diff options
| author |   Alexander Chernavin <achernavin@netgate.com> | 2022-07-20 10:48:56 +0000 |
|---|---|---|
| committer |   Matthew Smith <mgsmith@netgate.com> | 2022-08-03 18:35:40 +0000 |
| commit | 44ec846f4ad1c11cc596c9fa6b73284511131ed4 (patch) | |
| tree | 795b7243e2fa5a628dc9fabe407dcf76ee2600b2 /src/plugins/wireguard/wireguard_input.c | |
| parent | 818806062cd36a816fd778c6993d20d442d3d3ac (diff) | |
wireguard: add processing of received cookie messages
Type: feature
Currently, if a handshake message is sent and a cookie message is
received in reply, the cookie message will be ignored. Thus, further
handshake messages will not have valid mac2 and handshake will not be
able to be completed.
With this change, process received cookie messages to be able to
calculate mac2 for further handshake messages sent. Cover this with
tests.
Signed-off-by: Alexander Chernavin <achernavin@netgate.com>
Change-Id: I6d51459778b7145be7077badec479b2aa85960b9
Diffstat (limited to 'src/plugins/wireguard/wireguard_input.c')
| -rw-r--r-- | src/plugins/wireguard/wireguard_input.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/src/plugins/wireguard/wireguard_input.c b/src/plugins/wireguard/wireguard_input.c index 3eba9cbf75f..ef60d50c3da 100644 --- a/src/plugins/wireguard/wireguard_input.c +++ b/src/plugins/wireguard/wireguard_input.c @@ -31,6 +31,7 @@ _ (KEEPALIVE_SEND, "Failed while sending Keepalive") \ _ (HANDSHAKE_SEND, "Failed while sending Handshake") \ _ (HANDSHAKE_RECEIVE, "Failed while receiving Handshake") \ + _ (COOKIE_DECRYPTION, "Failed during Cookie decryption") \ _ (TOO_BIG, "Packet too big") \ _ (UNDEFINED, "Undefined error") \ _ (CRYPTO_ENGINE_ERROR, "crypto engine error (packet dropped)") @@ -185,7 +186,9 @@ wg_handshake_process (vlib_main_t *vm, wg_main_t *wmp, vlib_buffer_t *b, else return WG_INPUT_ERROR_PEER; - // TODO: Implement cookie_maker_consume_payload + if (!cookie_maker_consume_payload ( + vm, &peer->cookie_maker, packet->nonce, packet->encrypted_cookie)) + return WG_INPUT_ERROR_COOKIE_DECRYPTION; return WG_INPUT_ERROR_NONE; } |