FD.io VPP  v21.06-3-gbb25fbf28
Vector Packet Processing
wireguard_output_tun.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2020 Doc.ai and/or its affiliates.
3  * Copyright (c) 2020 Cisco and/or its affiliates.
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at:
7  *
8  * http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include <vlib/vlib.h>
18 #include <vnet/vnet.h>
19 #include <vppinfra/error.h>
20 
21 #include <wireguard/wireguard.h>
23 
24 #define foreach_wg_output_error \
25  _(NONE, "No error") \
26  _(PEER, "Peer error") \
27  _(KEYPAIR, "Keypair error") \
28  _(TOO_BIG, "packet too big") \
29 
30 typedef enum
31 {
32 #define _(sym,str) WG_OUTPUT_ERROR_##sym,
34 #undef _
37 
38 static char *wg_output_error_strings[] = {
39 #define _(sym,string) string,
41 #undef _
42 };
43 
44 typedef enum
45 {
51 
52 typedef struct
53 {
57 
58 u8 *
59 format_ip4_udp_header (u8 * s, va_list * args)
60 {
61  ip4_udp_header_t *hdr = va_arg (*args, ip4_udp_header_t *);
62 
63  s = format (s, "%U:$U",
65 
66  return (s);
67 }
68 
69 /* packet trace format function */
70 static u8 *
71 format_wg_output_tun_trace (u8 * s, va_list * args)
72 {
73  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
74  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
75 
76  wg_output_tun_trace_t *t = va_arg (*args, wg_output_tun_trace_t *);
77 
78  s = format (s, "peer: %d\n", t->peer);
79  s = format (s, " Encrypted packet: %U", format_ip4_udp_header, &t->hdr);
80  return s;
81 }
82 
86 {
88  u32 *from;
92 
94  n_left_from = frame->n_vectors;
95  b = bufs;
96  next = nexts;
97 
99 
100  wg_main_t *wmp = &wg_main;
101  wg_peer_t *peer = NULL;
102 
103  while (n_left_from > 0)
104  {
106  u8 *plain_data = (vlib_buffer_get_current (b[0]) +
107  sizeof (ip4_udp_header_t));
108  u16 plain_data_len =
109  clib_net_to_host_u16 (((ip4_header_t *) plain_data)->length);
110  index_t peeri;
111 
113  peeri =
114  wg_peer_get_by_adj_index (vnet_buffer (b[0])->ip.adj_index[VLIB_TX]);
115  peer = wg_peer_get (peeri);
116 
117  if (!peer || peer->is_dead)
118  {
119  b[0]->error = node->errors[WG_OUTPUT_ERROR_PEER];
120  goto out;
121  }
122 
123  if (PREDICT_FALSE (~0 == peer->output_thread_index))
124  {
125  /* this is the first packet to use this peer, claim the peer
126  * for this thread.
127  */
128  clib_atomic_cmp_and_swap (&peer->output_thread_index, ~0,
130  }
131 
132  if (PREDICT_TRUE (thread_index != peer->output_thread_index))
133  {
135  goto next;
136  }
137 
138  if (PREDICT_FALSE (!peer->remote.r_current))
139  {
140  wg_send_handshake_from_mt (peeri, false);
141  b[0]->error = node->errors[WG_OUTPUT_ERROR_KEYPAIR];
142  goto out;
143  }
144  size_t encrypted_packet_len = message_data_len (plain_data_len);
145 
146  /*
147  * Ensure there is enough space to write the encrypted data
148  * into the packet
149  */
150  if (PREDICT_FALSE (encrypted_packet_len >= WG_DEFAULT_DATA_SIZE) ||
151  PREDICT_FALSE ((b[0]->current_data + encrypted_packet_len) >=
153  {
154  b[0]->error = node->errors[WG_OUTPUT_ERROR_TOO_BIG];
155  goto out;
156  }
157 
158  message_data_t *encrypted_packet =
160 
162  state =
164  &peer->remote,
165  &encrypted_packet->receiver_index,
166  &encrypted_packet->counter, plain_data,
167  plain_data_len,
168  encrypted_packet->encrypted_data);
169 
171  {
172  wg_send_handshake_from_mt (peeri, false);
173  }
174  else if (PREDICT_FALSE (state == SC_FAILED))
175  {
176  //TODO: Maybe wrong
177  wg_send_handshake_from_mt (peeri, false);
178  goto out;
179  }
180 
