2019-01-01 19:55:51 -05:00
|
|
|
/* SPDX-License-Identifier: MIT
|
2018-05-03 09:04:00 -04:00
|
|
|
*
|
2022-09-20 11:21:32 -04:00
|
|
|
* Copyright (C) 2017-2023 WireGuard LLC. All Rights Reserved.
|
2018-05-03 09:04:00 -04:00
|
|
|
*/
|
|
|
|
|
2019-03-02 22:04:41 -05:00
|
|
|
package device
|
2017-05-30 16:36:49 -04:00
|
|
|
|
|
|
|
import (
|
2021-02-10 12:19:11 -05:00
|
|
|
"container/list"
|
2017-06-26 07:14:02 -04:00
|
|
|
"errors"
|
2017-05-30 16:36:49 -04:00
|
|
|
"sync"
|
2019-06-11 12:13:52 -04:00
|
|
|
"sync/atomic"
|
2017-06-04 15:48:15 -04:00
|
|
|
"time"
|
2019-11-07 11:13:05 -05:00
|
|
|
|
2024-01-07 14:03:11 -05:00
|
|
|
"gitea.hbanafa.com/hesham/wireguard-go/conn"
|
2017-05-30 16:36:49 -04:00
|
|
|
)
|
|
|
|
|
|
|
|
type Peer struct {
|
2022-08-30 10:43:11 -04:00
|
|
|
isRunning atomic.Bool
|
|
|
|
keypairs Keypairs
|
|
|
|
handshake Handshake
|
|
|
|
device *Device
|
|
|
|
stopping sync.WaitGroup // routines pending stop
|
|
|
|
txBytes atomic.Uint64 // bytes send to peer (endpoint)
|
|
|
|
rxBytes atomic.Uint64 // bytes received from peer
|
|
|
|
lastHandshakeNano atomic.Int64 // nano seconds since epoch
|
2018-02-02 10:40:14 -05:00
|
|
|
|
2023-11-20 19:49:06 -05:00
|
|
|
endpoint struct {
|
|
|
|
sync.Mutex
|
|
|
|
val conn.Endpoint
|
|
|
|
clearSrcOnTx bool // signal to val.ClearSrc() prior to next packet transmission
|
|
|
|
disableRoaming bool
|
|
|
|
}
|
2020-12-22 15:34:21 -05:00
|
|
|
|
2018-05-07 16:27:03 -04:00
|
|
|
timers struct {
|
|
|
|
retransmitHandshake *Timer
|
|
|
|
sendKeepalive *Timer
|
|
|
|
newHandshake *Timer
|
|
|
|
zeroKeyMaterial *Timer
|
|
|
|
persistentKeepalive *Timer
|
2022-08-30 10:43:11 -04:00
|
|
|
handshakeAttempts atomic.Uint32
|
|
|
|
needAnotherKeepalive atomic.Bool
|
|
|
|
sentLastMinuteHandshake atomic.Bool
|
2017-06-28 17:45:45 -04:00
|
|
|
}
|
2018-02-02 10:40:14 -05:00
|
|
|
|
2021-02-08 16:02:52 -05:00
|
|
|
state struct {
|
2021-02-09 09:35:43 -05:00
|
|
|
sync.Mutex // protects against concurrent Start/Stop
|
2021-02-08 16:02:52 -05:00
|
|
|
}
|
|
|
|
|
2017-06-28 17:45:45 -04:00
|
|
|
queue struct {
|
2023-10-02 17:48:28 -04:00
|
|
|
staged chan *QueueOutboundElementsContainer // staged packets before a handshake is available
|
|
|
|
outbound *autodrainingOutboundQueue // sequential ordering of udp transmission
|
|
|
|
inbound *autodrainingInboundQueue // sequential ordering of tun writing
|
2018-01-13 03:00:37 -05:00
|
|
|
}
|
2018-02-02 10:40:14 -05:00
|
|
|
|
2021-02-10 12:19:11 -05:00
|
|
|
cookieGenerator CookieGenerator
|
|
|
|
trieEntries list.List
|
2022-08-30 10:43:11 -04:00
|
|
|
persistentKeepaliveInterval atomic.Uint32
|
2017-06-24 09:34:17 -04:00
|
|
|
}
|
|
|
|
|
2017-08-07 09:25:04 -04:00
|
