FD.io VPP  v21.06-3-gbb25fbf28
Vector Packet Processing
wireguard_cookie.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2020 Doc.ai and/or its affiliates.
3  * Copyright (c) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>.
4  * Copyright (c) 2019-2020 Matt Dunwoodie <ncon@noconroy.net>.
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at:
8  *
9  * http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  */
17 
18 #ifndef __included_wg_cookie_h__
19 #define __included_wg_cookie_h__
20 
21 #include <vnet/ip/ip4_packet.h>
23 
25 {
29 };
30 
31 #define COOKIE_MAC_SIZE 16
32 #define COOKIE_KEY_SIZE 32
33 #define COOKIE_NONCE_SIZE 24
34 #define COOKIE_COOKIE_SIZE 16
35 #define COOKIE_SECRET_SIZE 32
36 #define COOKIE_INPUT_SIZE 32
37 #define COOKIE_ENCRYPTED_SIZE (COOKIE_COOKIE_SIZE + COOKIE_MAC_SIZE)
38 
39 #define COOKIE_MAC1_KEY_LABEL "mac1----"
40 #define COOKIE_COOKIE_KEY_LABEL "cookie--"
41 #define COOKIE_SECRET_MAX_AGE 120
42 #define COOKIE_SECRET_LATENCY 5
43 
44 /* Constants for initiation rate limiting */
45 #define RATELIMIT_SIZE (1 << 13)
46 #define RATELIMIT_SIZE_MAX (RATELIMIT_SIZE * 8)
47 #define NSEC_PER_SEC 1000000000LL
48 #define INITIATIONS_PER_SECOND 20
49 #define INITIATIONS_BURSTABLE 5
50 #define INITIATION_COST (NSEC_PER_SEC / INITIATIONS_PER_SECOND)
51 #define TOKEN_MAX (INITIATION_COST * INITIATIONS_BURSTABLE)
52 #define ELEMENT_TIMEOUT 1
53 #define IPV4_MASK_SIZE 4 /* Use all 4 bytes of IPv4 address */
54 #define IPV6_MASK_SIZE 8 /* Use top 8 bytes (/64) of IPv6 address */
55 
56 typedef struct cookie_macs
57 {
61 
62 typedef struct cookie_maker
63 {
66 
72 
73 typedef struct cookie_checker
74 {
77 
81 
82 
83 void cookie_maker_init (cookie_maker_t *, const uint8_t[COOKIE_INPUT_SIZE]);
85 void cookie_maker_mac (cookie_maker_t *, message_macs_t *, void *, size_t);
88  message_macs_t *, void *,
89  size_t, bool,
91  u16 udp_port);
92 
93 #endif /* __included_wg_cookie_h__ */
94 
95 /*
96  * fd.io coding-style-patch-verification: ON
97  *
98  * Local Variables:
99  * eval: (c-set-style "gnu")
100  * End:
101  */
cookie_maker::cp_cookie_key
uint8_t cp_cookie_key[COOKIE_KEY_SIZE]
Definition: wireguard_cookie.h:65
ip4
vl_api_ip4_address_t ip4
Definition: one.api:376
cookie_macs::mac1
uint8_t mac1[COOKIE_MAC_SIZE]
Definition: wireguard_cookie.h:58
cookie_checker
Definition: wireguard_cookie.h:73
cookie_maker::cp_mac1_valid
int cp_mac1_valid
Definition: wireguard_cookie.h:69
cookie_macs::mac2
uint8_t mac2[COOKIE_MAC_SIZE]
Definition: wireguard_cookie.h:59
u16
unsigned short u16
Definition: types.h:57
vm
vlib_main_t * vm
X-connect all packets from the HOST to the PHY.
Definition: nat44_ei.c:3047
wireguard_noise.h
cookie_maker
Definition: wireguard_cookie.h:62
cookie_macs
Definition: wireguard_cookie.h:56
f64
double f64
Definition: types.h:142
cookie_maker::cp_cookie
uint8_t cp_cookie[COOKIE_COOKIE_SIZE]
Definition: wireguard_cookie.h:67
ip4_address_t
Definition: ip4_packet.h:50
cookie_maker::cp_birthdate
f64 cp_birthdate
Definition: wireguard_cookie.h:68
ip4_packet.h
cookie_checker::cc_mac1_key
uint8_t cc_mac1_key[COOKIE_KEY_SIZE]
Definition: wireguard_cookie.h:75
cookie_checker::cc_secret
uint8_t cc_secret[COOKIE_SECRET_SIZE]
Definition: wireguard_cookie.h:79
cookie_maker::cp_mac1_key
uint8_t cp_mac1_key[COOKIE_KEY_SIZE]
Definition: wireguard_cookie.h:64
cookie_maker::cp_mac1_last
uint8_t cp_mac1_last[COOKIE_MAC_SIZE]
Definition: wireguard_cookie.h:70
vlib_main_t
Definition: main.h:102
cookie_checker::cc_secret_birthdate
f64 cc_secret_birthdate
Definition: wireguard_cookie.h:78
cookie_checker::cc_cookie_key
uint8_t cc_cookie_key[COOKIE_KEY_SIZE]
Definition: wireguard_cookie.h:76