summaryrefslogtreecommitdiffstats
path: root/src/plugins/wireguard
AgeCommit message (Collapse)AuthorFilesLines
2022-08-14wireguard: increment interface RX countersMatthew Smith1-0/+15
Type: improvement When packets were received and processed successfully, increment the byte/packet counters for the tunnel interface. Change-Id: I42855607ac6916de641be42aac86c9942cc97140 Signed-off-by: Matthew Smith <mgsmith@netgate.com> (cherry picked from commit 42928beec9f4dc87dcf61332a39801a454c1d7bc)
2022-04-28wireguard: Document wireguard async mode defaultJon Loeliger1-2/+2
Type: improvement Signed-off-by: Jon Loeliger <jdl@netgate.com> Change-Id: I446eb86c097d1bf99f05ee47f1c550689d70ced2
2022-04-05wireguard: prevent segfault on non-adj packetsJon Loeliger2-0/+7
An unexpected packet that shows up on a Wireguard interace that happens not to have a forwarding peer will cause a segfault trying to index the vector of peers by adjacency. Rather than segfaulting, recognize a non-adjacent packet and drop it instead. This leaves open the question of what _should_ be happening to, say, IPv6 multicast packets. Signed-off-by: Jon Loeliger <jdl@netgate.com> Type: fix Fixes: edca1325cf296bd0f5ff422fc12de2ce7a7bad88 Change-Id: Ic0a29e6cf6fe812a4895ec11bedcca86c62e590b
2022-03-21wireguard: dont stacksmash bad peer base64 keysJon Loeliger1-1/+1
Just like commit 252647482b24bb3474e8f13bc86100718176832f did for Wireguard interface keys, prevent stack smashing the peer keys. Integer math on 32 bytes of base64 data might yield 33 bytes of data in some poorly formed user input of private key values. Rather than smashing the stack (detected) and aborting, simply allow for the possible yet irrelevant 33-rd byte of data. Type: fix Fixes: edca1325cf296bd0f5ff422fc12de2ce7a7bad88 Signed-off-by: Jon Loeliger <jdl@netgate.com> Change-Id: I9f77b3faaaa01d3123b356c958db60c87238db9c
2022-03-21wireguard: improve peer dump detailsJon Loeliger2-11/+22
- Add peer_index, table_id, and keep-alive. - Fix some lingering cut-n-paste issues in the API file. Type: improvement Signed-off-by: Jon Loeliger <jdl@netgate.com> Change-Id: I6fc0729ba0268bbcda0248f680979c44e68b6b0c
2022-03-02wireguard: improve sending WG interface dump detailsJon Loeliger2-2/+11
Include the user_instance in wireguard interface details. In addition to dumping all wireguard interface details, also allow selective dumping of just one interface. Type: improvement Signed-off-by: Jon Loeliger <jdl@netgate.com> Change-Id: Iaf1093c6ae3eb00a685f34b2e0171285b02fae2b
2022-02-23wireguard: fix dereferences null pointerGabriel Oginski2-14/+21
Type: fix Fixed coverity-issue CID 248517. Originally possible passing null pointer to one function and directly dereferences it. This patch fixes the issue by add a new condition to check this pointer. Change-Id: If506abaf08c9f003860b641971af291f68613c18 Signed-off-by: Gabriel Oginski <gabrielx.oginski@intel.com>
2022-02-22wireguard: prevent stacksmashing on poorly formed base64 keysJon Loeliger1-1/+1
Integer math on 32 bytes of base64 data might yield 33 bytes of data in some poorly formed user input of private key values. Rather than smashing the stack (detected) and aborting, simply allow for the possible yet irrelevant 33-rd byte of data. Type: fix Fixes: edca1325cf296bd0f5ff422fc12de2ce7a7bad88 Change-Id: I42acfbf3e8fbb3d517e21c53d4f80459d4800e9d Signed-off-by: Jon Loeliger <jdl@netgate.com>
2022-02-18wireguard: fix passing null pointerGabriel Oginski2-10/+11
Type: fix Fixed coverity-issue CID 248517. Originally possibly passing null pointer to one function and directly dereferences it. This patch fixes the problem by add a new condition. Signed-off-by: Gabriel Oginski <gabrielx.oginski@intel.com> Change-Id: I02fc6fb5d1cfd6138ea4ba2b1946fd8a7ef34d3b
2022-02-17wireguard: Fix wireguard device name to use user-instanceJon Loeliger1-1/+2
If the user supplies an instance number when creating a wireguard interface, it should be used in the device name. If no user-instance is given, the device instnce (tunnel number) is used. For example: vpp# wireguard create instance 17 listen-port 23023 src 1.2.3.4 private-key MDEwMjAzMDQwNTA2MDcwODA5MTAxMTEyMTMxNDE1MTY= wg17 Type: fix Fixes: edca1325cf296bd0f5ff422fc12de2ce7a7bad88 Signed-off-by: Jon Loeliger <jdl@netgate.com> Change-Id: Ibf51868bf7b4b9e8a3f85557d05667207873bc91