|
|
func (device *Device) NewPeer(pk NoisePublicKey) (*Peer, error) {
|
2021-01-19 12:02:16 -05:00
|
|
|
if device.isClosed() {
|
2018-05-13 13:33:41 -04:00
|
|
|
return nil, errors.New("device closed")
|
2018-01-26 16:52:32 -05:00
|
|
|
}
|
|
|
|
|
2018-02-02 10:40:14 -05:00
|
|
|
// lock resources
|
2019-01-03 13:04:00 -05:00
|
|
|
device.staticIdentity.RLock()
|
|
|
|
defer device.staticIdentity.RUnlock()
|
2018-02-02 10:40:14 -05:00
|
|
|
|
2019-01-03 13:04:00 -05:00
|
|
|
device.peers.Lock()
|
|
|
|
defer device.peers.Unlock()
|
2018-02-02 10:40:14 -05:00
|
|
|
|
|
|
|
// check if over limit
|
|
|
|
if len(device.peers.keyMap) >= MaxPeers {
|
2018-05-13 13:33:41 -04:00
|
|
|
return nil, errors.New("too many peers")
|
2018-02-02 10:40:14 -05:00
|
|
|
}
|
2018-01-26 16:52:32 -05:00
|
|
|
|
2017-06-26 07:14:02 -04:00
|
|
|
// create peer
|
2017-06-30 08:41:08 -04:00
|
|
|
peer := new(Peer)
|
2017-07-01 17:29:22 -04:00
|
|
|
|
2018-05-13 17:14:43 -04:00
|
|
|
peer.cookieGenerator.Init(pk)
|
2017-07-01 17:29:22 -04:00
|
|
|
peer.device = device
|
2021-02-09 18:21:12 -05:00
|
|
|
peer.queue.outbound = newAutodrainingOutboundQueue(device)
|
|
|
|
peer.queue.inbound = newAutodrainingInboundQueue(device)
|
2023-10-02 17:48:28 -04:00
|
|
|
peer.queue.staged = make(chan *QueueOutboundElementsContainer, QueueStagedSize)
|
2017-07-08 17:51:26 -04:00
|
|
|
|
2017-06-30 08:41:08 -04:00
|
|
|
// map public key
|
2018-02-02 10:40:14 -05:00
|
|
|
_, ok := device.peers.keyMap[pk]
|
2017-06-26 07:14:02 -04:00
|
|
|
if ok {
|
2018-05-13 13:33:41 -04:00
|
|
|
return nil, errors.New("adding existing peer")
|
2017-06-26 07:14:02 -04:00
|
|
|
}
|
2017-06-24 09:34:17 -04:00
|
|
|
|
2018-02-02 11:24:29 -05:00
|
|
|
// pre-compute DH
|
2017-06-26 07:14:02 -04:00
|
|
|
handshake := &peer.handshake
|
|
|
|
handshake.mutex.Lock()
|
2023-02-16 09:51:30 -05:00
|
|
|
handshake.precomputedStaticStatic, _ = device.staticIdentity.privateKey.sharedSecret(pk)
|
2019-08-05 10:57:41 -04:00
|
|
|
handshake.remoteStatic = pk
|
2017-06-26 07:14:02 -04:00
|
|
|
handshake.mutex.Unlock()
|
2017-06-24 09:34:17 -04:00
|
|
|
|
2017-10-16 15:33:47 -04:00
|
|
|
// reset endpoint
|
2023-11-20 19:49:06 -05:00
|
|
|
peer.endpoint.Lock()
|
|
|
|
peer.endpoint.val = nil
|
|
|
|
peer.endpoint.disableRoaming = false
|
|
|
|
peer.endpoint.clearSrcOnTx = false
|
|
|
|
peer.endpoint.Unlock()
|
2017-10-16 15:33:47 -04:00
|
|
|
|
2021-11-10 21:12:37 -05:00
|
|
|
// init timers
|
|
|
|
peer.timersInit()
|
|
|
|
|
2020-03-18 01:06:56 -04:00
|
|
|
// add
|
|
|
|
device.peers.keyMap[pk] = peer
|
2019-08-05 10:57:41 -04:00
|
|
|
|
2017-08-07 09:25:04 -04:00
|
|
|
return peer, nil
|
2017-05-30 16:36:49 -04:00
|
|
|
}
|
2017-06-28 17:45:45 -04:00
