2 * Copyright (c) 2020 Doc.ai and/or its affiliates.
3 * Copyright (c) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>.
4 * Copyright (c) 2019-2020 Matt Dunwoodie <ncon@noconroy.net>.
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
18 #ifndef __included_wg_cookie_h__
19 #define __included_wg_cookie_h__
21 #include <vnet/ip/ip46_address.h>
22 #include <wireguard/wireguard_noise.h>
27 VALID_MAC_BUT_NO_COOKIE,
28 VALID_MAC_WITH_COOKIE,
29 VALID_MAC_WITH_COOKIE_BUT_RATELIMITED,
32 #define COOKIE_MAC_SIZE 16
33 #define COOKIE_KEY_SIZE 32
34 #define COOKIE_NONCE_SIZE 24
35 #define COOKIE_COOKIE_SIZE 16
36 #define COOKIE_SECRET_SIZE 32
37 #define COOKIE_INPUT_SIZE 32
38 #define COOKIE_ENCRYPTED_SIZE (COOKIE_COOKIE_SIZE + COOKIE_MAC_SIZE)
40 #define COOKIE_MAC1_KEY_LABEL "mac1----"
41 #define COOKIE_COOKIE_KEY_LABEL "cookie--"
42 #define COOKIE_SECRET_MAX_AGE 120
43 #define COOKIE_SECRET_LATENCY 5
45 /* Constants for initiation rate limiting */
46 #define RATELIMIT_SIZE (1 << 13)
47 #define RATELIMIT_SIZE_MAX (RATELIMIT_SIZE * 8)
48 #define NSEC_PER_SEC 1000000000LL
49 #define INITIATIONS_PER_SECOND 20
50 #define INITIATIONS_BURSTABLE 5
51 #define INITIATION_COST (NSEC_PER_SEC / INITIATIONS_PER_SECOND)
52 #define TOKEN_MAX (INITIATION_COST * INITIATIONS_BURSTABLE)
53 #define ELEMENT_TIMEOUT 1
55 typedef struct cookie_macs
57 uint8_t mac1[COOKIE_MAC_SIZE];
58 uint8_t mac2[COOKIE_MAC_SIZE];
61 typedef struct ratelimit_entry
67 typedef struct ratelimit
69 ratelimit_entry_t *rl_pool;
74 typedef struct cookie_maker
76 uint8_t cp_mac1_key[COOKIE_KEY_SIZE];
77 uint8_t cp_cookie_key[COOKIE_KEY_SIZE];
79 uint8_t cp_cookie[COOKIE_COOKIE_SIZE];
82 uint8_t cp_mac1_last[COOKIE_MAC_SIZE];
85 typedef struct cookie_checker
87 ratelimit_t cc_ratelimit_v4;
88 ratelimit_t cc_ratelimit_v6;
90 uint8_t cc_mac1_key[COOKIE_KEY_SIZE];
91 uint8_t cc_cookie_key[COOKIE_KEY_SIZE];
93 f64 cc_secret_birthdate;
94 uint8_t cc_secret[COOKIE_SECRET_SIZE];
98 void cookie_maker_init (cookie_maker_t *, const uint8_t[COOKIE_INPUT_SIZE]);
99 void cookie_checker_init (cookie_checker_t *, ratelimit_entry_t *);
100 void cookie_checker_update (cookie_checker_t *, uint8_t[COOKIE_INPUT_SIZE]);
101 void cookie_checker_deinit (cookie_checker_t *);
102 void cookie_checker_create_payload (vlib_main_t *vm, cookie_checker_t *cc,
104 uint8_t nonce[COOKIE_NONCE_SIZE],
105 uint8_t ecookie[COOKIE_ENCRYPTED_SIZE],
106 ip46_address_t *ip, u16 udp_port);
107 bool cookie_maker_consume_payload (vlib_main_t *vm, cookie_maker_t *cp,
108 uint8_t nonce[COOKIE_NONCE_SIZE],
109 uint8_t ecookie[COOKIE_ENCRYPTED_SIZE]);
110 void cookie_maker_mac (cookie_maker_t *, message_macs_t *, void *, size_t);
111 enum cookie_mac_state
112 cookie_checker_validate_macs (vlib_main_t *vm, cookie_checker_t *,
113 message_macs_t *, void *, size_t, bool,
114 ip46_address_t *ip, u16 udp_port);
116 #endif /* __included_wg_cookie_h__ */
119 * fd.io coding-style-patch-verification: ON
122 * eval: (c-set-style "gnu")