FD.io VPP  v21.06-3-gbb25fbf28
Vector Packet Processing
wireguard_send.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2020 Doc.ai and/or its affiliates.
3  * Copyright (c) 2020 Cisco and/or its affiliates.
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at:
7  *
8  * http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include <vnet/vnet.h>
18 #include <vnet/ip/ip6_link.h>
19 #include <vppinfra/error.h>
20 #include <vlibmemory/api.h>
21 #include <wireguard/wireguard.h>
23 
24 static int
26 {
27  vlib_frame_t *f = 0;
28  u32 lookup_node_index =
29  is_ip6 ? ip6_lookup_node.index : ip4_lookup_node.index;
30 
31  f = vlib_get_frame_to_node (vm, lookup_node_index);
32  /* f can not be NULL here - frame allocation failure causes panic */
33 
34  u32 *to_next = vlib_frame_vector_args (f);
35  f->n_vectors = 1;
36  to_next[0] = bi0;
37 
38  vlib_put_frame_to_node (vm, lookup_node_index, f);
39 
40  return f->n_vectors;
41 }
42 
43 static void
45 {
46  ip4_udp_header_t *hdr;
47 
48  vlib_buffer_advance (b0, -sizeof (*hdr));
49 
50  hdr = vlib_buffer_get_current (b0);
51  clib_memcpy (hdr, peer->rewrite, vec_len (peer->rewrite));
52 
53  hdr->udp.length =
54  clib_host_to_net_u16 (b0->current_length - sizeof (ip4_header_t));
56  clib_host_to_net_u16 (b0->current_length));
57 }
58 
59 static bool
61  const wg_peer_t * peer,
62  const u8 * packet, u32 packet_len, u32 * bi)
63 {
64  u32 n_buf0 = 0;
65  vlib_buffer_t *b0;
66 
67  n_buf0 = vlib_buffer_alloc (vm, bi, 1);
68  if (!n_buf0)
69  return false;
70 
71  b0 = vlib_get_buffer (vm, *bi);
72 
73  u8 *payload = vlib_buffer_get_current (b0);
74  clib_memcpy (payload, packet, packet_len);
75 
76  b0->current_length = packet_len;
77 
79 
80  return true;
81 }
82 
83 bool
85 {
86  ASSERT (vm->thread_index == 0);
87 
89 
90  if (!is_retry)
91  peer->timer_handshake_attempts = 0;
92 
93  if (!wg_birthdate_has_expired (peer->last_sent_handshake,
94  REKEY_TIMEOUT) || peer->is_dead)
95  return true;
96 
98  &peer->remote,
99  &packet.sender_index,
100  packet.unencrypted_ephemeral,
101  packet.encrypted_static,
102  packet.encrypted_timestamp))
103  {
104  packet.header.type = MESSAGE_HANDSHAKE_INITIATION;
105  cookie_maker_mac (&peer->cookie_maker, &packet.macs, &packet,
106  sizeof (packet));
110 
111  peer->last_sent_handshake = vlib_time_now (vm);
112  }
113  else
114  return false;
115 
116  u32 bi0 = 0;
117  if (!wg_create_buffer (vm, peer, (u8 *) & packet, sizeof (packet), &bi0))
118  return false;
119 
120  ip46_enqueue_packet (vm, bi0, false);
121  return true;
122 }
123 
124 typedef struct
125 {
127  bool is_retry;
129 
130 static void *
132 {
133  wg_send_args_t *a = arg;
134 
135  wg_main_t *wmp = &wg_main;
136  wg_peer_t *peer = wg_peer_get (a->peer_idx);
137 
138  wg_send_handshake (wmp->vlib_main, peer, a->is_retry);
139  return 0;
140 }
141 
142 void
143 wg_send_handshake_from_mt (u32 peer_idx, bool is_retry)
144 {
145  wg_send_args_t a = {
146  .peer_idx = peer_idx,
147  .is_retry = is_retry,
148  };
149 
151  (u8 *) & a, sizeof (a));
152 }
153 
154 bool
156 {
157  ASSERT (vm->thread_index == 0);
158 
159  u32 size_of_packet = message_data_len (0);
162  u32 bi0 = 0;
163  bool ret = true;
165 
166  if (!peer->remote.r_current)
167  {
168  wg_send_handshake (vm, peer, false);
169  goto out;
170  }
171 
172  state =
174  &peer->remote,
175  &packet->receiver_index,
176  &packet->counter, NULL, 0, packet->encrypted_data);
177 
179  {
180  wg_send_handshake (vm, peer, false);
181  }
182  else if (PREDICT_FALSE (state == SC_FAILED))
183  {
184  ret = false;
185  goto out;
186  }
187 
188  packet->header.type = MESSAGE_DATA;
189 
190  if (!wg_create_buffer (vm, peer, (u8 *) packet, size_of_packet, &bi0))
191  {
192  ret = false;
193  goto out;
194  }
195 
196  ip46_enqueue_packet (vm, bi0, false);
197 
200 
201 out:
202  return ret;
203 }
204 
205 bool
207 {
209 
211  &peer->remote,