|
|
|
|
2023-03-02 17:48:02 -05:00
|
|
|
func (peer *Peer) SendBuffers(buffers [][]byte) error {
|
2019-01-03 13:04:00 -05:00
|
|
|
peer.device.net.RLock()
|
|
|
|
defer peer.device.net.RUnlock()
|
2017-12-29 11:42:09 -05:00
|
|
|
|
2021-02-21 20:01:50 -05:00
|
|
|
if peer.device.isClosed() {
|
|
|
|
return nil
|
2018-02-02 14:45:25 -05:00
|
|
|
}
|
|
|
|
|
2023-11-20 19:49:06 -05:00
|
|
|
peer.endpoint.Lock()
|
|
|
|
endpoint := peer.endpoint.val
|
|
|
|
if endpoint == nil {
|
|
|
|
peer.endpoint.Unlock()
|
2018-05-13 13:33:41 -04:00
|
|
|
return errors.New("no known endpoint for peer")
|
2017-10-27 04:43:37 -04:00
|
|
|
}
|
2023-11-20 19:49:06 -05:00
|
|
|
if peer.endpoint.clearSrcOnTx {
|
|
|
|
endpoint.ClearSrc()
|
|
|
|
peer.endpoint.clearSrcOnTx = false
|
|
|
|
}
|
|
|
|
peer.endpoint.Unlock()
|
2017-12-29 11:42:09 -05:00
|
|
|
|
2023-11-20 19:49:06 -05:00
|
|
|
err := peer.device.net.bind.Send(buffers, endpoint)
|
2019-06-11 12:13:52 -04:00
|
|
|
if err == nil {
|
2023-03-02 17:48:02 -05:00
|
|
|
var totalLen uint64
|
|
|
|
for _, b := range buffers {
|
|
|
|
totalLen += uint64(len(b))
|
|
|
|
}
|
|
|
|
peer.txBytes.Add(totalLen)
|
2019-06-11 12:13:52 -04:00
|
|
|
}
|
|
|
|
return err
|
2017-10-27 04:43:37 -04:00
|
|
|
}
|
|
|
|
|
2017-07-13 08:32:40 -04:00
|
|
|
func (peer *Peer) String() string {
|
2021-05-13 18:30:18 -04:00
|
|
|
// The awful goo that follows is identical to:
|
|
|
|
//
|
|
|
|
// base64Key := base64.StdEncoding.EncodeToString(peer.handshake.remoteStatic[:])
|
|
|
|
// abbreviatedKey := base64Key[0:4] + "…" + base64Key[39:43]
|
|
|
|
// return fmt.Sprintf("peer(%s)", abbreviatedKey)
|
|
|
|
//
|
|
|
|
// except that it is considerably more efficient.
|
2021-05-13 19:07:55 -04:00
|
|
|
src := peer.handshake.remoteStatic
|
|
|
|
b64 := func(input byte) byte {
|
|
|
|
return input + 'A' + byte(((25-int(input))>>8)&6) - byte(((51-int(input))>>8)&75) - byte(((61-int(input))>>8)&15) + byte(((62-int(input))>>8)&3)
|
|
|
|
}
|
|
|
|
b := []byte("peer(____…____)")
|
|
|
|
const first = len("peer(")
|
|
|
|
const second = len("peer(____…")
|
|
|
|
b[first+0] = b64((src[0] >> 2) & 63)
|
|
|
|
b[first+1] = b64(((src[0] << 4) | (src[1] >> 4)) & 63)
|
|
|
|
b[first+2] = b64(((src[1] << 2) | (src[2] >> 6)) & 63)
|
|
|
|
b[first+3] = b64(src[2] & 63)
|
|
|
|
b[second+0] = b64(src[29] & 63)
|
|
|
|
b[second+1] = b64((src[30] >> 2) & 63)
|
|
|
|
b[second+2] = b64(((src[30] << 4) | (src[31] >> 4)) & 63)
|
|
|
|
b[second+3] = b64((src[31] << 2) & 63)
|
|
|
|
return string(b)
|
2017-07-13 08:32:40 -04:00
|
|
|
}
|
|
|
|
|
2018-01-13 03:00:37 -05:00
|
|
|
func (peer *Peer) Start() {
|
2018-02-02 11:24:29 -05:00
|
|
|
// should never start a peer on a closed device