2022-02-15tcp: Do not include the tcp_packet.h file in the ip4_packet.hNeale Ranns1-0/+1
Type: refactor IP4 does not depend on TCP (it's the other way around). This upside down dependency leads to some nasty circular includes when trying to use ip46_address.h in interface.h Signed-off-by: Neale Ranns <neale@graphiant.com> Change-Id: I4a1bd21543b08b9c1cf1e5563da738414734a878
2022-01-24wireguard: fix passing argumentGabriel Oginski1-1/+1
Fixed coverity-issue CID 248456. Originally passing argument of type "uint64_t *" to function: "memcopy_s_inline". This patch fixes the problem by changing type of passing argument and make a portable assumption. Type: fix Signed-off-by: Gabriel Oginski <gabrielx.oginski@intel.com> Change-Id: I17e4583a05ea1263e4d8a4acc9949454e5fd92c0
2022-01-21wireguard: add async mode for decryption packetsGabriel Oginski5-217/+445
Originally wireguard doesn't support async mode for decryption packets. This patch add async mode for decryption in wireguard. In addition, it contains some performance improvement such as prefetching packet header and reducing the number of current time function calls. Type: improvement Signed-off-by: Gabriel Oginski <gabrielx.oginski@intel.com> Change-Id: Ieba6ae0078f3ff140c05b517891afb57232b3b7d
2022-01-21wireguard: add async mode for encryption packetsGabriel Oginski10-98/+606
Originally wireguard doesn't support async mode for encryption packets. This patch add async mode for encryption in wireguard and also adds support chacha20-poly1305 algorithm in cryptodev for async handler. In addition it contains new command line to activate async mode for wireguard: set wireguard async mode on|off and also add new command to check active mode for wireguard: show wireguard mode Type: improvement Signed-off-by: Gabriel Oginski <gabrielx.oginski@intel.com> Change-Id: I141d48b42ee8dbff0112b8542ab5205268089da6
2022-01-20wireguard: add burst modeGabriel Oginski7-181/+538
Originally wireguard does packet by packet encryption and decryption. This patch adds burst mode for encryption and decryption packets. In addition, it contains some performance improvement such as prefetching packet header and reducing the number of current time function calls. Type: improvement Signed-off-by: Gabriel Oginski <gabrielx.oginski@intel.com> Change-Id: I04c7daa9b6dc56cd15c789661a64ec642b35aa3f
2022-01-05wireguard: fix 'wireguard add peer' cli behaviorMiroslav Miklus1-6/+6
- change 'port' to 'dst-port' to make the input self-explanatory - add empty spaces to short help Type: fix Signed-off-by: Miroslav Miklus <miroslav.miklus@pantheon.tech> Change-Id: I74c783e6e8629e61b1c100e9355d09cf5e35a750
2021-11-22wireguard: add local variable in handshake processGabriel Oginski1-2/+4
Originally handshake process gets pointer to value of index peer. In the meantime this pointer can be invalid due to resize hash table for wireguard and passed poison value to another function. The fixes add local variable to keep index of peer instead of value from pointer. Type: fix Signed-off-by: Gabriel Oginski <gabrielx.oginski@intel.com> Change-Id: I1b2535c44b4f987d19077c75c778aaa5ed71a457
2021-11-19fib: Don't use [midchain] adjacencies to change an interface's feature arcNeale Ranns1-0/+3
Type: fix Using the adjacency to modify the interface's feature arc doesn't work, since there are potentially more than one adj per-interface. Instead have the interface, when it is created, register what the end node of the feature arc is. This end node is then also used as the interface's tx node (i.e. it is used as the adjacency's next-node). rename adj-midhcain-tx as 'tunnel-output', that's a bit more intuitive. There's also a fix in config string handling to: 1- prevent false sharing of strings when the end node of the arc is different. 2- call registered listeners when the end node is changed For IPSec the consequences are that one cannot provide per-adjacency behaviour using different end-nodes - this was previously done for the no-SA and an SA with no protection. These cases are no handled in the esp-encrypt node. Signed-off-by: Neale Ranns <neale@graphiant.com> Change-Id: If3a83d03a3000f28820d9a9cb4101d244803d084
