vm, bi0, false);
235  }
236  else
237  return false;
238  }
239  else
240  return false;
241  return true;
242 }
243 
244 /*
245  * fd.io coding-style-patch-verification: ON
246  *
247  * Local Variables:
248  * eval: (c-set-style "gnu")
249  * End:
250  */
message_header_t header
wg_per_thread_data_t * per_thread_data
Definition: wireguard.h:43
u8 encrypted_static[noise_encrypted_len(NOISE_PUBLIC_KEY_LEN)]
bool noise_create_initiation(vlib_main_t *vm, noise_remote_t *r, uint32_t *s_idx, uint8_t ue[NOISE_PUBLIC_KEY_LEN], uint8_t es[NOISE_PUBLIC_KEY_LEN+NOISE_AUTHTAG_LEN], uint8_t ets[NOISE_TIMESTAMP_LEN+NOISE_AUTHTAG_LEN])
enum noise_state_crypt noise_remote_encrypt(vlib_main_t *vm, noise_remote_t *r, uint32_t *r_idx, uint64_t *nonce, uint8_t *src, size_t srclen, uint8_t *dst)
a
Definition: bitmap.h:538
noise_state_crypt
static f64 vlib_time_now(vlib_main_t *vm)
Definition: main.h:333
u32 thread_index
Definition: main.h:249
u16 current_length
Nbytes between current data and the end of this buffer.
Definition: buffer.h:113
void wg_timers_any_authenticated_packet_traversal(wg_peer_t *peer)
static void wg_buffer_prepend_rewrite(vlib_buffer_t *b0, const wg_peer_t *peer)
vlib_main_t * vm
Definition: in2out_ed.c:1582
unsigned char u8
Definition: types.h:56
vlib_node_registration_t ip4_lookup_node
(constructor) VLIB_REGISTER_NODE (ip4_lookup_node)
Definition: ip4_forward.c:104
#define clib_memcpy(d, s, n)
Definition: string.h:180
bool noise_remote_begin_session(vlib_main_t *vm, noise_remote_t *r)
ip4_header_t ip4
noise_remote_t remote
bool wg_send_handshake_response(vlib_main_t *vm, wg_peer_t *peer)
vlib_frame_t * vlib_get_frame_to_node(vlib_main_t *vm, u32 to_node_index)
Definition: main.c:182
void vl_api_rpc_call_main_thread(void *fp, u8 *data, u32 data_length)
Definition: vlib_api.c:619
bool noise_create_response(vlib_main_t *vm, noise_remote_t *r, uint32_t *s_idx, uint32_t *r_idx, uint8_t ue[NOISE_PUBLIC_KEY_LEN], uint8_t en[0+NOISE_AUTHTAG_LEN])
void wg_send_handshake_from_mt(u32 peer_idx, bool is_retry)
unsigned int u32
Definition: types.h:88
bool is_ip6
Definition: ip.api:43
static int ip46_enqueue_packet(vlib_main_t *vm, u32 bi0, int is_ip6)
u8 encrypted_nothing[noise_encrypted_len(0)]
static __clib_warn_unused_result u32 vlib_buffer_alloc(vlib_main_t *vm, u32 *buffers, u32 n_buffers)
Allocate buffers into supplied array.
Definition: buffer_funcs.h:677
void vlib_put_frame_to_node(vlib_main_t *vm, u32 to_node_index, vlib_frame_t *f)
Definition: main.c:216
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:229
#define PREDICT_FALSE(x)
Definition: clib.h:120
vl_api_address_t peer
Definition: teib.api:28
static bool wg_birthdate_has_expired(f64 birthday_seconds, f64 expiration_seconds)
#define message_data_len(plain_len)
u16 n_vectors
Definition: node.h:396
void wg_timers_any_authenticated_packet_sent(wg_peer_t *peer)
u8 data[WG_DEFAULT_DATA_SIZE]
Definition: wireguard.h:29
cookie_maker_t cookie_maker
bool is_dead
vlib_node_registration_t ip6_lookup_node
(constructor) VLIB_REGISTER_NODE (ip6_lookup_node)
Definition: ip6_forward.c:741
#define ASSERT(truth)
wg_main_t wg_main
Definition: wireguard.c:27
u8 * rewrite
u8 encrypted_timestamp[noise_encrypted_len(NOISE_TIMESTAMP_LEN)]
u8 unencrypted_ephemeral[NOISE_PUBLIC_KEY_LEN]
static void vlib_buffer_advance(vlib_buffer_t *b, word l)
Advance current data pointer by the supplied (signed!) amount.
Definition: buffer.h:248
f64 last_sent_handshake
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
VLIB buffer representation.
Definition: buffer.h:102
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:297
vlib_main_t * vlib_main
Definition: wireguard.h:34
udp_header_t udp
noise_keypair_t * r_current
void wg_timers_session_derived(wg_peer_t *peer)
static void ip4_header_set_len_w_chksum(ip4_header_t *ip4, u16 len)
bool wg_send_keepalive(vlib_main_t *vm, wg_peer_t *peer)
vl_api_dhcp_client_state_t state
Definition: dhcp.api:201
message_type_t type
static bool wg_create_buffer(vlib_main_t *vm, const wg_peer_t *peer, const u8 *packet, u32 packet_len, u32 *bi)
static void * wg_send_handshake_thread_fn(void *arg)
u8 unencrypted_ephemeral[NOISE_PUBLIC_KEY_LEN]
void wg_timers_handshake_initiated(wg_peer_t *peer)
static wg_peer_t * wg_peer_get(index_t peeri)
u32 timer_handshake_attempts
bool wg_send_handshake(vlib_main_t *vm, wg_peer_t *peer, bool is_retry)
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
Definition: buffer_funcs.h:85