2 * Copyright (c) 2020 Cisco and/or its affiliates.
3 * Copyright (c) 2020 Doc.ai and/or its affiliates.
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at:
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
17 #include <vnet/adj/adj_midchain.h>
18 #include <vnet/udp/udp.h>
20 #include <wireguard/wireguard_messages.h>
21 #include <wireguard/wireguard_if.h>
22 #include <wireguard/wireguard.h>
23 #include <wireguard/wireguard_peer.h>
25 /* pool of interfaces */
28 /* bitmap of Allocated WG_ITF instances */
29 static uword *wg_if_instances;
31 /* vector of interfaces key'd on their sw_if_index */
32 static index_t *wg_if_index_by_sw_if_index;
34 /* vector of interfaces key'd on their UDP port (in network order) */
35 index_t **wg_if_indexes_by_port;
37 /* pool of ratelimit entries */
38 static ratelimit_entry_t *wg_ratelimit_pool;
41 format_wg_if_name (u8 * s, va_list * args)
43 u32 dev_instance = va_arg (*args, u32);
44 wg_if_t *wgi = wg_if_get (dev_instance);
45 return format (s, "wg%d", wgi->user_instance);
49 format_wg_if (u8 * s, va_list * args)
51 index_t wgii = va_arg (*args, u32);
52 wg_if_t *wgi = wg_if_get (wgii);
53 noise_local_t *local = noise_local_get (wgi->local_idx);
54 u8 key[NOISE_KEY_LEN_BASE64];
56 s = format (s, "[%d] %U src:%U port:%d",
58 format_vnet_sw_if_index_name, vnet_get_main (),
59 wgi->sw_if_index, format_ip_address, &wgi->src_ip, wgi->port);
61 key_to_base64 (local->l_private, NOISE_PUBLIC_KEY_LEN, key);
63 s = format (s, " private-key:%s", key);
65 format (s, " %U", format_hex_bytes, local->l_private,
66 NOISE_PUBLIC_KEY_LEN);
68 key_to_base64 (local->l_public, NOISE_PUBLIC_KEY_LEN, key);
70 s = format (s, " public-key:%s", key);
73 format (s, " %U", format_hex_bytes, local->l_public,
74 NOISE_PUBLIC_KEY_LEN);
76 s = format (s, " mac-key: %U", format_hex_bytes,
77 &wgi->cookie_checker.cc_mac1_key, NOISE_PUBLIC_KEY_LEN);
83 wg_if_find_by_sw_if_index (u32 sw_if_index)
85 if (vec_len (wg_if_index_by_sw_if_index) <= sw_if_index)
87 u32 ti = wg_if_index_by_sw_if_index[sw_if_index];
95 wg_if_find_peer_by_public_key (index_t peeri, void *data)
97 uint8_t *public = data;
98 wg_peer_t *peer = wg_peer_get (peeri);
100 if (!memcmp (peer->remote.r_public, public, NOISE_PUBLIC_KEY_LEN))
102 return (WALK_CONTINUE);
105 static noise_remote_t *
106 wg_remote_get (const uint8_t public[NOISE_PUBLIC_KEY_LEN])
110 peeri = wg_peer_walk (wg_if_find_peer_by_public_key, (void *) public);
112 if (INDEX_INVALID != peeri)
113 return &wg_peer_get (peeri)->remote;
119 wg_index_set (vlib_main_t *vm, noise_remote_t *remote)
121 wg_main_t *wmp = &wg_main;
122 u32 rnd_seed = (u32) (vlib_time_now (wmp->vlib_main) * 1e6);
124 wg_index_table_add (vm, &wmp->index_table, remote->r_peer_idx, rnd_seed);
129 wg_index_drop (vlib_main_t *vm, uint32_t key)
131 wg_main_t *wmp = &wg_main;
132 wg_index_table_del (vm, &wmp->index_table, key);
135 static clib_error_t *
136 wg_if_admin_up_down (vnet_main_t * vnm, u32 hw_if_index, u32 flags)
138 vnet_hw_interface_t *hi;
142 hi = vnet_get_hw_interface (vnm, hw_if_index);
143 hw_flags = (flags & VNET_SW_INTERFACE_FLAG_ADMIN_UP ?
