2019-01-02 01:55:51 +01:00
|
|
|
/* SPDX-License-Identifier: MIT
|
2018-05-03 15:04:00 +02:00
|
|
|
*
|
2021-01-28 17:52:15 +01:00
|
|
|
* Copyright (C) 2017-2021 WireGuard LLC. All Rights Reserved.
|
2018-05-03 15:04:00 +02:00
|
|
|
*/
|
|
|
|
|
2019-03-03 04:04:41 +01:00
|
|
|
package device
|
2017-05-30 22:36:49 +02:00
|
|
|
|
|
|
|
import (
|
2017-07-13 14:32:40 +02:00
|
|
|
"encoding/base64"
|
2017-06-26 13:14:02 +02:00
|
|
|
"errors"
|
2017-07-13 14:32:40 +02:00
|
|
|
"fmt"
|
2017-05-30 22:36:49 +02:00
|
|
|
"sync"
|
2019-06-11 18:13:52 +02:00
|
|
|
"sync/atomic"
|
2017-06-04 21:48:15 +02:00
|
|
|
"time"
|
2019-11-07 17:13:05 +01:00
|
|
|
|
|
|
|
"golang.zx2c4.com/wireguard/conn"
|
2017-05-30 22:36:49 +02:00
|
|
|
)
|
|
|
|
|
|
|
|
type Peer struct {
|
2018-01-26 22:52:32 +01:00
|
|
|
isRunning AtomicBool
|
2019-01-03 19:04:00 +01:00
|
|
|
sync.RWMutex // Mostly protects endpoint, but is generally taken whenever we modify peer
|
2018-05-13 18:23:40 +02:00
|
|
|
keypairs Keypairs
|
2017-06-24 15:34:17 +02:00
|
|
|
handshake Handshake
|
|
|
|
device *Device
|
2019-11-07 17:13:05 +01:00
|
|
|
endpoint conn.Endpoint
|
2020-12-15 00:28:52 +01:00
|
|
|
persistentKeepaliveInterval uint32 // accessed atomically
|
2021-01-26 23:44:37 +01:00
|
|
|
firstTrieEntry *trieEntry
|
2021-01-29 14:54:11 +01:00
|
|
|
stopping sync.WaitGroup // routines pending stop
|
2018-02-02 16:40:14 +01:00
|
|
|
|
2020-03-01 09:39:24 +01:00
|
|
|
// These fields are accessed with atomic operations, which must be
|
|
|
|
// 64-bit aligned even on 32-bit platforms. Go guarantees that an
|
|
|
|
// allocated struct will be 64-bit aligned. So we place
|
|
|
|
// atomically-accessed fields up front, so that they can share in
|
|
|
|
// this alignment before smaller fields throw it off.
|
2018-02-02 16:40:14 +01:00
|
|
|
stats struct {
|
2017-07-18 15:22:56 +02:00
|
|
|
txBytes uint64 // bytes send to peer (endpoint)
|
|
|
|
rxBytes uint64 // bytes received from peer
|
|
|
|
lastHandshakeNano int64 // nano seconds since epoch
|
|
|
|
}
|
2018-02-02 16:40:14 +01:00
|
|
|
|
2020-12-22 21:34:21 +01:00
|
|
|
disableRoaming bool
|
|
|
|
|
2018-05-07 22:27:03 +02:00
|
|
|
timers struct {
|
|
|
|
retransmitHandshake *Timer
|
|
|
|
sendKeepalive *Timer
|
|
|
|
newHandshake *Timer
|
|
|
|
zeroKeyMaterial *Timer
|
|
|
|
persistentKeepalive *Timer
|
2018-05-20 06:50:07 +02:00
|
|
|
handshakeAttempts uint32
|
|
|
|
needAnotherKeepalive AtomicBool
|
|
|
|
sentLastMinuteHandshake AtomicBool
|
2017-06-28 23:45:45 +02:00
|
|
|
}
|
2018-02-02 16:40:14 +01:00