181  /* Here we are sure that can send packet to next node */
183  encrypted_packet->header.type = MESSAGE_DATA;
184 
185  clib_memcpy (plain_data, (u8 *) encrypted_packet, encrypted_packet_len);
186 
187  hdr->udp.length = clib_host_to_net_u16 (encrypted_packet_len +
188  sizeof (udp_header_t));
189  b[0]->current_length = (encrypted_packet_len +
190  sizeof (ip4_header_t) + sizeof (udp_header_t));
192  (&hdr->ip4, clib_host_to_net_u16 (b[0]->current_length));
193 
197 
198  out:
199  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
200  && (b[0]->flags & VLIB_BUFFER_IS_TRACED)))
201  {
203  vlib_add_trace (vm, node, b[0], sizeof (*t));
204  t->hdr = *hdr;
205  t->peer = peeri;
206  }
207  next:
208  n_left_from -= 1;
209  next += 1;
210  b += 1;
211  }
212 
214  return frame->n_vectors;
215 }
216 
217 /* *INDENT-OFF* */
219 {
220  .name = "wg-output-tun",
221  .vector_size = sizeof (u32),
222  .format_trace = format_wg_output_tun_trace,
224  .n_errors = ARRAY_LEN (wg_output_error_strings),
225  .error_strings = wg_output_error_strings,
226  .n_next_nodes = WG_OUTPUT_N_NEXT,
227  .next_nodes = {
228  [WG_OUTPUT_NEXT_HANDOFF] = "wg-output-tun-handoff",
229  [WG_OUTPUT_NEXT_INTERFACE_OUTPUT] = "adj-midchain-tx",
230  [WG_OUTPUT_NEXT_ERROR] = "error-drop",
231  },
232 };
233 /* *INDENT-ON* */
234 
235 /*
236  * fd.io coding-style-patch-verification: ON
237  *
238  * Local Variables:
239  * eval: (c-set-style "gnu")
240  * End:
241  */
vlib.h
ip4_udp_header_t
struct ip4_udp_header_t_ ip4_udp_header_t
wg_output_tun_node
vlib_node_registration_t wg_output_tun_node
(constructor) VLIB_REGISTER_NODE (wg_output_tun_node)
Definition: wireguard_output_tun.c:218
udp_header_t::length
u16 length
Definition: udp_packet.h:51
thread_index
u32 thread_index
Definition: nat44_ei_hairpinning.c:492
bufs
vlib_buffer_t * bufs[VLIB_FRAME_SIZE]
Definition: nat44_ei_out2in.c:717
frame
vlib_main_t vlib_node_runtime_t vlib_frame_t * frame
Definition: nat44_ei.c:3048
wg_send_handshake_from_mt
void wg_send_handshake_from_mt(u32 peer_idx, bool is_retry)
Definition: wireguard_send.c:143
wg_output_error_strings
static char * wg_output_error_strings[]
Definition: wireguard_output_tun.c:38
clib_memcpy
#define clib_memcpy(d, s, n)
Definition: string.h:197
wg_output_tun_trace_t::hdr
ip4_udp_header_t hdr
Definition: wireguard_output_tun.c:54
SC_KEEP_KEY_FRESH
@ SC_KEEP_KEY_FRESH
Definition: wireguard_noise.h:56
message_data::counter
u64 counter
Definition: wireguard_messages.h:89
vlib_get_buffers
vlib_get_buffers(vm, from, b, n_left_from)
next
u16 * next
Definition: nat44_ei_out2in.c:718
VLIB_NODE_TYPE_INTERNAL
@ VLIB_NODE_TYPE_INTERNAL
Definition: node.h:72
VLIB_FRAME_SIZE
#define VLIB_FRAME_SIZE
Definition: node.h:368
wg_peer_assign_thread
static u32 wg_peer_assign_thread(u32 thread_id)
Definition: wireguard_peer.h:140
node
vlib_main_t vlib_node_runtime_t * node
Definition: nat44_ei.c:3047
message_data::header
message_header_t header
Definition: wireguard_messages.h:87
message_data::receiver_index
u32 receiver_index
Definition: wireguard_messages.h:88
ip4_header_set_len_w_chksum
static void ip4_header_set_len_w_chksum(ip4_header_t *ip4, u16 len)
Definition: wireguard_send.h:28
message_data::encrypted_data
u8 encrypted_data[]
Definition: wireguard_messages.h:90
wg_peer_get_by_adj_index
static index_t wg_peer_get_by_adj_index(index_t ai)
Definition: wireguard_peer.h:131
WG_OUTPUT_N_NEXT
@ WG_OUTPUT_N_NEXT
Definition: wireguard_output_tun.c:49
u16
unsigned short u16
Definition: types.h:57
vm
vlib_main_t * vm
X-connect all packets from the HOST to the PHY.
