2 * Copyright (c) 2020 Doc.ai and/or its affiliates.
3 * Copyright (c) 2020 Cisco and/or its affiliates.
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at:
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
17 #include <vnet/vnet.h>
18 #include <vnet/ip/ip6_link.h>
19 #include <vppinfra/error.h>
20 #include <vlibmemory/api.h>
21 #include <wireguard/wireguard.h>
22 #include <wireguard/wireguard_send.h>
25 ip46_enqueue_packet (vlib_main_t *vm, u32 bi0, int is_ip4)
28 u32 lookup_node_index =
29 is_ip4 ? ip4_lookup_node.index : ip6_lookup_node.index;
31 f = vlib_get_frame_to_node (vm, lookup_node_index);
32 /* f can not be NULL here - frame allocation failure causes panic */
34 u32 *to_next = vlib_frame_vector_args (f);
38 vlib_put_frame_to_node (vm, lookup_node_index, f);
44 wg_buffer_prepend_rewrite (vlib_buffer_t *b0, const wg_peer_t *peer, u8 is_ip4)
48 ip4_udp_header_t *hdr4;
50 vlib_buffer_advance (b0, -sizeof (*hdr4));
52 hdr4 = vlib_buffer_get_current (b0);
53 clib_memcpy (hdr4, peer->rewrite, vec_len (peer->rewrite));
56 clib_host_to_net_u16 (b0->current_length - sizeof (ip4_header_t));
57 ip4_header_set_len_w_chksum (&hdr4->ip4,
58 clib_host_to_net_u16 (b0->current_length));
62 ip6_udp_header_t *hdr6;
64 vlib_buffer_advance (b0, -sizeof (*hdr6));
66 hdr6 = vlib_buffer_get_current (b0);
67 clib_memcpy (hdr6, peer->rewrite, vec_len (peer->rewrite));
70 clib_host_to_net_u16 (b0->current_length - sizeof (ip6_header_t));
72 hdr6->ip6.payload_length = clib_host_to_net_u16 (b0->current_length);
77 wg_create_buffer (vlib_main_t *vm, const wg_peer_t *peer, const u8 *packet,
78 u32 packet_len, u32 *bi, u8 is_ip4)
83 n_buf0 = vlib_buffer_alloc (vm, bi, 1);
87 b0 = vlib_get_buffer (vm, *bi);
89 u8 *payload = vlib_buffer_get_current (b0);
90 clib_memcpy (payload, packet, packet_len);
92 b0->current_length = packet_len;
94 wg_buffer_prepend_rewrite (b0, peer, is_ip4);
100 wg_send_handshake (vlib_main_t * vm, wg_peer_t * peer, bool is_retry)
102 ASSERT (vm->thread_index == 0);
104 message_handshake_initiation_t packet;
107 peer->timer_handshake_attempts = 0;
109 if (!wg_birthdate_has_expired (peer->last_sent_handshake,
110 REKEY_TIMEOUT) || peer->is_dead)
113 if (noise_create_initiation (vm,
115 &packet.sender_index,
116 packet.unencrypted_ephemeral,
117 packet.encrypted_static,
118 packet.encrypted_timestamp))
120 packet.header.type = MESSAGE_HANDSHAKE_INITIATION;
121 cookie_maker_mac (&peer->cookie_maker, &packet.macs, &packet,
123 wg_timers_any_authenticated_packet_sent (peer);
124 wg_timers_handshake_initiated (peer);
125 wg_timers_any_authenticated_packet_traversal (peer);
127 peer->last_sent_handshake = vlib_time_now (vm);
132 u8 is_ip4 = ip46_address_is_ip4 (&peer->dst.addr);
134 if (!wg_create_buffer (vm, peer, (u8 *) &packet, sizeof (packet), &bi0,
138 ip46_enqueue_packet (vm, bi0, is_ip4);
149 wg_send_handshake_thread_fn (void *arg)
151 wg_send_args_t *a = arg;
153 wg_main_t *wmp = &wg_main;
154 wg_peer_t *peer = wg_peer_get (a->peer_idx);
156 wg_send_handshake (wmp->vlib_main, peer, a->is_retry);
161 wg_send_handshake_from_mt (u32 peer_idx, bool is_retry)
164 .peer_idx = peer_idx,
165 .is_retry = is_retry,
168 vl_api_rpc_call_main_thread (wg_send_handshake_thread_fn,
169 (u8 *) & a, sizeof (a));
173 wg_send_keepalive (vlib_main_t * vm, wg_peer_t * peer)
175 ASSERT (vm->thread_index == 0);
177 u32 size_of_packet = message_data_len (0);
178 message_data_t *packet =
179 (message_data_t *) wg_main.per_thread_data[vm->thread_index].data;
182 enum noise_state_crypt state;
184 if (!peer->remote.r_current)
186 wg_send_handshake (vm, peer, false);
191 noise_remote_encrypt (vm,
193 &packet->receiver_index,
194 &packet->counter, NULL, 0, packet->encrypted_data);
196 if (PREDICT_FALSE (state == SC_KEEP_KEY_FRESH))
198 wg_send_handshake (vm, peer, false);
200 else if (PREDICT_FALSE (state == SC_FAILED))
206 u8 is_ip4 = ip46_address_is_ip4 (&peer->dst.addr);
207 packet->header.type = MESSAGE_DATA;
209 if (!wg_create_buffer (vm, peer, (u8 *) packet, size_of_packet, &bi0,
216 ip46_enqueue_packet (vm, bi0, is_ip4);
218 wg_timers_any_authenticated_packet_sent (peer);
219 wg_timers_any_authenticated_packet_traversal (peer);
226 wg_send_handshake_response (vlib_main_t * vm, wg_peer_t * peer)
228 message_handshake_response_t packet;
230 if (noise_create_response (vm,
232 &packet.sender_index,
233 &packet.receiver_index,
234 packet.unencrypted_ephemeral,
235 packet.encrypted_nothing))
237 packet.header.type = MESSAGE_HANDSHAKE_RESPONSE;
238 cookie_maker_mac (&peer->cookie_maker, &packet.macs, &packet,
241 if (noise_remote_begin_session (vm, &peer->remote))
243 wg_timers_session_derived (peer);
244 wg_timers_any_authenticated_packet_sent (peer);
245 wg_timers_any_authenticated_packet_traversal (peer);
246 peer->last_sent_handshake = vlib_time_now (vm);
249 u8 is_ip4 = ip46_address_is_ip4 (&peer->dst.addr);
250 if (!wg_create_buffer (vm, peer, (u8 *) &packet, sizeof (packet),
254 ip46_enqueue_packet (vm, bi0, is_ip4);
265 * fd.io coding-style-patch-verification: ON
268 * eval: (c-set-style "gnu")