src/plugins/wireguard/wireguard_output_tun.c

   1 /*
   2  * Copyright (c) 2020 Doc.ai and/or its affiliates.
   3  * Licensed under the Apache License, Version 2.0 (the "License");
   4  * you may not use this file except in compliance with the License.
   5  * You may obtain a copy of the License at:
   6  *
   7  *     http://www.apache.org/licenses/LICENSE-2.0
   8  *
   9  * Unless required by applicable law or agreed to in writing, software
  10  * distributed under the License is distributed on an "AS IS" BASIS,
  11  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12  * See the License for the specific language governing permissions and
  13  * limitations under the License.
  14  */
  15
  16 #include <vlib/vlib.h>
  17 #include <vnet/vnet.h>
  18 #include <vnet/pg/pg.h>
  19 #include <vnet/fib/ip6_fib.h>
  20 #include <vnet/fib/ip4_fib.h>
  21 #include <vnet/fib/fib_entry.h>
  22 #include <vppinfra/error.h>
  23
  24 #include <wireguard/wireguard.h>
  25 #include <wireguard/wireguard_send.h>
  26
  27 #define foreach_wg_output_error                                         \
  28  _(NONE, "No error")                                                    \
  29  _(PEER, "Peer error")                                                  \
  30  _(KEYPAIR, "Keypair error")                                            \
  31  _(HANDSHAKE_SEND, "Handshake sending failed")                          \
  32  _(TOO_BIG, "packet too big")                                           \
  33
  34 #define WG_OUTPUT_SCRATCH_SIZE 2048
  35
  36 typedef struct wg_output_scratch_t_
  37 {
  38   u8 scratch[WG_OUTPUT_SCRATCH_SIZE];
  39 } wg_output_scratch_t;
  40
  41 /* Cache line aligned per-thread scratch space */
  42 static wg_output_scratch_t *wg_output_scratchs;
  43
  44 typedef enum
  45 {
  46 #define _(sym,str) WG_OUTPUT_ERROR_##sym,
  47   foreach_wg_output_error
  48 #undef _
  49     WG_OUTPUT_N_ERROR,
  50 } wg_output_error_t;
  51
  52 static char *wg_output_error_strings[] = {
  53 #define _(sym,string) string,
  54   foreach_wg_output_error
  55 #undef _
  56 };
  57
  58 typedef enum
  59 {
  60   WG_OUTPUT_NEXT_ERROR,
  61   WG_OUTPUT_NEXT_INTERFACE_OUTPUT,
  62   WG_OUTPUT_N_NEXT,
  63 } wg_output_next_t;
  64
  65 typedef struct
  66 {
  67   ip4_udp_header_t hdr;
  68 } wg_output_tun_trace_t;
  69
  70 u8 *
  71 format_ip4_udp_header (u8 * s, va_list * args)
  72 {
  73   ip4_udp_header_t *hdr = va_arg (*args, ip4_udp_header_t *);
  74
  75   s = format (s, "%U:$U",
  76               format_ip4_header, &hdr->ip4, format_udp_header, &hdr->udp);
  77
  78   return (s);
  79 }
  80
  81 /* packet trace format function */
  82 static u8 *
  83 format_wg_output_tun_trace (u8 * s, va_list * args)
  84 {
  85   CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
  86   CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
  87
  88   wg_output_tun_trace_t *t = va_arg (*args, wg_output_tun_trace_t *);
  89
  90   s = format (s, "Encrypted packet: %U\n", format_ip4_udp_header, &t->hdr);
  91   return s;
  92 }
  93
  94 VLIB_NODE_FN (wg_output_tun_node) (vlib_main_t * vm,
  95                                    vlib_node_runtime_t * node,
  96                                    vlib_frame_t * frame)
  97 {
  98   u32 n_left_from;
  99   u32 *from;
 100   vlib_buffer_t *bufs[VLIB_FRAME_SIZE], **b;
 101   u16 nexts[VLIB_FRAME_SIZE], *next;
 102   u32 thread_index = vm->thread_index;
 103
 104   from = vlib_frame_vector_args (frame);
 105   n_left_from = frame->n_vectors;
 106   b = bufs;
 107   next = nexts;
 108
 109   vlib_get_buffers (vm, from, bufs, n_left_from);
 110
 111   wg_main_t *wmp = &wg_main;
 112   u32 handsh_fails = 0;
 113   wg_peer_t *peer = NULL;
 114
 115   while (n_left_from > 0)
 116     {
 117       ip4_udp_header_t *hdr = vlib_buffer_get_current (b[0]);
 118       u8 *plain_data = vlib_buffer_get_current (b[0]) + sizeof (ip4_header_t);
 119       u16 plain_data_len =
 120         clib_net_to_host_u16 (((ip4_header_t *) plain_data)->length);
 121
 122       next[0] = WG_OUTPUT_NEXT_ERROR;
 123
 124       peer =
 125         wg_peer_get_by_adj_index (vnet_buffer (b[0])->ip.adj_index[VLIB_TX]);
 126
 127       if (!peer || peer->is_dead)
 128         {
 129           b[0]->error = node->errors[WG_OUTPUT_ERROR_PEER];
 130           goto out;
 131         }
 132
 133       if (PREDICT_FALSE (!peer->remote.r_current))
 134         {
