wireguard-go/device.go

397 lines
7.8 KiB
Go
Raw Normal View History

/* SPDX-License-Identifier: GPL-2.0
*
* Copyright (C) 2017-2018 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
*/
package main
import (
2018-02-12 22:48:09 +00:00
"./ratelimiter"
"runtime"
"sync"
"sync/atomic"
"time"
)
2018-05-05 04:00:38 +00:00
const (
DeviceRoutineNumberPerCPU = 3
)
type Device struct {
isUp AtomicBool // device is (going) up
isClosed AtomicBool // device is closed? (acting as guard)
log *Logger
// synchronized resources (locks acquired in order)
state struct {
2018-05-05 04:00:38 +00:00
stopping sync.WaitGroup
2018-02-04 15:46:24 +00:00
mutex sync.Mutex
changing AtomicBool
current bool
}
net struct {
2018-02-04 15:46:24 +00:00
mutex sync.RWMutex
bind Bind // bind interface
port uint16 // listening port
fwmark uint32 // mark value (0 = disabled)
}
2018-05-13 21:14:43 +00:00
staticIdentity struct {
2018-02-04 15:46:24 +00:00
mutex sync.RWMutex
privateKey NoisePrivateKey
publicKey NoisePublicKey
}
peers struct {
2018-02-04 15:46:24 +00:00
mutex sync.RWMutex
keyMap map[NoisePublicKey]*Peer
}
// unprotected / "self-synchronising resources"
2018-05-13 21:14:43 +00:00
allowedips AllowedIPs
indexTable IndexTable
cookieChecker CookieChecker
rate struct {
underLoadUntil atomic.Value
limiter ratelimiter.Ratelimiter
}
pool struct {
messageBuffers sync.Pool
}
queue struct {
2017-07-01 21:29:22 +00:00
encryption chan *QueueOutboundElement
decryption chan *QueueInboundElement
handshake chan QueueHandshakeElement
}
signals struct {
stop chan struct{}
}
tun struct {
device TUNDevice
mtu int32
}
2017-06-01 19:31:30 +00:00
}
/* Converts the peer into a "zombie", which remains in the peer map,
* but processes no packets and does not exists in the routing table.
*
2018-05-13 21:14:43 +00:00
* Must hold device.peers.mutex.
*/
func unsafeRemovePeer(device *Device, peer *Peer, key NoisePublicKey) {
2017-12-29 16:42:09 +00:00
// stop routing and processing of packets
2018-05-13 21:14:43 +00:00
device.allowedips.RemoveByPeer(peer)
peer.Stop()
// remove from peer map
delete(device.peers.keyMap, key)
}
func deviceUpdateState(device *Device) {
// check if state already being updated (guard)
if device.state.changing.Swap(true) {
return
}
2018-02-04 15:46:24 +00:00
// compare to current state of device
2018-02-04 15:46:24 +00:00
device.state.mutex.Lock()
2018-02-04 15:46:24 +00:00
newIsUp := device.isUp.Get()
2018-02-04 15:46:24 +00:00
if newIsUp == device.state.current {
device.state.changing.Set(false)
device.state.mutex.Unlock()
return
}
2018-02-04 15:46:24 +00:00
// change state of device
2018-02-04 15:46:24 +00:00
switch newIsUp {
case true:
if err := device.BindUpdate(); err != nil {
device.isUp.Set(false)
break
}
2018-05-13 21:14:43 +00:00
device.peers.mutex.RLock()
2018-02-04 15:46:24 +00:00
for _, peer := range device.peers.keyMap {
peer.Start()
}
2018-05-13 21:14:43 +00:00
device.peers.mutex.RUnlock()
2018-02-04 15:46:24 +00:00
case false:
device.BindClose()
2018-05-13 21:14:43 +00:00
device.peers.mutex.RLock()
2018-02-04 15:46:24 +00:00
for _, peer := range device.peers.keyMap {
peer.Stop()
}
2018-05-13 21:14:43 +00:00
device.peers.mutex.RUnlock()
2018-02-04 15:46:24 +00:00
}
2018-02-04 15:46:24 +00:00
