/* * Copyright (c) 2020 Cisco and/or its affiliates. * Copyright (c) 2020 Doc.ai and/or its affiliates. * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at: * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ #include <vnet/vnet.h> #include <vlibmemory/api.h> #include <vnet/format_fns.h> #include <vnet/ip/ip_types_api.h> #include <vlibapi/api.h> #include <wireguard/wireguard.api_enum.h> #include <wireguard/wireguard.api_types.h> #include <wireguard/wireguard_key.h> #include <wireguard/wireguard.h> #include <wireguard/wireguard_if.h> #include <wireguard/wireguard_peer.h> #define REPLY_MSG_ID_BASE wmp->msg_id_base #include <vlibapi/api_helper_macros.h> static void vl_api_wireguard_interface_create_t_handler (vl_api_wireguard_interface_create_t * mp) { vl_api_wireguard_interface_create_reply_t *rmp; wg_main_t *wmp = &wg_main; u8 private_key[NOISE_PUBLIC_KEY_LEN]; ip_address_t src; u32 sw_if_index = ~0; int rv = 0; wg_feature_init (wmp); ip_address_decode2 (&mp->interface.src_ip, &src); if (AF_IP6 == ip_addr_version (&src)) rv = VNET_API_ERROR_INVALID_PROTOCOL; else { if (mp->generate_key) curve25519_gen_secret (private_key); else clib_memcpy (private_key, mp->interface.private_key, NOISE_PUBLIC_KEY_LEN); rv = wg_if_create (ntohl (mp->interface.user_instance), private_key, ntohs (mp->interface.port), &src, &sw_if_index); } /* *INDENT-OFF* */ REPLY_MACRO2(VL_API_WIREGUARD_INTERFACE_CREATE_REPLY, { rmp->sw_if_index = htonl(sw_if_index); }); /* *INDENT-ON* */ } static void vl_api_wireguard_interface_delete_t_handler (vl_api_wireguard_interface_delete_t * mp) { vl_api_wireguard_interface_delete_reply_t *rmp; wg_main_t *wmp = &wg_main; int rv = 0; wg_feature_init (wmp); VALIDATE_SW_IF_INDEX (mp); rv = wg_if_delete (ntohl (mp->sw_if_index)); BAD_SW_IF_INDEX_LABEL; /* *INDENT-OFF* */ REPLY_MACRO(VL_API_WIREGUARD_INTERFACE_DELETE_REPLY); /* *INDENT-ON* */ } typedef struct wg_deatils_walk_t_ { vl_api_registration_t *reg; u32 context; u8 show_private_key; } wg_deatils_walk_t; static walk_rc_t wireguard_if_send_details (index_t wgii, void *data) { vl_api_wireguard_interface_details_t *rmp; wg_deatils_walk_t *ctx = data; const wg_if_t *wgi; const noise_local_t *local; wgi = wg_if_get (wgii); local = noise_local_get (wgi->local_idx); rmp = vl_msg_api_alloc_zero (sizeof (*rmp)); rmp->_vl_msg_id = htons (VL_API_WIREGUARD_INTERFACE_DETAILS + wg_main.msg_id_base); if (ctx->show_private_key) clib_memcpy (rmp->interface.private_key, local->l_private, NOISE_PUBLIC_KEY_LEN); clib_memcpy (rmp->interface.public_key, local->l_public, NOISE_PUBLIC_KEY_LEN); rmp->interface.sw_if_index = htonl (wgi->sw_if_index); rmp->interface.port = htons (wgi->port); ip_address_encode2 (&wgi->src_ip, &rmp->interface.src_ip); rmp->context = ctx->context; vl_api_send_msg (ctx->reg, (u8 *) rmp); return (WALK_CONTINUE); } static void vl_api_wireguard_interface_dump_t_handler (vl_api_wireguard_interface_dump_t * mp) { vl_api_registration_t *reg; wg_main_t *wmp = &wg_main; wg_feature_init (wmp); reg = vl_api_client_index_to_registration (mp->client_index); if (reg == 0) return; wg_deatils_walk_t ctx = { .reg = reg, .context = mp->context, .show_private_key = mp->show_private_key, }; wg_if_walk (wireguard_if_send_details, &ctx); } static void vl_api_wireguard_peer_add_t_handler (vl_api_wireguard_peer_add_t * mp) { vl_api_wireguard_peer_add_reply_t *rmp; wg_main_t *wmp = &wg_main; index_t peeri = INDEX_INVALID; int ii, rv = 0; ip_address_t endpoint; fib_prefix_t *allowed_ips = NULL; VALIDATE_SW_IF_INDEX (&(mp->peer)); if (0 == mp->peer.n_allowed_ips) { rv = VNET_API_ERROR_INVALID_VALUE; goto done; } wg_feature_init (wmp); vec_validate (allowed_ips, mp->peer.n_allowed_ips - 1); ip_address_decode2 (&mp->peer.endpoint, &endpoint); for (ii = 0; ii < mp->peer.n_allowed_ips; ii++) ip_prefix_decode (&mp->peer.allowed_ips[ii], &allowed_ips[ii]); if (AF_IP6 == ip_addr_version (&endpoint) || FIB_PROTOCOL_IP6 == allowed_ips[0].fp_proto) /* ip6 currently not supported, but the API needs to support it * else we'll need to change it later, and that's a PITA */ rv = VNET_API_ERROR_INVALID_PROTOCOL; else rv = wg_peer_add (ntohl (mp->peer.sw_if_index), mp->peer.public_key, ntohl (mp->peer.table_id), &ip_addr_46 (&endpoint), allowed_ips, ntohs (mp->peer.port), ntohs (mp->peer.persistent_keepalive), &peeri); vec_free (allowed_ips); done: BAD_SW_IF_INDEX_LABEL; /* *INDENT-OFF* */ REPLY_MACRO2(VL_API_WIREGUARD_PEER_ADD_REPLY, { rmp->peer_index = ntohl (peeri); }); /* *INDENT-ON* */ } static void vl_api_wireguard_peer_remove_t_handler (vl_api_wireguard_peer_remove_t * mp) { vl_api_wireguard_peer_remove_reply_t *rmp; wg_main_t *wmp = &wg_main; int rv = 0; wg_feature_init (wmp); rv = wg_peer_remove (ntohl (mp->peer_index)); /* *INDENT-OFF* */ REPLY_MACRO(VL_API_WIREGUARD_PEER_REMOVE_REPLY); /* *INDENT-ON* */ } static walk_rc_t send_wg_peers_details (index_t peeri, void *data) { vl_api_wireguard_peers_details_t *rmp; wg_deatils_walk_t *ctx = data; const wg_peer_t *peer; u8 n_allowed_ips; size_t ss; peer = wg_peer_get (peeri); n_allowed_ips = vec_len (peer->allowed_ips); ss = (sizeof (*rmp) + (n_allowed_ips * sizeof (rmp->peer.allowed_ips[0]))); rmp = vl_msg_api_alloc_zero (ss); rmp->_vl_msg_id = htons (VL_API_WIREGUARD_PEERS_DETAILS + wg_main.msg_id_base); if (peer->is_dead) rmp->peer.flags = WIREGUARD_PEER_STATUS_DEAD; clib_memcpy (rmp->peer.public_key, peer->remote.r_public, NOISE_PUBLIC_KEY_LEN); ip_address_encode (&peer->dst.addr, IP46_TYPE_ANY, &rmp->peer.endpoint); rmp->peer.port = htons (peer->dst.port); rmp->peer.n_allowed_ips = n_allowed_ips; rmp->peer.sw_if_index = htonl (peer->wg_sw_if_index); int ii; for (ii = 0; ii < n_allowed_ips; ii++) ip_prefix_encode (&peer->allowed_ips[ii].prefix, &rmp->peer.allowed_ips[ii]); rmp->context = ctx->context; vl_api_send_msg (ctx->reg, (u8 *) rmp); return (WALK_CONTINUE); } static void vl_api_wireguard_peers_dump_t_handler (vl_api_wireguard_peers_dump_t * mp) { vl_api_registration_t *reg; wg_main_t *wmp = &wg_main; wg_feature_init (wmp); reg = vl_api_client_index_to_registration (mp->client_index); if (reg == NULL) return; wg_deatils_walk_t ctx = { .reg = reg, .context = mp->context, }; wg_peer_walk (send_wg_peers_details, &ctx); } /* set tup the API message handling tables */ #include <wireguard/wireguard.api.c> static clib_error_t * wg_api_hookup (vlib_main_t * vm) { wg_main_t *wmp = &wg_main; wmp->msg_id_base = setup_message_id_table (); return 0; } VLIB_API_INIT_FUNCTION (wg_api_hookup); /* * fd.io coding-style-patch-verification: ON * * Local Variables: * eval: (c-set-style "gnu") * End: */