|
|
|
|
2017-06-28 23:45:45 +02:00
|
|
|
queue struct {
|
2020-11-18 13:53:22 +01:00
|
|
|
sync.RWMutex
|
2021-01-27 18:13:53 +01:00
|
|
|
staged chan *QueueOutboundElement // staged packets before a handshake is available
|
2021-01-29 14:54:11 +01:00
|
|
|
outbound chan *QueueOutboundElement // sequential ordering of udp transmission
|
|
|
|
inbound chan *QueueInboundElement // sequential ordering of tun writing
|
2018-01-13 09:00:37 +01:00
|
|
|
}
|
2018-02-02 16:40:14 +01:00
|
|
|
|
2018-05-13 23:14:43 +02:00
|
|
|
cookieGenerator CookieGenerator
|
2017-06-24 15:34:17 +02:00
|
|
|
}
|
|
|
|
|
2017-08-07 15:25:04 +02:00
|
|
|
func (device *Device) NewPeer(pk NoisePublicKey) (*Peer, error) {
|
2021-01-19 18:02:16 +01:00
|
|
|
if device.isClosed() {
|
2018-05-13 19:33:41 +02:00
|
|
|
return nil, errors.New("device closed")
|
2018-01-26 22:52:32 +01:00
|
|
|
}
|
|
|
|
|
2018-02-02 16:40:14 +01:00
|
|
|
// lock resources
|
2019-01-03 19:04:00 +01:00
|
|
|
device.staticIdentity.RLock()
|
|
|
|
defer device.staticIdentity.RUnlock()
|
2018-02-02 16:40:14 +01:00
|
|
|
|
2019-01-03 19:04:00 +01:00
|
|
|
device.peers.Lock()
|
|
|
|
defer device.peers.Unlock()
|
2018-02-02 16:40:14 +01:00
|
|
|
|
|
|
|
// check if over limit
|
|
|
|
if len(device.peers.keyMap) >= MaxPeers {
|
2018-05-13 19:33:41 +02:00
|
|
|
return nil, errors.New("too many peers")
|
2018-02-02 16:40:14 +01:00
|
|
|
}
|
2018-01-26 22:52:32 +01:00
|
|
|
|
2017-06-26 13:14:02 +02:00
|
|
|
// create peer
|
2017-06-30 14:41:08 +02:00
|
|
|
peer := new(Peer)
|
2019-01-03 19:04:00 +01:00
|
|
|
peer.Lock()
|
|
|
|
defer peer.Unlock()
|
2017-07-01 23:29:22 +02:00
|
|
|
|
2018-05-13 23:14:43 +02:00
|
|
|
peer.cookieGenerator.Init(pk)
|
2017-07-01 23:29:22 +02:00
|
|
|
peer.device = device
|
2017-07-08 23:51:26 +02:00
|
|
|
|
2017-06-30 14:41:08 +02:00
|
|
|
// map public key
|
2018-02-02 16:40:14 +01:00
|
|
|
_, ok := device.peers.keyMap[pk]
|
2017-06-26 13:14:02 +02:00
|
|
|
if ok {
|
2018-05-13 19:33:41 +02:00
|
|
|
return nil, errors.New("adding existing peer")
|
2017-06-26 13:14:02 +02:00
|
|
|
}
|
2017-06-24 15:34:17 +02:00
|
|
|
|
2018-02-02 17:24:29 +01:00
|
|
|
// pre-compute DH
|
2017-06-26 13:14:02 +02:00
|
|
|
handshake := &peer.handshake
|
|
|
|
handshake.mutex.Lock()
|
2018-05-13 23:14:43 +02:00
|
|
|
handshake.precomputedStaticStatic = device.staticIdentity.privateKey.sharedSecret(pk)
|
2019-08-05 16:57:41 +02:00
|
|
|
handshake.remoteStatic = pk
|
2017-06-26 13:14:02 +02:00
|
|
|
handshake.mutex.Unlock()
|
2017-06-24 15:34:17 +02:00