// update state variables
2018-02-04 15:46:24 +00:00
device.state.current = newIsUp
device.state.changing.Set(false)
device.state.mutex.Unlock()
// check for state change in the mean time
deviceUpdateState(device)
2017-12-29 16:42:09 +00:00
}
func (device *Device) Up() {
// closed device cannot be brought up
2017-12-29 16:42:09 +00:00
if device.isClosed.Get() {
return
}
device.state.mutex.Lock()
device.isUp.Set(true)
device.state.mutex.Unlock()
deviceUpdateState(device)
}
func (device *Device) Down() {
device.state.mutex.Lock()
device.isUp.Set(false)
device.state.mutex.Unlock()
deviceUpdateState(device)
2017-12-29 16:42:09 +00:00
}
func (device *Device) IsUnderLoad() bool {
// check if currently under load
now := time.Now()
underLoad := len(device.queue.handshake) >= UnderLoadQueueSize
if underLoad {
2018-05-13 16:42:06 +00:00
device.rate.underLoadUntil.Store(now.Add(UnderLoadAfterTime))
return true
}
// check if recently under load
until := device.rate.underLoadUntil.Load().(time.Time)
return until.After(now)
}
2017-08-04 14:15:53 +00:00
func (device *Device) SetPrivateKey(sk NoisePrivateKey) error {
// lock required resources
2018-05-13 21:14:43 +00:00
device.staticIdentity.mutex.Lock()
defer device.staticIdentity.mutex.Unlock()
device.peers.mutex.Lock()
defer device.peers.mutex.Unlock()
for _, peer := range device.peers.keyMap {
peer.handshake.mutex.RLock()
defer peer.handshake.mutex.RUnlock()
}
2017-06-24 13:34:17 +00:00
// remove peers with matching public keys
2017-08-04 14:15:53 +00:00
publicKey := sk.publicKey()
for key, peer := range device.peers.keyMap {
if peer.handshake.remoteStatic.Equals(publicKey) {
unsafeRemovePeer(device, peer, key)
2017-08-04 14:15:53 +00:00
}
}
2017-06-24 13:34:17 +00:00
// update key material
2018-05-13 21:14:43 +00:00
device.staticIdentity.privateKey = sk
device.staticIdentity.publicKey = publicKey
device.cookieChecker.Init(publicKey)
2017-06-24 13:34:17 +00:00
// do static-static DH pre-computations
2018-05-13 21:14:43 +00:00
rmKey := device.staticIdentity.privateKey.IsZero()
2017-06-24 13:34:17 +00:00
for key, peer := range device.peers.keyMap {
hs := &peer.handshake
2017-08-04 14:15:53 +00:00
if rmKey {
hs.precomputedStaticStatic = [NoisePublicKeySize]byte{}
2017-08-04 14:15:53 +00:00
} else {
2018-05-13 21:14:43 +00:00
hs.precomputedStaticStatic = device.staticIdentity.privateKey.sharedSecret(hs.remoteStatic)
}
if isZero(hs.precomputedStaticStatic[:]) {
unsafeRemovePeer(device, peer, key)
2017-08-04 14:15:53 +00:00
}
2017-06-23 11:41:59 +00:00
}
2017-08-04 14:15:53 +00:00
return nil
2017-06-23 11:41:59 +00:00
}
func (device *Device) GetMessageBuffer() *[MaxMessageSize]byte {
return device.pool.messageBuffers.Get().(*[MaxMessageSize]byte)
}
func (device *Device) PutMessageBuffer(msg *[MaxMessageSize]byte) {
device.pool.messageBuffers.Put(msg)
}
2017-11-14 17:26:28 +00:00
func NewDevice(tun TUNDevice, logger *Logger) *Device {
device := new(Device)
2017-06-24 13:34:17 +00:00
2017-12-29 16:42:09 +00:00
device.isUp.Set(false)
device.isClosed.Set(false)
2017-11-14 17:26:28 +00:00
device.log = logger
2018-04-18 14:39:14 +00:00
device.tun.device = tun
2018-04-18 14:39:14 +00:00
mtu, err := device.tun.device.MTU()
if err != nil {
2018-04-19 13:52:59 +00:00