2021-11-03wireguard: reduce memcopy and prefetch headerGabriel Oginski6-35/+48
Originally wireguard implementation does memory copy of the whole packet in encryption and decryption. This patch removes unnecessary packet copy in wireguard. In addition, it contains some performance improvement such as prefetching header and deleting unnecessary lock and unlock for decryption. Type: improvement Signed-off-by: Gabriel Oginski <gabrielx.oginski@intel.com> Change-Id: I1fe8e54d749e6922465341083b448c842e2b670f
2021-11-02build: remove unnecessary executable bitsRay Kinsella15-0/+0
Run 'find src -executable -type f', remove unnecessary executable bits from the source tree. Type: refactor Signed-off-by: Ray Kinsella <mdr@ashroe.eu> Change-Id: I070e22c8fb2ef8712bc3ea620727ee5ab3d9a9fb
2021-10-13docs: convert plugins doc md->rstNathan Skrzypczak2-60/+81
Type: improvement Change-Id: I7e821cce1feae229e1be4baeed249b9cca658135 Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com>
2021-10-07wireguard: peers dump fixArtem Glazychev1-1/+1
Type: fix Signed-off-by: Artem Glazychev <artem.glazychev@xored.com> Change-Id: I4450b8c8b50a3be8d6a399f6a58bc0e8eb500b28
2021-10-06wireguard: add events for peerArtem Glazychev8-33/+223
we can receive events from peer about its state: -WIREGUARD_PEER_STATUS_DEAD -WIREGUARD_PEER_ESTABLISHED Type: improvement Change-Id: Ide83fbe2cfafa79ded5bcf3f6a884c26a7583db0 Signed-off-by: Artem Glazychev <artem.glazychev@xored.com>
2021-10-06wireguard: add ipv6 supportArtem Glazychev14-193/+517
Type: improvement Signed-off-by: Artem Glazychev <artem.glazychev@xored.com> Change-Id: If1a7e82ce163c4c4acaa5acf45ad2b88371396f6
2021-10-04wireguard: use the same udp-port for multi-tunnelArtem Glazychev5-29/+62
now we can reuse udp-port for many wireguard interfaces Type: improvement Change-Id: I14b5a9dbe917d83300ccb4d6907743d88355e5c5 Signed-off-by: Artem Glazychev <artem.glazychev@xored.com>
2021-09-30wireguard: move adjacency processing from wireguard_peer to wireguard_interfaceArtem Glazychev7-233/+123
now we should add routes manually Type: improvement Change-Id: I877511a18854efdfad02939267d38a216b2ccec3 Signed-off-by: Artem Glazychev <artem.glazychev@xored.com>
2021-09-23wireguard: fix wg-output-tun feature configurationAloys Augustin1-3/+0
The removed code caused the feature to be wrongly removed on the wg interface. Type: fix Signed-off-by: Aloys Augustin <aloaugus@cisco.com> Change-Id: I998e01ec231527128eaeae78bcc7576ac00e5b12
2021-08-13wireguard: add flag to check hmac for decryptionGabriel Oginski1-0/+1
Type: fix Originally the decryption doesn't check the hmac for chacha20-poly1305. This patch fixes the problem by adding flag to crypto op to check hmac. Signed-off-by: Gabriel Oginski <gabrielx.oginski@intel.com> Change-Id: I63e06fc011b288b1c9dc1b96a92923f224ef656b
2021-05-21bfd: use vnet cryptoKlement Sekera1-0/+4
Type: improvement Change-Id: I873a99c1258a97ed5ed195b9756e8302f865e7f0 Signed-off-by: Klement Sekera <ksekera@cisco.com> Signed-off-by: Filip Tehlar <ftehlar@cisco.com>
2021-05-14vlib: pass node runtime to vlib_buffer_enqueue_to_thread()Damjan Marion1-1/+1
Mechanical change for patch following this one... Type: improvement Change-Id: Iee12f3a8851f35569e6c039494a94fc36e83d20f Signed-off-by: Damjan Marion <damarion@cisco.com>
2021-05-13tests: move test source to vpp/testDave Wallace1-748/+0
- Generate copyright year and version instead of using hard-coded data Type: refactor Signed-off-by: Dave Wallace <dwallacelf@gmail.com> Change-Id: I6058f5025323b3aa483f5df4a2c4371e27b5914e
2021-03-20tests: add support for worker awarenessKlement Sekera1-1/+1
VppTestCase now has vpp_worker_count property set to number of workers. This can be overriden by child classes. Also overriden by VPP_WORKER_CONFIG variable for legacy reasons. Type: improvement Change-Id: Ic328bacb9003ddf9e92815767653bd362aa7f086 Signed-off-by: Klement Sekera <ksekera@cisco.com>