144 VNET_HW_INTERFACE_FLAG_LINK_UP : 0);
145 vnet_hw_interface_set_flags (vnm, hw_if_index, hw_flags);
147 wgii = wg_if_find_by_sw_if_index (hi->sw_if_index);
149 wg_if_peer_walk (wg_if_get (wgii), wg_peer_if_admin_state_change, NULL);
155 wg_if_update_adj (vnet_main_t * vnm, u32 sw_if_index, adj_index_t ai)
159 /* Convert any neighbour adjacency that has a next-hop reachable through
160 * the wg interface into a midchain. This is to avoid sending ARP/ND to
161 * resolve the next-hop address via the wg interface. Then, if one of the
162 * peers has matching prefix among allowed prefixes, the midchain will be
163 * updated to the corresponding one.
165 adj_nbr_midchain_update_rewrite (ai, NULL, NULL, ADJ_FLAG_NONE, NULL);
167 wgii = wg_if_find_by_sw_if_index (sw_if_index);
168 wg_if_peer_walk (wg_if_get (wgii), wg_peer_if_adj_change, &ai);
172 VNET_DEVICE_CLASS (wg_if_device_class) = {
173 .name = "Wireguard Tunnel",
174 .format_device_name = format_wg_if_name,
175 .admin_up_down_function = wg_if_admin_up_down,
178 VNET_HW_INTERFACE_CLASS(wg_hw_interface_class) = {
180 .update_adjacency = wg_if_update_adj,
181 .flags = VNET_HW_INTERFACE_CLASS_FLAG_NBMA,
185 * Maintain a bitmap of allocated wg_if instance numbers.
187 #define WG_ITF_MAX_INSTANCE (16 * 1024)
190 wg_if_instance_alloc (u32 want)
193 * Check for dynamically allocated instance number.
199 bit = clib_bitmap_first_clear (wg_if_instances);
200 if (bit >= WG_ITF_MAX_INSTANCE)
204 wg_if_instances = clib_bitmap_set (wg_if_instances, bit, 1);
211 if (want >= WG_ITF_MAX_INSTANCE)
219 if (clib_bitmap_get (wg_if_instances, want))
225 * Grant allocation request.
227 wg_if_instances = clib_bitmap_set (wg_if_instances, want, 1);
233 wg_if_instance_free (u32 instance)
235 if (instance >= WG_ITF_MAX_INSTANCE)
240 if (clib_bitmap_get (wg_if_instances, instance) == 0)
245 wg_if_instances = clib_bitmap_set (wg_if_instances, instance, 0);
251 wg_if_create (u32 user_instance,
252 const u8 private_key[NOISE_PUBLIC_KEY_LEN],
253 u16 port, const ip_address_t * src_ip, u32 * sw_if_indexp)
255 vnet_main_t *vnm = vnet_get_main ();
256 u32 instance, hw_if_index;
257 vnet_hw_interface_t *hi;
259 noise_local_t *local;
261 ASSERT (sw_if_indexp);
263 *sw_if_indexp = (u32) ~ 0;
266 * Allocate a wg_if instance. Either select on dynamically
267 * or try to use the desired user_instance number.