 135           if (PREDICT_FALSE (!wg_send_handshake (vm, peer, false)))
 136             handsh_fails++;
 137           b[0]->error = node->errors[WG_OUTPUT_ERROR_KEYPAIR];
 138           goto out;
 139         }
 140
 141       size_t encrypted_packet_len = message_data_len (plain_data_len);
 142
 143       /*
 144        * Ensure there is enough space to write the encrypted data
 145        * into the packet
 146        */
 147       if (PREDICT_FALSE (encrypted_packet_len > WG_OUTPUT_SCRATCH_SIZE) ||
 148           PREDICT_FALSE ((b[0]->current_data + encrypted_packet_len) <
 149                          vlib_buffer_get_default_data_size (vm)))
 150         {
 151           b[0]->error = node->errors[WG_OUTPUT_ERROR_TOO_BIG];
 152           goto out;
 153         }
 154
 155       message_data_t *encrypted_packet =
 156         (message_data_t *) wg_output_scratchs[thread_index].scratch;
 157
 158       enum noise_state_crypt state;
 159       state =
 160         noise_remote_encrypt (wmp->vlib_main,
 161                               &peer->remote,
 162                               &encrypted_packet->receiver_index,
 163                               &encrypted_packet->counter, plain_data,
 164                               plain_data_len,
 165                               encrypted_packet->encrypted_data);
 166       switch (state)
 167         {
 168         case SC_OK:
 169           break;
 170         case SC_KEEP_KEY_FRESH:
 171           if (PREDICT_FALSE (!wg_send_handshake (vm, peer, false)))
 172             handsh_fails++;
 173           break;
 174         case SC_FAILED:
 175           //TODO: Maybe wrong
 176           if (PREDICT_FALSE (!wg_send_handshake (vm, peer, false)))
 177             handsh_fails++;
 178           clib_mem_free (encrypted_packet);
 179           goto out;
 180         default:
 181           break;
 182         }
 183
 184       // Here we are sure that can send packet to next node.
 185       next[0] = WG_OUTPUT_NEXT_INTERFACE_OUTPUT;
 186       encrypted_packet->header.type = MESSAGE_DATA;
 187
 188       clib_memcpy (plain_data, (u8 *) encrypted_packet, encrypted_packet_len);
 189
 190       hdr->udp.length = clib_host_to_net_u16 (encrypted_packet_len +
 191                                               sizeof (udp_header_t));
 192       b[0]->current_length = (encrypted_packet_len +
 193                               sizeof (ip4_header_t) + sizeof (udp_header_t));
 194       ip4_header_set_len_w_chksum
 195         (&hdr->ip4, clib_host_to_net_u16 (b[0]->current_length));
 196
 197       wg_timers_any_authenticated_packet_traversal (peer);
 198       wg_timers_any_authenticated_packet_sent (peer);
 199       wg_timers_data_sent (peer);
 200
 201     out:
 202       if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE)
 203                          && (b[0]->flags & VLIB_BUFFER_IS_TRACED)))
 204         {
 205           wg_output_tun_trace_t *t =
 206             vlib_add_trace (vm, node, b[0], sizeof (*t));
 207           t->hdr = *hdr;
 208         }
 209       n_left_from -= 1;
 210       next += 1;
 211       b += 1;
 212     }
 213
 214   vlib_buffer_enqueue_to_next (vm, node, from, nexts, frame->n_vectors);
 215
 216   vlib_node_increment_counter (vm, node->node_index,
 217                                WG_OUTPUT_ERROR_HANDSHAKE_SEND, handsh_fails);
 218
 219   return frame->n_vectors;
 220 }
 221
 222 /* *INDENT-OFF* */
 223 VLIB_REGISTER_NODE (wg_output_tun_node) =
 224 {
 225   .name = "wg-output-tun",
 226   .vector_size = sizeof (u32),
 227   .format_trace = format_wg_output_tun_trace,
 228   .type = VLIB_NODE_TYPE_INTERNAL,
 229   .n_errors = ARRAY_LEN (wg_output_error_strings),
 230   .error_strings = wg_output_error_strings,
 231   .n_next_nodes = WG_OUTPUT_N_NEXT,
 232   .next_nodes = {
 233         [WG_OUTPUT_NEXT_INTERFACE_OUTPUT] = "adj-midchain-tx",
 234         [WG_OUTPUT_NEXT_ERROR] = "error-drop",
 235   },
 236 };
 237 /* *INDENT-ON* */
 238
 239 static clib_error_t *
 240 wireguard_output_module_init (vlib_main_t * vm)
 241 {
 242   vlib_thread_main_t *tm = vlib_get_thread_main ();
 243
 244   vec_validate_aligned (wg_output_scratchs, tm->n_vlib_mains,
 245                         CLIB_CACHE_LINE_BYTES);
 246   return (NULL);
 247 }
 248
 249 VLIB_INIT_FUNCTION (wireguard_output_module_init);
 250
 251 /*
 252  * fd.io coding-style-patch-verification: ON
 253  *
 254  * Local Variables:
 255  * eval: (c-set-style "gnu")
 256  * End:
 257  */