212  &packet.sender_index,
213  &packet.receiver_index,
214  packet.unencrypted_ephemeral,
215  packet.encrypted_nothing))
216  {
217  packet.header.type = MESSAGE_HANDSHAKE_RESPONSE;
218  cookie_maker_mac (&peer->cookie_maker, &packet.macs, &packet,
219  sizeof (packet));
220 
221  if (noise_remote_begin_session (vm, &peer->remote))
222  {
226  peer->last_sent_handshake = vlib_time_now (vm);
227 
228  u32 bi0 = 0;
229  if (!wg_create_buffer (vm, peer, (u8 *) & packet,
230  sizeof (packet), &bi0))
231  return false;
232 
233  ip46_enqueue_packet (vm, bi0, false);
234  }
235  else
236  return false;
237  }
238  else
239  return false;
240  return true;
241 }
242 
243 /*
244  * fd.io coding-style-patch-verification: ON
245  *
246  * Local Variables:
247  * eval: (c-set-style "gnu")
248  * End:
249  */
ip4_lookup_node
vlib_node_registration_t ip4_lookup_node
(constructor) VLIB_REGISTER_NODE (ip4_lookup_node)
Definition: ip4_forward.c:104
vlib_frame_t::n_vectors
u16 n_vectors
Definition: node.h:387
udp_header_t::length
u16 length
Definition: udp_packet.h:51
api.h
wg_timers_session_derived
void wg_timers_session_derived(wg_peer_t *peer)
Definition: wireguard_timer.c:229
REKEY_TIMEOUT
@ REKEY_TIMEOUT
Definition: wireguard_messages.h:31
wg_send_handshake_from_mt
void wg_send_handshake_from_mt(u32 peer_idx, bool is_retry)
Definition: wireguard_send.c:143
clib_memcpy
#define clib_memcpy(d, s, n)
Definition: string.h:197
wg_send_args_t::is_retry
bool is_retry
Definition: wireguard_send.c:127
vlib_get_buffer
static vlib_buffer_t * vlib_get_buffer(vlib_main_t *vm, u32 buffer_index)
Translate buffer index into buffer pointer.
Definition: buffer_funcs.h:111
f
vlib_frame_t * f
Definition: interface_output.c:1080
message_handshake_response
Definition: wireguard_messages.h:67
wg_send_handshake
bool wg_send_handshake(vlib_main_t *vm, wg_peer_t *peer, bool is_retry)
Definition: wireguard_send.c:84
wg_create_buffer
static bool wg_create_buffer(vlib_main_t *vm, const wg_peer_t *peer, const u8 *packet, u32 packet_len, u32 *bi)
Definition: wireguard_send.c:60
SC_KEEP_KEY_FRESH
@ SC_KEEP_KEY_FRESH
Definition: wireguard_noise.h:56
wg_send_args_t::peer_idx
u32 peer_idx
Definition: wireguard_send.c:126
ip4_header_set_len_w_chksum
static void ip4_header_set_len_w_chksum(ip4_header_t *ip4, u16 len)
Definition: wireguard_send.h:28
wg_birthdate_has_expired
static bool wg_birthdate_has_expired(f64 birthday_seconds, f64 expiration_seconds)
Definition: wireguard_timer.h:54
message_handshake_initiation
Definition: wireguard_messages.h:57
vm
vlib_main_t * vm
X-connect all packets from the HOST to the PHY.
Definition: nat44_ei.c:3047
ip46_enqueue_packet
static int ip46_enqueue_packet(vlib_main_t *vm, u32 bi0, int is_ip6)
Definition: wireguard_send.c:25
packet
description malformed packet
Definition: map.api:445
state
vl_api_dhcp_client_state_t state
Definition: dhcp.api:201
SC_FAILED
@ SC_FAILED
Definition: wireguard_noise.h:57
vlib_frame_t
Definition: node.h:372
vlib_get_frame_to_node
vlib_frame_t * vlib_get_frame_to_node(vlib_main_t *vm, u32 to_node_index)
Definition: main.c:184
ip6_lookup_node
vlib_node_registration_t ip6_lookup_node
(constructor) VLIB_REGISTER_NODE (ip6_lookup_node)
Definition: ip6_forward.c:741
ip4_header_t
Definition: ip4_packet.h:87
vlib_put_frame_to_node
void vlib_put_frame_to_node(vlib_main_t *vm, u32 to_node_index, vlib_frame_t *f)
Definition: main.c:218
vlib_buffer_advance
static void vlib_buffer_advance(vlib_buffer_t *b, word l)
Advance current data pointer by the supplied (signed!) amount.
Definition: buffer.h:276
ip4_udp_header_t_::ip4
ip4_header_t ip4
Definition: wireguard_peer.h:30
vec_len
#define vec_len(v)
Number of elements in vector (rvalue-only, NULL tolerant)
Definition: vec_bootstrap.h:142
error.h
vlib_buffer_alloc
static __clib_warn_unused_result u32 vlib_buffer_alloc(vlib_main_t *vm, u32 *buffers, u32 n_buffers)
Allocate buffers into supplied array.