2021-02-24wireguard: coverity fixArtem Glazychev1-11/+12
explicit null dereferenced Type: fix Signed-off-by: Artem Glazychev <artem.glazychev@xored.com> Change-Id: Id1e4b0e048dbd0a68063c63374172ab6d3653aff
2021-02-15vlib: refactor checksum offload supportMohsin Kazmi1-1/+2
Type: refactor This patch refactors the offload flags in vlib_buffer_t. There are two main reasons behind this refactoring. First, offload flags are insufficient to represent outer and inner headers offloads. Second, room for these flags in first cacheline of vlib_buffer_t is also limited. This patch introduces a generic offload flag in first cacheline. And detailed offload flags in 2nd cacheline of the structure for performance optimization. Change-Id: Icc363a142fb9208ec7113ab5bbfc8230181f6004 Signed-off-by: Mohsin Kazmi <sykazmi@cisco.com>
2021-02-11wireguard: testing alternative timer dispatchMohammed Hawari3-3/+10
Change-Id: I645bb0a31b333a6160c74987dddb3fb50ff154d8 Type: improvement Signed-off-by: Mohammed Hawari <mohammed@hawari.fr>
2021-02-01docs: fix up the markdownAndrew Yourtchenko1-1/+1
Type: docs Change-Id: Ia541839e1f1ceddfae4579dece43b9cc820702e2 Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com> (cherry picked from commit de569048a504cf211d80b86882e6781684301790)
2020-12-14misc: move to new pool_foreach macrosDamjan Marion2-7/+7
Type: refactor Change-Id: Ie67dc579e88132ddb1ee4a34cb69f96920101772 Signed-off-by: Damjan Marion <damarion@cisco.com>
2020-12-06wireguard: run feature after gsoNathan Skrzypczak1-0/+1
This allows using GSO with wireguard Type: fix Change-Id: Id00a1425f9d9412aca9f259beda55a46bf5595d7 Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com>
2020-12-01wireguard: return public key in apiNathan Skrzypczak2-2/+9
Type: feature Change-Id: Iacb0da8bc738ed400678f9bb40e70e0031c6588e Signed-off-by: Nathan Skrzypczak <nathan.skrzypczak@gmail.com>
2020-10-21misc: minimize dependencies on udp.hFlorin Coras2-2/+0
Type: improvement Signed-off-by: Florin Coras <fcoras@cisco.com> Change-Id: Id13f33843b230a1d169560742c4f7b2dc17d8718
2020-10-20wireguard: reset secret data before freeing itBenoît Ganne1-4/+4
Type: fix Change-Id: I880bdd55ae5da0b9775a3fb548d44512348a7bc6 Signed-off-by: Benoît Ganne <bganne@cisco.com>
2020-10-09wireguard: park the timer processDave Barach5-2/+68
Until the feature is configured. It would make sense to push more of the feature init code into the newly-added wg_feature_init() function. This patch fixes a severe hemorrhoid. Type: improvement Signed-off-by: Dave Barach <dave@barachs.net> Change-Id: I87095575363baa41407dd52492159a7b8c2899e7
2020-10-07misc: Purge unused pg includesNeale Ranns2-2/+0
Type: style Signed-off-by: Neale Ranns <nranns@cisco.com> Change-Id: I26a19e42076e031ec5399d5ca05cb49fd6fbe1cd
2020-09-30wireguard: fix udp-port registrationArtem Glazychev2-3/+10
Type: fix Signed-off-by: Artem Glazychev <artem.glazychev@xored.com> Change-Id: I698ef299316004b797da1e74b64d067caac4bd2d
2020-09-29wireguard: fix license headersArtem Glazychev13-2/+25
Type: fix Signed-off-by: Artem Glazychev <artem.glazychev@xored.com> Change-Id: If5cc8894e0d1785dd04ab1e460e017580c9b41ce
2020-09-29wireguard: fix indentsArtem Glazychev1-21/+35
Type: fix Signed-off-by: Artem Glazychev <artem.glazychev@xored.com> Change-Id: I84cd7b08eac62160cf407409d32dd40cec7ae9d6
2020-09-29wireguard: readme fixArtem Glazychev1-36/+17
Type: fix Signed-off-by: Artem Glazychev <artem.glazychev@xored.com> Change-Id: I0080a158fc3e17dfdd360f6ba164e3bfa3d585a6
2020-09-24wireguard: coverity fixArtem Glazychev1-1/+1
Type: fix Change-Id: Ib69b9d83a77d315368ce091085b6bc2d26994282 Signed-off-by: Artem Glazychev <artem.glazychev@xored.com>
2020-09-23wireguard: add handoff nodeArtem Glazychev18-448/+889
All timer and control plane functions happen from main thread Type: fix Change-Id: I4fc333c644485cd17e6f426493feef91688d9b24 Signed-off-by: Artem Glazychev <artem.glazychev@xored.com>
2020-09-14wireguard: coverity fixesNeale Ranns2-6/+10
Type: fix Signed-off-by: Neale Ranns <nranns@cisco.com> Change-Id: Ib1eabbc87a573c660ac251602d631f167928259b