diff options
| author |   Alexander Chernavin <achernavin@netgate.com> | 2022-07-20 13:01:42 +0000 |
|---|---|---|
| committer |   Matthew Smith <mgsmith@netgate.com> | 2022-08-09 15:42:43 +0000 |
| commit | a6328e51e0c831ba3f0f4977f776491ac44eaec5 (patch) | |
| tree | 2824c830f35554ed16887be32065d48f66809c34 /src/plugins/wireguard/wireguard_if.c | |
| parent | fd2417b2a42e34062e3d07875e5c4e11922513d5 (diff) | |
wireguard: add handshake rate limiting support
Type: feature
With this change, if being under load a handshake message with both
valid mac1 and mac2 is received, the peer will be rate limited. Cover
this with tests.
Signed-off-by: Alexander Chernavin <achernavin@netgate.com>
Change-Id: Id8d58bb293a7975c3d922c48b4948fd25e20af4b
Diffstat (limited to 'src/plugins/wireguard/wireguard_if.c')
| -rw-r--r-- | src/plugins/wireguard/wireguard_if.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/plugins/wireguard/wireguard_if.c b/src/plugins/wireguard/wireguard_if.c index c4199d23354..a869df08ce2 100644 --- a/src/plugins/wireguard/wireguard_if.c +++ b/src/plugins/wireguard/wireguard_if.c @@ -34,6 +34,9 @@ static index_t *wg_if_index_by_sw_if_index; /* vector of interfaces key'd on their UDP port (in network order) */ index_t **wg_if_indexes_by_port; +/* pool of ratelimit entries */ +static ratelimit_entry_t *wg_ratelimit_pool; + static u8 * format_wg_if_name (u8 * s, va_list * args) { @@ -309,6 +312,7 @@ wg_if_create (u32 user_instance, wg_if->port = port; wg_if->local_idx = local - noise_local_pool; + cookie_checker_init (&wg_if->cookie_checker, wg_ratelimit_pool); cookie_checker_update (&wg_if->cookie_checker, local->l_public); hw_if_index = vnet_register_interface (vnm, @@ -372,6 +376,8 @@ wg_if_delete (u32 sw_if_index) udp_unregister_dst_port (vlib_get_main (), wg_if->port, 0); } + cookie_checker_deinit (&wg_if->cookie_checker); + vnet_reset_interface_l3_output_node (vnm->vlib_main, sw_if_index); vnet_delete_hw_interface (vnm, hw->hw_if_index); pool_put_index (noise_local_pool, wg_if->local_idx); |