|
2021-01-19 12:02:16 -05:00
|
|
|
if peer.device.isClosed() {
|
2018-02-02 10:40:14 -05:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2018-02-02 11:24:29 -05:00
|
|
|
// prevent simultaneous start/stop operations
|
2021-02-09 09:35:43 -05:00
|
|
|
peer.state.Lock()
|
|
|
|
defer peer.state.Unlock()
|
2018-02-02 14:45:25 -05:00
|
|
|
|
2022-08-30 10:43:11 -04:00
|
|
|
if peer.isRunning.Load() {
|
2018-02-02 14:45:25 -05:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2018-02-04 13:18:44 -05:00
|
|
|
device := peer.device
|
2021-05-07 06:17:41 -04:00
|
|
|
device.log.Verbosef("%v - Starting", peer)
|
2018-01-26 16:52:32 -05:00
|
|
|
|
2018-05-05 16:07:58 -04:00
|
|
|
// reset routine state
|
2021-01-29 08:54:11 -05:00
|
|
|
peer.stopping.Wait()
|
|
|
|
peer.stopping.Add(2)
|
2017-12-29 11:42:09 -05:00
|
|
|
|
2021-02-03 11:52:31 -05:00
|
|
|
peer.handshake.mutex.Lock()
|
|
|
|
peer.handshake.lastSentHandshake = time.Now().Add(-(RekeyTimeout + time.Second))
|
|
|
|
peer.handshake.mutex.Unlock()
|
|
|
|
|
2021-02-02 13:46:34 -05:00
|
|
|
peer.device.queue.encryption.wg.Add(1) // keep encryption queue open for our writes
|
2018-01-26 16:52:32 -05:00
|
|
|
|
2021-02-08 13:01:35 -05:00
|
|
|
peer.timersStart()
|
2018-02-02 14:45:25 -05:00
|
|
|
|
2021-02-09 18:39:28 -05:00
|
|
|
device.flushInboundQueue(peer.queue.inbound)
|
|
|
|
device.flushOutboundQueue(peer.queue.outbound)
|
2023-03-02 17:48:02 -05:00
|
|
|
|
|
|
|
// Use the device batch size, not the bind batch size, as the device size is
|
|
|
|
// the size of the batch pools.
|
|
|
|
batchSize := peer.device.BatchSize()
|
|
|
|
go peer.RoutineSequentialSender(batchSize)
|
|
|
|
go peer.RoutineSequentialReceiver(batchSize)
|
2017-12-29 11:42:09 -05:00
|
|
|
|
2022-08-30 10:43:11 -04:00
|
|
|
peer.isRunning.Store(true)
|
2017-12-29 11:42:09 -05:00
|
|
|
}
|
|
|
|
|
2018-05-13 17:14:43 -04:00
|
|
|
func (peer *Peer) ZeroAndFlushAll() {
|
|
|
|
device := peer.device
|
|
|
|
|
|
|
|
// clear key pairs
|
|
|
|
|
|
|
|
keypairs := &peer.keypairs
|
2019-01-03 13:04:00 -05:00
|
|
|
keypairs.Lock()
|
2018-05-13 17:14:43 -04:00
|
|
|
device.DeleteKeypair(keypairs.previous)
|
|
|
|
device.DeleteKeypair(keypairs.current)
|
2022-08-30 10:43:11 -04:00
|
|
|
device.DeleteKeypair(keypairs.next.Load())
|
2018-05-13 17:14:43 -04:00
|
|
|
keypairs.previous = nil
|
|
|
|
keypairs.current = nil
|
2022-08-30 10:43:11 -04:00
|
|
|
keypairs.next.Store(nil)
|
2019-01-03 13:04:00 -05:00
|
|
|
keypairs.Unlock()
|
2018-05-13 17:14:43 -04:00
|
|
|
|
|
|
|
// clear handshake state
|
|
|
|
|
|
|
|
handshake := &peer.handshake
|
|
|
|
handshake.mutex.Lock()
|
|
|
|
device.indexTable.Delete(handshake.localIndex)
|
|
|
|