|
|
|
|
2017-10-16 21:33:47 +02:00
|
|
|
// reset endpoint
|
2017-11-18 23:34:02 +01:00
|
|
|
peer.endpoint = nil
|
2017-10-16 21:33:47 +02:00
|
|
|
|
2020-03-18 06:06:56 +01:00
|
|
|
// add
|
|
|
|
device.peers.keyMap[pk] = peer
|
2020-12-16 02:44:21 +01:00
|
|
|
device.peers.empty.Set(false)
|
2019-08-05 16:57:41 +02:00
|
|
|
|
2018-01-26 22:52:32 +01:00
|
|
|
// start peer
|
2021-01-19 18:02:16 +01:00
|
|
|
if peer.device.isUp() {
|
2018-01-26 22:52:32 +01:00
|
|
|
peer.Start()
|
|
|
|
}
|
|
|
|
|
2017-08-07 15:25:04 +02:00
|
|
|
return peer, nil
|
2017-05-30 22:36:49 +02:00
|
|
|
}
|
2017-06-28 23:45:45 +02:00
|
|
|
|
2017-10-27 10:43:37 +02:00
|
|
|
func (peer *Peer) SendBuffer(buffer []byte) error {
|
2019-01-03 19:04:00 +01:00
|
|
|
peer.device.net.RLock()
|
|
|
|
defer peer.device.net.RUnlock()
|
2017-12-29 17:42:09 +01:00
|
|
|
|
2018-02-02 20:45:25 +01:00
|
|
|
if peer.device.net.bind == nil {
|
2020-12-14 22:34:03 +01:00
|
|
|
// Packets can leak through to SendBuffer while the device is closing.
|
|
|
|
// When that happens, drop them silently to avoid spurious errors.
|
2021-01-19 18:02:16 +01:00
|
|
|
if peer.device.isClosed() {
|
2020-12-14 22:34:03 +01:00
|
|
|
return nil
|
|
|
|
}
|
2018-05-13 19:33:41 +02:00
|
|
|
return errors.New("no bind")
|
2018-02-02 20:45:25 +01:00
|
|
|
}
|
|
|
|
|
2019-01-03 19:04:00 +01:00
|
|
|
peer.RLock()
|
|
|
|
defer peer.RUnlock()
|
2017-12-29 17:42:09 +01:00
|
|
|
|
2017-11-18 23:34:02 +01:00
|
|
|
if peer.endpoint == nil {
|
2018-05-13 19:33:41 +02:00
|
|
|
return errors.New("no known endpoint for peer")
|
2017-10-27 10:43:37 +02:00
|
|
|
}
|
2017-12-29 17:42:09 +01:00
|
|
|
|
2019-06-11 18:13:52 +02:00
|
|
|
err := peer.device.net.bind.Send(buffer, peer.endpoint)
|
|
|
|
if err == nil {
|
|
|
|
atomic.AddUint64(&peer.stats.txBytes, uint64(len(buffer)))
|
|
|
|
}
|
|
|
|
return err
|
2017-10-27 10:43:37 +02:00
|
|
|
}
|
|
|
|
|
2017-07-13 14:32:40 +02:00
|
|
|
func (peer *Peer) String() string {
|
2018-05-13 19:33:41 +02:00
|
|
|
base64Key := base64.StdEncoding.EncodeToString(peer.handshake.remoteStatic[:])
|
|
|
|
abbreviatedKey := "invalid"
|
|
|
|
if len(base64Key) == 44 {
|
2018-05-13 23:27:28 +02:00
|
|
|
abbreviatedKey = base64Key[0:4] + "…" + base64Key[39:43]
|
2018-05-13 19:33:41 +02:00
|
|
|
}
|
|
|
|
return fmt.Sprintf("peer(%s)", abbreviatedKey)
|
2017-07-13 14:32:40 +02:00
|
|
|
}
|
|
|
|
|
2018-01-13 09:00:37 +01:00
|
|
|
func (peer *Peer) Start() {
|
2018-02-02 17:24:29 +01:00
|
|
|
// should never start a peer on a closed device
|