Definition: nat44_ei.c:3047
WG_OUTPUT_N_ERROR
@ WG_OUTPUT_N_ERROR
Definition: wireguard_output_tun.c:35
state
vl_api_dhcp_client_state_t state
Definition: dhcp.api:201
SC_FAILED
@ SC_FAILED
Definition: wireguard_noise.h:57
vlib_buffer_enqueue_to_next
vlib_buffer_enqueue_to_next(vm, node, from,(u16 *) nexts, frame->n_vectors)
format_wg_output_tun_trace
static u8 * format_wg_output_tun_trace(u8 *s, va_list *args)
Definition: wireguard_output_tun.c:71
vlib_frame_t
Definition: node.h:372
udp_header_t
Definition: udp_packet.h:45
ip4_header_t
Definition: ip4_packet.h:87
WG_OUTPUT_NEXT_HANDOFF
@ WG_OUTPUT_NEXT_HANDOFF
Definition: wireguard_output_tun.c:47
format_udp_header
format_function_t format_udp_header
Definition: format.h:100
wg_output_tun_trace_t
Definition: wireguard_output_tun.c:52
ip4_udp_header_t_::ip4
ip4_header_t ip4
Definition: wireguard_peer.h:30
vlib_buffer_t::error
vlib_error_t error
Error code for buffers to be enqueued to error handler.
Definition: buffer.h:145
error.h
VLIB_NODE_FN
#define VLIB_NODE_FN(node)
Definition: node.h:202
wg_timers_data_sent
void wg_timers_data_sent(wg_peer_t *peer)
Definition: wireguard_timer.c:239
CLIB_UNUSED
#define CLIB_UNUSED(x)
Definition: clib.h:90
vnet_buffer
#define vnet_buffer(b)
Definition: buffer.h:437
VLIB_NODE_FLAG_TRACE
#define VLIB_NODE_FLAG_TRACE
Definition: node.h:291
wg_main_t::per_thread_data
wg_per_thread_data_t * per_thread_data
Definition: wireguard.h:43
PREDICT_FALSE
#define PREDICT_FALSE(x)
Definition: clib.h:124
ARRAY_LEN
#define ARRAY_LEN(x)
Definition: clib.h:70
vlib_frame_vector_args
static void * vlib_frame_vector_args(vlib_frame_t *f)
Get pointer to frame vector data.
Definition: node_funcs.h:301
index_t
u32 index_t
A Data-Path Object is an object that represents actions that are applied to packets are they are swit...
Definition: dpo.h:43
peer
vl_api_address_t peer
Definition: teib.api:28
wg_output_tun_trace_t::peer
index_t peer
Definition: wireguard_output_tun.c:55
ip4_udp_header_t_
Definition: wireguard_peer.h:28
wg_peer
Definition: wireguard_peer.h:48
vlib_main_t::thread_index
u32 thread_index
Definition: main.h:213
noise_state_crypt
noise_state_crypt
Definition: wireguard_noise.h:52
wg_main
wg_main_t wg_main
Definition: wireguard.c:26
noise_remote_encrypt
enum noise_state_crypt noise_remote_encrypt(vlib_main_t *vm, noise_remote_t *r, uint32_t *r_idx, uint64_t *nonce, uint8_t *src, size_t srclen, uint8_t *dst)
Definition: wireguard_noise.c:544
wg_output_error_t
wg_output_error_t
Definition: wireguard_output_tun.c:30
vlib_node_registration_t
struct _vlib_node_registration vlib_node_registration_t
vlib_buffer_t::current_length
u16 current_length
Nbytes between current data and the end of this buffer.