269 instance = wg_if_instance_alloc (user_instance);
271 return VNET_API_ERROR_INVALID_REGISTRATION;
273 struct noise_upcall upcall = {
274 .u_remote_get = wg_remote_get,
275 .u_index_set = wg_index_set,
276 .u_index_drop = wg_index_drop,
279 pool_get (noise_local_pool, local);
281 noise_local_init (local, &upcall);
282 if (!noise_local_set_private (local, private_key))
284 pool_put (noise_local_pool, local);
285 wg_if_instance_free (instance);
286 return VNET_API_ERROR_INVALID_REGISTRATION;
289 pool_get_zero (wg_if_pool, wg_if);
291 /* tunnel index (or instance) */
292 u32 t_idx = wg_if - wg_if_pool;
294 wg_if->user_instance = instance;
295 if (~0 == wg_if->user_instance)
296 wg_if->user_instance = t_idx;
298 vec_validate_init_empty (wg_if_indexes_by_port, port, NULL);
299 if (vec_len (wg_if_indexes_by_port[port]) == 0)
301 udp_register_dst_port (vlib_get_main (), port, wg4_input_node.index,
303 udp_register_dst_port (vlib_get_main (), port, wg6_input_node.index,
307 vec_add1 (wg_if_indexes_by_port[port], t_idx);
310 wg_if->local_idx = local - noise_local_pool;
311 cookie_checker_init (&wg_if->cookie_checker, wg_ratelimit_pool);
312 cookie_checker_update (&wg_if->cookie_checker, local->l_public);
314 hw_if_index = vnet_register_interface (vnm,
315 wg_if_device_class.index,
317 wg_hw_interface_class.index, t_idx);
319 hi = vnet_get_hw_interface (vnm, hw_if_index);
321 vec_validate_init_empty (wg_if_index_by_sw_if_index, hi->sw_if_index,
323 wg_if_index_by_sw_if_index[hi->sw_if_index] = t_idx;
325 ip_address_copy (&wg_if->src_ip, src_ip);
326 wg_if->sw_if_index = *sw_if_indexp = hi->sw_if_index;
327 vnet_set_interface_l3_output_node (vnm->vlib_main, hi->sw_if_index,
328 (u8 *) "tunnel-output");
334 wg_if_delete (u32 sw_if_index)
336 vnet_main_t *vnm = vnet_get_main ();
338 if (pool_is_free_index (vnm->interface_main.sw_interfaces, sw_if_index))
339 return VNET_API_ERROR_INVALID_SW_IF_INDEX;
341 vnet_hw_interface_t *hw = vnet_get_sup_hw_interface (vnm, sw_if_index);
342 if (hw == 0 || hw->dev_class_index != wg_if_device_class.index)
343 return VNET_API_ERROR_INVALID_VALUE;
346 index_t wgii = wg_if_find_by_sw_if_index (sw_if_index);
347 wg_if = wg_if_get (wgii);
349 return VNET_API_ERROR_INVALID_SW_IF_INDEX_2;
351 if (wg_if_instance_free (wg_if->user_instance) < 0)
352 return VNET_API_ERROR_INVALID_VALUE_2;
354 // Remove peers before interface deletion
355 wg_if_peer_walk (wg_if, wg_peer_if_delete, NULL);
357 hash_free (wg_if->peers);
360 index_t *ifs = wg_if_indexes_get_by_port (wg_if->port);
361 vec_foreach (ii, ifs)
365 vec_del1 (ifs, ifs - ii);
369 if (vec_len (ifs) == 0)
371 udp_unregister_dst_port (vlib_get_main (), wg_if->port, 1);
372 udp_unregister_dst_port (vlib_get_main (), wg_if->port, 0);
375 cookie_checker_deinit (&wg_if->cookie_checker);
377 vnet_reset_interface_l3_output_node (vnm->vlib_main, sw_if_index);
378 vnet_delete_hw_interface (vnm, hw->hw_if_index);
379 pool_put_index (noise_local_pool, wg_if->local_idx);
380 pool_put (wg_if_pool, wg_if);
386 wg_if_peer_add (wg_if_t * wgi, index_t peeri)
388 hash_set (wgi->peers, peeri, peeri);
390 if (1 == hash_elts (wgi->peers))
392 vnet_feature_enable_disable ("ip4-output", "wg4-output-tun",
393 wgi->sw_if_index, 1, 0, 0);
394 vnet_feature_enable_disable ("ip6-output", "wg6-output-tun",
395 wgi->sw_if_index, 1, 0, 0);
400 wg_if_peer_remove (wg_if_t * wgi, index_t peeri)
402 hash_unset (wgi->peers, peeri);
404 if (0 == hash_elts (wgi->peers))
406 vnet_feature_enable_disable ("ip4-output", "wg4-output-tun",
407 wgi->sw_if_index, 0, 0, 0);
408 vnet_feature_enable_disable ("ip6-output", "wg6-output-tun",
409 wgi->sw_if_index, 0, 0, 0);
414 wg_if_walk (wg_if_walk_cb_t fn, void *data)
418 pool_foreach_index (wgii, wg_if_pool)
420 if (WALK_STOP == fn(wgii, data))
426 wg_if_peer_walk (wg_if_t * wgi, wg_if_peer_walk_cb_t fn, void *data)
430 hash_foreach (peeri, val, wgi->peers, {
431 if (WALK_STOP == fn (peeri, data))
435 return INDEX_INVALID;
439 * fd.io coding-style-patch-verification: ON
442 * eval: (c-set-style "gnu")