2021-01-19 18:02:16 +01:00
|
|
|
if peer.device.isClosed() {
|
2018-02-02 16:40:14 +01:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2018-02-02 17:24:29 +01:00
|
|
|
// prevent simultaneous start/stop operations
|
2021-01-29 14:54:11 +01:00
|
|
|
peer.queue.Lock()
|
|
|
|
defer peer.queue.Unlock()
|
2018-02-02 20:45:25 +01:00
|
|
|
|
|
|
|
if peer.isRunning.Get() {
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2018-02-04 19:18:44 +01:00
|
|
|
device := peer.device
|
2021-01-26 23:05:48 +01:00
|
|
|
device.log.Verbosef("%v - Starting...", peer)
|
2018-01-26 22:52:32 +01:00
|
|
|
|
2018-05-05 22:07:58 +02:00
|
|
|
// reset routine state
|
2021-01-29 14:54:11 +01:00
|
|
|
peer.stopping.Wait()
|
|
|
|
peer.stopping.Add(2)
|
2017-12-29 17:42:09 +01:00
|
|
|
|
2021-02-03 17:52:31 +01:00
|
|
|
peer.handshake.mutex.Lock()
|
|
|
|
peer.handshake.lastSentHandshake = time.Now().Add(-(RekeyTimeout + time.Second))
|
|
|
|
peer.handshake.mutex.Unlock()
|
|
|
|
|
2018-05-05 22:07:58 +02:00
|
|
|
// prepare queues
|
2018-01-26 22:52:32 +01:00
|
|
|
peer.queue.outbound = make(chan *QueueOutboundElement, QueueOutboundSize)
|
|
|
|
peer.queue.inbound = make(chan *QueueInboundElement, QueueInboundSize)
|
2021-01-29 14:54:11 +01:00
|
|
|
if peer.queue.staged == nil {
|
|
|
|
peer.queue.staged = make(chan *QueueOutboundElement, QueueStagedSize)
|
|
|
|
}
|
2021-02-02 19:46:34 +01:00
|
|
|
peer.device.queue.encryption.wg.Add(1) // keep encryption queue open for our writes
|
2018-01-26 22:52:32 +01:00
|
|
|
|
2018-05-07 22:27:03 +02:00
|
|
|
peer.timersInit()
|
2018-02-02 20:45:25 +01:00
|
|
|
|
2017-12-29 17:42:09 +01:00
|
|
|
go peer.RoutineSequentialSender()
|
|
|
|
go peer.RoutineSequentialReceiver()
|
|
|
|
|
2018-01-26 22:52:32 +01:00
|
|
|
peer.isRunning.Set(true)
|
2017-12-29 17:42:09 +01:00
|
|
|
}
|
|
|
|
|
2018-05-13 23:14:43 +02:00
|
|
|
func (peer *Peer) ZeroAndFlushAll() {
|
|
|
|
device := peer.device
|
|
|
|
|
|
|
|
// clear key pairs
|
|
|
|
|
|
|
|
keypairs := &peer.keypairs
|
2019-01-03 19:04:00 +01:00
|
|
|
keypairs.Lock()
|
2018-05-13 23:14:43 +02:00
|
|
|
device.DeleteKeypair(keypairs.previous)
|
|
|
|
device.DeleteKeypair(keypairs.current)
|
2020-05-02 09:30:23 +02:00
|
|
|
device.DeleteKeypair(keypairs.loadNext())
|
2018-05-13 23:14:43 +02:00
|
|
|
keypairs.previous = nil
|
|
|
|
keypairs.current = nil
|
2020-05-02 09:30:23 +02:00
|
|
|
keypairs.storeNext(nil)
|
2019-01-03 19:04:00 +01:00
|
|
|
keypairs.Unlock()
|
2018-05-13 23:14:43 +02:00
|
|
|
|
|
|
|
// clear handshake state
|
|
|
|
|