Definition: buffer.h:122
wireguard_send.h
wg_main_t
Definition: wireguard.h:31
wg_output_next_t
wg_output_next_t
Definition: wireguard_output_tun.c:44
message_data_len
#define message_data_len(plain_len)
Definition: wireguard_messages.h:93
format_ip4_udp_header
u8 * format_ip4_udp_header(u8 *s, va_list *args)
Definition: wireguard_output_tun.c:59
format
description fragment has unexpected format
Definition: map.api:433
vlib_buffer_get_default_data_size
static_always_inline u32 vlib_buffer_get_default_data_size(vlib_main_t *vm)
Definition: buffer_funcs.h:122
u32
unsigned int u32
Definition: types.h:88
clib_atomic_cmp_and_swap
#define clib_atomic_cmp_and_swap(addr, old, new)
Definition: atomics.h:37
WG_OUTPUT_NEXT_INTERFACE_OUTPUT
@ WG_OUTPUT_NEXT_INTERFACE_OUTPUT
Definition: wireguard_output_tun.c:48
format_ip4_header
format_function_t format_ip4_header
Definition: format.h:81
foreach_wg_output_error
#define foreach_wg_output_error
Definition: wireguard_output_tun.c:24
length
char const int length
Definition: cJSON.h:163
vlib_main_t
Definition: main.h:102
vlib_node_t
Definition: node.h:247
wg_per_thread_data_t_::data
u8 data[WG_DEFAULT_DATA_SIZE]
Definition: wireguard.h:29
vlib_add_trace
void * vlib_add_trace(vlib_main_t *vm, vlib_node_runtime_t *r, vlib_buffer_t *b, u32 n_data_bytes)
Definition: trace.c:628
WG_DEFAULT_DATA_SIZE
#define WG_DEFAULT_DATA_SIZE
Definition: wireguard.h:22
b
vlib_buffer_t ** b
Definition: nat44_ei_out2in.c:717
u8
unsigned char u8
Definition: types.h:56
wireguard.h
vlib_buffer_get_current
static void * vlib_buffer_get_current(vlib_buffer_t *b)
Get pointer to current data to process.
Definition: buffer.h:257
ip
vl_api_address_t ip
Definition: l2.api:558
wg_timers_any_authenticated_packet_sent
void wg_timers_any_authenticated_packet_sent(wg_peer_t *peer)
Definition: wireguard_timer.c:212
wg_peer_get
static wg_peer_t * wg_peer_get(index_t peeri)
Definition: wireguard_peer.h:125
message_data
Definition: wireguard_messages.h:85
nexts
u16 nexts[VLIB_FRAME_SIZE]
Definition: nat44_ei_out2in.c:718
vnet.h
vlib_node_runtime_t
Definition: node.h:454
ip4_udp_header_t_::udp
udp_header_t udp
Definition: wireguard_peer.h:31
from
from
Definition: nat44_ei_hairpinning.c:415
PREDICT_TRUE
#define PREDICT_TRUE(x)
Definition: clib.h:125
VLIB_TX
@ VLIB_TX
Definition: defs.h:47
n_left_from
n_left_from
Definition: nat44_ei_hairpinning.c:416
type
vl_api_fib_path_type_t type
Definition: fib_types.api:123
WG_OUTPUT_NEXT_ERROR
@ WG_OUTPUT_NEXT_ERROR
Definition: wireguard_output_tun.c:46
message_header::type
message_type_t type
Definition: wireguard_messages.h:54
vlib_buffer_t::flags
u32 flags
buffer flags: VLIB_BUFFER_FREE_LIST_INDEX_MASK: bits used to store free list index,...
Definition: buffer.h:133
vlib_buffer_t
VLIB buffer representation.
Definition: buffer.h:111
VLIB_REGISTER_NODE
#define VLIB_REGISTER_NODE(x,...)
Definition: node.h:169
wg_timers_any_authenticated_packet_traversal
void wg_timers_any_authenticated_packet_traversal(wg_peer_t *peer)
Definition: wireguard_timer.c:201