src/network/netdev/wireguard.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2 /***
   3   Copyright © 2015-2017 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
   4 ***/
   5
   6 #include <sys/ioctl.h>
   7 #include <net/if.h>
   8 #include <netinet/in.h>
   9 #include <linux/if_arp.h>
  10 #include <linux/ipv6_route.h>
  11
  12 #include "sd-resolve.h"
  13
  14 #include "alloc-util.h"
  15 #include "dns-domain.h"
  16 #include "event-util.h"
  17 #include "fd-util.h"
  18 #include "fileio.h"
  19 #include "hexdecoct.h"
  20 #include "memory-util.h"
  21 #include "netlink-util.h"
  22 #include "networkd-manager.h"
  23 #include "networkd-route-util.h"
  24 #include "networkd-route.h"
  25 #include "networkd-util.h"
  26 #include "parse-helpers.h"
  27 #include "parse-util.h"
  28 #include "random-util.h"
  29 #include "resolve-private.h"
  30 #include "string-util.h"
  31 #include "strv.h"
  32 #include "wireguard.h"
  33
  34 static void wireguard_resolve_endpoints(NetDev *netdev);
  35 static int peer_resolve_endpoint(WireguardPeer *peer);
  36
  37 static WireguardPeer* wireguard_peer_free(WireguardPeer *peer) {
  38         WireguardIPmask *mask;
  39
  40         if (!peer)
  41                 return NULL;
  42
  43         if (peer->wireguard) {
  44                 LIST_REMOVE(peers, peer->wireguard->peers, peer);
  45
  46                 if (peer->section)
  47                         hashmap_remove(peer->wireguard->peers_by_section, peer->section);
  48         }
  49
  50         config_section_free(peer->section);
  51
  52         while ((mask = peer->ipmasks)) {
  53                 LIST_REMOVE(ipmasks, peer->ipmasks, mask);
  54                 free(mask);
  55         }
  56
  57         free(peer->endpoint_host);
  58         free(peer->endpoint_port);
  59         free(peer->preshared_key_file);
  60         explicit_bzero_safe(peer->preshared_key, WG_KEY_LEN);
  61
  62         sd_event_source_disable_unref(peer->resolve_retry_event_source);
  63         sd_resolve_query_unref(peer->resolve_query);
  64
  65         return mfree(peer);
  66 }
  67
  68 DEFINE_SECTION_CLEANUP_FUNCTIONS(WireguardPeer, wireguard_peer_free);
  69
  70 static int wireguard_peer_new_static(Wireguard *w, const char *filename, unsigned section_line, WireguardPeer **ret) {
  71         _cleanup_(config_section_freep) ConfigSection *n = NULL;
  72         _cleanup_(wireguard_peer_freep) WireguardPeer *peer = NULL;
  73         int r;
  74
  75         assert(w);
  76         assert(ret);
  77         assert(filename);
  78         assert(section_line > 0);
  79
  80         r = config_section_new(filename, section_line, &n);
  81         if (r < 0)
  82                 return r;
  83
  84         peer = hashmap_get(w->peers_by_section, n);
  85         if (peer) {
  86                 *ret = TAKE_PTR(peer);
  87                 return 0;
  88         }
  89
  90         peer = new(WireguardPeer, 1);
  91         if (!peer)
  92                 return -ENOMEM;
  93
  94         *peer = (WireguardPeer) {
  95                 .flags = WGPEER_F_REPLACE_ALLOWEDIPS,
  96                 .wireguard = w,
  97                 .section = TAKE_PTR(n),
  98         };
  99
 100         LIST_PREPEND(peers, w->peers, peer);
 101
 102         r = hashmap_ensure_put(&w->peers_by_section, &config_section_hash_ops, peer->section, peer);
 103         if (r < 0)
 104                 return r;
 105
 106         *ret = TAKE_PTR(peer);
 107         return 0;
 108 }
 109
 110 static int wireguard_set_ipmask_one(NetDev *netdev, sd_netlink_message *message, const WireguardIPmask *mask, uint16_t index) {
 111         int r;
 112
 113         assert(message);
 114         assert(mask);
 115         assert(index > 0);
 116
 117         /* This returns 1 on success, 0 on recoverable error, and negative errno on failure. */
 118
 119         r = sd_netlink_message_open_array(message, index);
 120         if (r < 0)
 121                 return 0;
 122
 123         r = sd_netlink_message_append_u16(message, WGALLOWEDIP_A_FAMILY, mask->family);
 124         if (r < 0)
 125                 goto cancel;
 126
 127         r = netlink_message_append_in_addr_union(message, WGALLOWEDIP_A_IPADDR, mask->family, &mask->ip);
 128         if (r < 0)
 129                 goto cancel;