|
|
|
handshake := &peer.handshake
|
|
|
|
handshake.mutex.Lock()
|
|
|
|
device.indexTable.Delete(handshake.localIndex)
|
|
|
|
handshake.Clear()
|
|
|
|
handshake.mutex.Unlock()
|
|
|
|
|
2021-01-27 18:13:53 +01:00
|
|
|
peer.FlushStagedPackets()
|
2018-05-13 23:14:43 +02:00
|
|
|
}
|
|
|
|
|
2019-07-11 17:36:36 +02:00
|
|
|
func (peer *Peer) ExpireCurrentKeypairs() {
|
|
|
|
handshake := &peer.handshake
|
|
|
|
handshake.mutex.Lock()
|
|
|
|
peer.device.indexTable.Delete(handshake.localIndex)
|
|
|
|
handshake.Clear()
|
|
|
|
peer.handshake.lastSentHandshake = time.Now().Add(-(RekeyTimeout + time.Second))
|
2020-12-16 00:02:13 +01:00
|
|
|
handshake.mutex.Unlock()
|
2019-07-11 17:36:36 +02:00
|
|
|
|
|
|
|
keypairs := &peer.keypairs
|
|
|
|
keypairs.Lock()
|
|
|
|
if keypairs.current != nil {
|
2020-12-16 00:02:13 +01:00
|
|
|
atomic.StoreUint64(&keypairs.current.sendNonce, RejectAfterMessages)
|
2019-07-11 17:36:36 +02:00
|
|
|
}
|
|
|
|
if keypairs.next != nil {
|
2020-12-16 00:02:13 +01:00
|
|
|
next := keypairs.loadNext()
|
|
|
|
atomic.StoreUint64(&next.sendNonce, RejectAfterMessages)
|
2019-07-11 17:36:36 +02:00
|
|
|
}
|
|
|
|
keypairs.Unlock()
|
|
|
|
}
|
|
|
|
|
2017-12-29 17:42:09 +01:00
|
|
|
func (peer *Peer) Stop() {
|
2021-01-29 14:54:11 +01:00
|
|
|
peer.queue.Lock()
|
|
|
|
defer peer.queue.Unlock()
|
2018-02-02 17:24:29 +01:00
|
|
|
|
2018-02-02 20:45:25 +01:00
|
|
|
if !peer.isRunning.Swap(false) {
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2021-01-26 23:05:48 +01:00
|
|
|
peer.device.log.Verbosef("%v - Stopping...", peer)
|
2018-01-26 22:52:32 +01:00
|
|
|
|
2018-05-07 22:27:03 +02:00
|
|
|
peer.timersStop()
|
|
|
|
|
2018-01-26 22:52:32 +01:00
|
|
|
close(peer.queue.inbound)
|
2021-01-27 18:13:53 +01:00
|
|
|
close(peer.queue.outbound)
|
2021-01-29 14:54:11 +01:00
|
|
|
peer.stopping.Wait()
|
2021-02-02 19:46:34 +01:00
|
|
|
peer.device.queue.encryption.wg.Done() // no more writes to encryption queue from us
|
2018-01-26 22:52:32 +01:00
|
|
|
|
2018-05-13 23:14:43 +02:00
|
|
|
peer.ZeroAndFlushAll()
|
2017-06-28 23:45:45 +02:00
|
|
|
}
|
2018-05-26 02:59:26 +02:00
|
|
|
|
2019-11-07 17:13:05 +01:00
|
|
|
func (peer *Peer) SetEndpointFromPacket(endpoint conn.Endpoint) {
|
2020-10-07 10:17:48 +02:00
|
|
|
if peer.disableRoaming {
|
2018-05-26 02:59:26 +02:00
|
|
|
return
|
|
|
|
}
|
2019-01-03 19:04:00 +01:00
|
|
|
peer.Lock()
|
2018-05-26 02:59:26 +02:00
|
|
|
peer.endpoint = endpoint
|
2019-01-03 19:04:00 +01:00
|
|
|
peer.Unlock()
|
2018-05-26 02:59:26 +02:00
|
|
|
}
|