handshake.Clear()
|
|
|
|
handshake.mutex.Unlock()
|
|
|
|
|
2021-01-27 12:13:53 -05:00
|
|
|
peer.FlushStagedPackets()
|
2018-05-13 17:14:43 -04:00
|
|
|
}
|
|
|
|
|
2019-07-11 11:36:36 -04:00
|
|
|
func (peer *Peer) ExpireCurrentKeypairs() {
|
|
|
|
handshake := &peer.handshake
|
|
|
|
handshake.mutex.Lock()
|
|
|
|
peer.device.indexTable.Delete(handshake.localIndex)
|
|
|
|
handshake.Clear()
|
|
|
|
peer.handshake.lastSentHandshake = time.Now().Add(-(RekeyTimeout + time.Second))
|
2020-12-15 18:02:13 -05:00
|
|
|
handshake.mutex.Unlock()
|
2019-07-11 11:36:36 -04:00
|
|
|
|
|
|
|
keypairs := &peer.keypairs
|
|
|
|
keypairs.Lock()
|
|
|
|
if keypairs.current != nil {
|
2022-08-30 10:43:11 -04:00
|
|
|
keypairs.current.sendNonce.Store(RejectAfterMessages)
|
2019-07-11 11:36:36 -04:00
|
|
|
}
|
2022-08-30 10:43:11 -04:00
|
|
|
if next := keypairs.next.Load(); next != nil {
|
|
|
|
next.sendNonce.Store(RejectAfterMessages)
|
2019-07-11 11:36:36 -04:00
|
|
|
}
|
|
|
|
keypairs.Unlock()
|
|
|
|
}
|
|
|
|
|
2017-12-29 11:42:09 -05:00
|
|
|
func (peer *Peer) Stop() {
|
2021-02-09 09:35:43 -05:00
|
|
|
peer.state.Lock()
|
|
|
|
defer peer.state.Unlock()
|
2018-02-02 11:24:29 -05:00
|
|
|
|
2018-02-02 14:45:25 -05:00
|
|
|
if !peer.isRunning.Swap(false) {
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2021-05-07 06:17:41 -04:00
|
|
|
peer.device.log.Verbosef("%v - Stopping", peer)
|
2018-01-26 16:52:32 -05:00
|
|
|
|
2018-05-07 16:27:03 -04:00
|
|
|
peer.timersStop()
|
2021-02-08 16:02:52 -05:00
|
|
|
// Signal that RoutineSequentialSender and RoutineSequentialReceiver should exit.
|
2021-02-09 09:09:50 -05:00
|
|
|
peer.queue.inbound.c <- nil
|
|
|
|
peer.queue.outbound.c <- nil
|
2021-01-29 08:54:11 -05:00
|
|
|
peer.stopping.Wait()
|
2021-02-02 13:46:34 -05:00
|
|
|
peer.device.queue.encryption.wg.Done() // no more writes to encryption queue from us
|
2018-01-26 16:52:32 -05:00
|
|
|
|
2018-05-13 17:14:43 -04:00
|
|
|
peer.ZeroAndFlushAll()
|
2017-06-28 17:45:45 -04:00
|
|
|
}
|
2018-05-25 20:59:26 -04:00
|
|
|
|
2019-11-07 11:13:05 -05:00
|
|
|
func (peer *Peer) SetEndpointFromPacket(endpoint conn.Endpoint) {
|
2023-11-20 19:49:06 -05:00
|
|
|
peer.endpoint.Lock()
|
|
|
|
defer peer.endpoint.Unlock()
|
|
|
|
if peer.endpoint.disableRoaming {
|
|
|
|
return
|
|
|
|
}
|
|
|
|
peer.endpoint.clearSrcOnTx = false
|
|
|
|
peer.endpoint.val = endpoint
|
|
|
|
}
|
|
|
|
|
|
|
|
func (peer *Peer) markEndpointSrcForClearing() {
|
|
|
|
peer.endpoint.Lock()
|
|
|
|
defer peer.endpoint.Unlock()
|
|
|
|
if peer.endpoint.val == nil {
|
2018-05-25 20:59:26 -04:00
|
|
|
return
|
|
|
|
}
|
2023-11-20 19:49:06 -05:00
|
|
|
peer.endpoint.clearSrcOnTx = true
|
2018-05-25 20:59:26 -04:00
|
|
|
}
|