wireguard-go/cookie.go

251 lines
4.6 KiB
Go
Raw Normal View History

/* SPDX-License-Identifier: GPL-2.0
*
2018-09-05 21:54:31 +00:00
* Copyright (C) 2017-2018 WireGuard LLC. All Rights Reserved.
*/
2017-08-14 15:09:25 +00:00
package main
import (
"crypto/hmac"
"crypto/rand"
"golang.org/x/crypto/blake2s"
"golang.org/x/crypto/chacha20poly1305"
"sync"
"time"
)
type CookieChecker struct {
mutex sync.RWMutex
mac1 struct {
key [blake2s.Size]byte
}
mac2 struct {
secret [blake2s.Size]byte
secretSet time.Time
encryptionKey [chacha20poly1305.KeySize]byte
}
}
type CookieGenerator struct {
mutex sync.RWMutex
mac1 struct {
key [blake2s.Size]byte
}
mac2 struct {
cookie [blake2s.Size128]byte
cookieSet time.Time
hasLastMAC1 bool
lastMAC1 [blake2s.Size128]byte
encryptionKey [chacha20poly1305.KeySize]byte
}
}
func (st *CookieChecker) Init(pk NoisePublicKey) {
st.mutex.Lock()
defer st.mutex.Unlock()
// mac1 state
func() {
2018-05-14 10:27:29 +00:00
hash, _ := blake2s.New256(nil)
hash.Write([]byte(WGLabelMAC1))
hash.Write(pk[:])
hash.Sum(st.mac1.key[:0])
2017-08-14 15:09:25 +00:00
}()
// mac2 state
func() {
2018-05-14 10:27:29 +00:00
hash, _ := blake2s.New256(nil)
hash.Write([]byte(WGLabelCookie))
hash.Write(pk[:])
hash.Sum(st.mac2.encryptionKey[:0])
2017-08-14 15:09:25 +00:00
}()
st.mac2.secretSet = time.Time{}
}
func (st *CookieChecker) CheckMAC1(msg []byte) bool {
2018-02-11 22:07:07 +00:00
st.mutex.RLock()
defer st.mutex.RUnlock()
2017-08-14 15:09:25 +00:00
size := len(msg)
smac2 := size - blake2s.Size128
smac1 := smac2 - blake2s.Size128
var mac1 [blake2s.Size128]byte
mac, _ := blake2s.New128(st.mac1.key[:])
mac.Write(msg[:smac1])
mac.Sum(mac1[:0])
return hmac.Equal(mac1[:], msg[smac1:smac2])
}
2017-10-08 20:03:32 +00:00
func (st *CookieChecker) CheckMAC2(msg []byte, src []byte) bool {
2017-08-14 15:09:25 +00:00
st.mutex.RLock()
defer st.mutex.RUnlock()
if time.Now().Sub(st.mac2.secretSet) > CookieRefreshTime {
return false
}
// derive cookie key
var cookie [blake2s.Size128]byte
func() {
mac, _ := blake2s.New128(st.mac2.secret[:])
2017-10-08 20:03:32 +00:00
mac.Write(src)
2017-08-14 15:09:25 +00:00
mac.Sum(cookie[:0])
}()
// calculate mac of packet (including mac1)
smac2 := len(msg) - blake2s.Size128
var mac2 [blake2s.Size128]byte
func() {
mac, _ := blake2s.New128(cookie[:])
mac.Write(msg[:smac2])
mac.Sum(mac2[:0])
}()
return hmac.Equal(mac2[:], msg[smac2:])
}
func (st *CookieChecker) CreateReply(
msg []byte,
recv uint32,
2017-10-08 20:03:32 +00:00
src []byte,
2017-08-14 15:09:25 +00:00
) (*MessageCookieReply, error) {
st.mutex.RLock()
// refresh cookie secret
if time.Now().Sub(st.mac2.secretSet) > CookieRefreshTime {
st.mutex.RUnlock()
st.mutex.Lock()
_, err := rand.Read(st.mac2.secret[:])
if err != nil {
st.mutex.Unlock()
return nil, err
}
st.mac2.secretSet = time.Now()
st.mutex.Unlock()
st.mutex.RLock()
}
// derive cookie
var cookie [blake2s.Size128]byte
func() {
mac, _ := blake2s.New128(st.mac2.secret[:])
2017-10-08 20:03:32 +00:00
mac.Write(src)
2017-08-14 15:09:25 +00:00
mac.Sum(cookie[:0])
}()
// encrypt cookie
size := len(msg)
smac2 := size - blake2s.Size128
smac1 := smac2 - blake2s.Size128
reply := new(MessageCookieReply)
reply.Type = MessageCookieReplyType
reply.Receiver = recv
_, err := rand.Read(reply.Nonce[:])
if err != nil {
st.mutex.RUnlock()
return nil, err
}
2018-12-10 03:23:17 +00:00
xchapoly, _ := chacha20poly1305.NewX(st.mac2.encryptionKey[:])
xchapoly.Seal(reply.Cookie[:0], reply.Nonce[:], cookie[:], msg[smac1:smac2])
2017-08-14 15:09:25 +00:00
st.mutex.RUnlock()
return reply, nil
}
func (st *CookieGenerator) Init(pk NoisePublicKey) {
st.mutex.Lock()
defer st.mutex.Unlock()
func() {
2018-05-14 10:27:29 +00:00
hash, _ := blake2s.New256(nil)
hash.Write([]byte(WGLabelMAC1))
hash.Write(pk[:])
hash.Sum(st.mac1.key[:0])
2017-08-14 15:09:25 +00:00
}()
func() {
2018-05-14 10:27:29 +00:00
hash, _ := blake2s.New256(nil)
hash.Write([]byte(WGLabelCookie))
hash.Write(pk[:])
hash.Sum(st.mac2.encryptionKey[:0])
2017-08-14 15:09:25 +00:00
}()
st.mac2.cookieSet = time.Time{}
}
func (st *CookieGenerator) ConsumeReply(msg *MessageCookieReply) bool {
st.mutex.Lock()
defer st.mutex.Unlock()
if !st.mac2.hasLastMAC1 {
return false
}
var cookie [blake2s.Size128]byte
2018-12-10 03:23:17 +00:00
xchapoly, _ := chacha20poly1305.NewX(st.mac2.encryptionKey[:])
_, err := xchapoly.Open(cookie[:0], msg.Nonce[:], msg.Cookie[:], st.mac2.lastMAC1[:])
2017-08-14 15:09:25 +00:00
if err != nil {
return false
}
st.mac2.cookieSet = time.Now()
st.mac2.cookie = cookie
return true
}
func (st *CookieGenerator) AddMacs(msg []byte) {
size := len(msg)
smac2 := size - blake2s.Size128
smac1 := smac2 - blake2s.Size128
mac1 := msg[smac1:smac2]
mac2 := msg[smac2:]
st.mutex.Lock()
defer st.mutex.Unlock()
// set mac1
func() {
mac, _ := blake2s.New128(st.mac1.key[:])
mac.Write(msg[:smac1])
mac.Sum(mac1[:0])
}()
copy(st.mac2.lastMAC1[:], mac1)
st.mac2.hasLastMAC1 = true
// set mac2
if time.Now().Sub(st.mac2.cookieSet) > CookieRefreshTime {
return
}
func() {
mac, _ := blake2s.New128(st.mac2.cookie[:])
mac.Write(msg[:smac2])
mac.Sum(mac2[:0])
}()
}