Definition: buffer_funcs.h:708
wg_main_t::per_thread_data
wg_per_thread_data_t * per_thread_data
Definition: wireguard.h:43
PREDICT_FALSE
#define PREDICT_FALSE(x)
Definition: clib.h:124
vlib_frame_vector_args
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:301
wg_timers_handshake_initiated
void wg_timers_handshake_initiated(wg_peer_t *peer)
Definition: wireguard_timer.c:218
peer
vl_api_address_t peer
Definition: teib.api:28
ip4_udp_header_t_
Definition: wireguard_peer.h:28
if
if(node->flags &VLIB_NODE_FLAG_TRACE) vnet_interface_output_trace(vm
wg_peer
Definition: wireguard_peer.h:48
vlib_main_t::thread_index
u32 thread_index
Definition: main.h:213
wg_send_handshake_response
bool wg_send_handshake_response(vlib_main_t *vm, wg_peer_t *peer)
Definition: wireguard_send.c:206
wg_send_handshake_thread_fn
static void * wg_send_handshake_thread_fn(void *arg)
Definition: wireguard_send.c:131
noise_state_crypt
noise_state_crypt
Definition: wireguard_noise.h:52
wg_main
wg_main_t wg_main
Definition: wireguard.c:26
noise_remote_encrypt
enum noise_state_crypt noise_remote_encrypt(vlib_main_t *vm, noise_remote_t *r, uint32_t *r_idx, uint64_t *nonce, uint8_t *src, size_t srclen, uint8_t *dst)
Definition: wireguard_noise.c:544
vlib_buffer_t::current_length
u16 current_length
Nbytes between current data and the end of this buffer.
Definition: buffer.h:122
noise_create_initiation
bool noise_create_initiation(vlib_main_t *vm, noise_remote_t *r, uint32_t *s_idx, uint8_t ue[NOISE_PUBLIC_KEY_LEN], uint8_t es[NOISE_PUBLIC_KEY_LEN+NOISE_AUTHTAG_LEN], uint8_t ets[NOISE_TIMESTAMP_LEN+NOISE_AUTHTAG_LEN])
Definition: wireguard_noise.c:118
wireguard_send.h
wg_main_t::vlib_main
vlib_main_t * vlib_main
Definition: wireguard.h:34
wg_main_t
Definition: wireguard.h:31
is_ip6
bool is_ip6
Definition: ip.api:43
message_data_len
#define message_data_len(plain_len)
Definition: wireguard_messages.h:93
wg_send_keepalive
bool wg_send_keepalive(vlib_main_t *vm, wg_peer_t *peer)
Definition: wireguard_send.c:155
ASSERT
#define ASSERT(truth)
Definition: error_bootstrap.h:69
u32
unsigned int u32
Definition: types.h:88
vl_api_rpc_call_main_thread
void vl_api_rpc_call_main_thread(void *fp, u8 *data, u32 data_length)
Definition: vlib_api.c:620
noise_create_response
bool noise_create_response(vlib_main_t *vm, noise_remote_t *r, uint32_t *s_idx, uint32_t *r_idx, uint8_t ue[NOISE_PUBLIC_KEY_LEN], uint8_t en[0+NOISE_AUTHTAG_LEN])
Definition: wireguard_noise.c:254
vlib_main_t
Definition: main.h:102
wg_send_args_t
Definition: wireguard_send.c:124
wg_per_thread_data_t_::data
u8 data[WG_DEFAULT_DATA_SIZE]
Definition: wireguard.h:29
u8
unsigned char u8
Definition: types.h:56
a
a
Definition: bitmap.h:544
wireguard.h
vlib_buffer_get_current
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:257
wg_timers_any_authenticated_packet_sent
void wg_timers_any_authenticated_packet_sent(wg_peer_t *peer)
Definition: wireguard_timer.c:212
wg_peer_get
static wg_peer_t * wg_peer_get(index_t peeri)
Definition: wireguard_peer.h:125
message_data
Definition: wireguard_messages.h:85
vlib_time_now
static f64 vlib_time_now(vlib_main_t *vm)
Definition: main.h:325
vnet.h
ip4_udp_header_t_::udp
udp_header_t udp
Definition: wireguard_peer.h:31
noise_remote_begin_session
bool noise_remote_begin_session(vlib_main_t *vm, noise_remote_t *r)
Definition: wireguard_noise.c:368
wg_buffer_prepend_rewrite
static void wg_buffer_prepend_rewrite(vlib_buffer_t *b0, const wg_peer_t *peer)
Definition: wireguard_send.c:44
vlib_buffer_t
VLIB buffer representation.
Definition: buffer.h:111
wg_timers_any_authenticated_packet_traversal
void wg_timers_any_authenticated_packet_traversal(wg_peer_t *peer)
Definition: wireguard_timer.c:201