logger.Error.Println("Trouble determining MTU, assuming default:", err)
mtu = DefaultMTU
2018-04-18 14:39:14 +00:00
}
device.tun.mtu = int32(mtu)
device.peers.keyMap = make(map[NoisePublicKey]*Peer)
2018-05-13 16:42:06 +00:00
// initialize rate limiter
device.rate.limiter.Init()
device.rate.underLoadUntil.Store(time.Time{})
2018-05-13 21:14:43 +00:00
// initialize staticIdentity & crypt-key routine
2018-05-13 16:23:40 +00:00
device.indexTable.Init()
2018-05-13 21:14:43 +00:00
device.allowedips.Reset()
// setup buffer pool
device.pool.messageBuffers = sync.Pool{
New: func() interface{} {
return new([MaxMessageSize]byte)
},
}
// create queues
2017-07-01 21:29:22 +00:00
device.queue.handshake = make(chan QueueHandshakeElement, QueueHandshakeSize)
2017-07-07 11:47:09 +00:00
device.queue.encryption = make(chan *QueueOutboundElement, QueueOutboundSize)
2017-07-01 21:29:22 +00:00
device.queue.decryption = make(chan *QueueInboundElement, QueueInboundSize)
// prepare signals
device.signals.stop = make(chan struct{}, 1)
2017-11-11 14:43:55 +00:00
// prepare net
device.net.port = 0
device.net.bind = nil
// start workers
2018-05-05 04:00:38 +00:00
cpus := runtime.NumCPU()
device.state.stopping.Add(DeviceRoutineNumberPerCPU * cpus)
for i := 0; i < cpus; i += 1 {
go device.RoutineEncryption()
2017-07-01 21:29:22 +00:00
go device.RoutineDecryption()
go device.RoutineHandshake()
}
2017-12-01 22:37:26 +00:00
go device.RoutineReadFromTUN()
go device.RoutineTUNEventReader()
2017-12-01 22:37:26 +00:00
return device
2017-06-24 13:34:17 +00:00
}
func (device *Device) LookupPeer(pk NoisePublicKey) *Peer {
device.peers.mutex.RLock()
defer device.peers.mutex.RUnlock()
return device.peers.keyMap[pk]
2017-06-24 13:34:17 +00:00
}
func (device *Device) RemovePeer(key NoisePublicKey) {
device.peers.mutex.Lock()
defer device.peers.mutex.Unlock()
// stop peer and remove from routing
peer, ok := device.peers.keyMap[key]
if ok {
unsafeRemovePeer(device, peer, key)
}
2017-06-01 19:31:30 +00:00
}
2017-06-24 13:34:17 +00:00
func (device *Device) RemoveAllPeers() {
device.peers.mutex.Lock()
defer device.peers.mutex.Unlock()
for key, peer := range device.peers.keyMap {
unsafeRemovePeer(device, peer, key)
2017-06-01 19:31:30 +00:00
}
device.peers.keyMap = make(map[NoisePublicKey]*Peer)
}
2018-05-05 04:00:38 +00:00
func (device *Device) FlushPacketQueues() {
for {
select {
case elem, ok := <-device.queue.decryption:
if ok {
elem.Drop()
}
case elem, ok := <-device.queue.encryption:
if ok {
elem.Drop()
}
case <-device.queue.handshake:
default:
return
}
}
}
func (device *Device) Close() {
2017-12-29 16:42:09 +00:00
if device.isClosed.Swap(true) {
return
}
device.log.Info.Println("Device closing")
device.state.changing.Set(true)
device.state.mutex.Lock()
defer device.state.mutex.Unlock()
2017-11-11 22:26:44 +00:00
device.tun.device.Close()
device.BindClose()
device.isUp.Set(false)
close(device.signals.stop)
2018-05-05 04:00:38 +00:00
device.state.stopping.Wait()
device.FlushPacketQueues()
device.RemoveAllPeers()
2018-02-11 21:53:39 +00:00
device.rate.limiter.Close()
device.state.changing.Set(false)
device.log.Info.Println("Interface closed")
}
2017-12-01 22:37:26 +00:00
func (device *Device) Wait() chan struct{} {
return device.signals.stop
}