 130
 131         r = sd_netlink_message_append_u8(message, WGALLOWEDIP_A_CIDR_MASK, mask->cidr);
 132         if (r < 0)
 133                 goto cancel;
 134
 135         r = sd_netlink_message_close_container(message);
 136         if (r < 0)
 137                 return log_netdev_error_errno(netdev, r, "Could not add wireguard allowed ip: %m");
 138
 139         return 1;
 140
 141 cancel:
 142         r = sd_netlink_message_cancel_array(message);
 143         if (r < 0)
 144                 return log_netdev_error_errno(netdev, r, "Could not cancel wireguard allowed ip message attribute: %m");
 145
 146         return 0;
 147 }
 148
 149 static int wireguard_set_peer_one(NetDev *netdev, sd_netlink_message *message, const WireguardPeer *peer, uint16_t index, WireguardIPmask **mask_start) {
 150         WireguardIPmask *start, *last = NULL;
 151         uint16_t j = 0;
 152         int r;
 153
 154         assert(message);
 155         assert(peer);
 156         assert(index > 0);
 157         assert(mask_start);
 158
 159         /* This returns 1 on success, 0 on recoverable error, and negative errno on failure. */
 160
 161         start = *mask_start ?: peer->ipmasks;
 162
 163         r = sd_netlink_message_open_array(message, index);
 164         if (r < 0)
 165                 return 0;
 166
 167         r = sd_netlink_message_append_data(message, WGPEER_A_PUBLIC_KEY, &peer->public_key, sizeof(peer->public_key));
 168         if (r < 0)
 169                 goto cancel;
 170
 171         if (!*mask_start) {
 172                 r = sd_netlink_message_append_data(message, WGPEER_A_PRESHARED_KEY, &peer->preshared_key, WG_KEY_LEN);
 173                 if (r < 0)
 174                         goto cancel;
 175
 176                 r = sd_netlink_message_append_u32(message, WGPEER_A_FLAGS, peer->flags);
 177                 if (r < 0)
 178                         goto cancel;
 179
 180                 r = sd_netlink_message_append_u16(message, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, peer->persistent_keepalive_interval);
 181                 if (r < 0)
 182                         goto cancel;
 183
 184                 if (IN_SET(peer->endpoint.sa.sa_family, AF_INET, AF_INET6)) {
 185                         r = netlink_message_append_sockaddr_union(message, WGPEER_A_ENDPOINT, &peer->endpoint);
 186                         if (r < 0)
 187                                 goto cancel;
 188                 }
 189         }
 190
 191         r = sd_netlink_message_open_container(message, WGPEER_A_ALLOWEDIPS);
 192         if (r < 0)
 193                 goto cancel;
 194
 195         LIST_FOREACH(ipmasks, mask, start) {
 196                 r = wireguard_set_ipmask_one(netdev, message, mask, ++j);
 197                 if (r < 0)
 198                         return r;
 199                 if (r == 0) {
 200                         last = mask;
 201                         break;
 202                 }
 203         }
 204
 205         r = sd_netlink_message_close_container(message);
 206         if (r < 0)
 207                 return log_netdev_error_errno(netdev, r, "Could not add wireguard allowed ip: %m");
 208
 209         r = sd_netlink_message_close_container(message);
 210         if (r < 0)
 211                 return log_netdev_error_errno(netdev, r, "Could not add wireguard peer: %m");
 212
 213         *mask_start = last; /* Start next cycle from this mask. */
 214         return !last;
 215
 216 cancel:
 217         r = sd_netlink_message_cancel_array(message);
 218         if (r < 0)
 219                 return log_netdev_error_errno(netdev, r, "Could not cancel wireguard peers: %m");
 220
 221         return 0;
 222 }
 223
 224 static int wireguard_set_interface(NetDev *netdev) {
 225         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *message = NULL;
 226         WireguardIPmask *mask_start = NULL;
 227         WireguardPeer *peer_start;
 228         bool sent_once = false;
 229         uint32_t serial;
 230         Wireguard *w;
 231         int r;
 232
 233         assert(netdev);
 234         w = WIREGUARD(netdev);
 235         assert(w);
 236
 237         for (peer_start = w->peers; peer_start || !sent_once; ) {
 238                 uint16_t i = 0;
 239
 240                 message = sd_netlink_message_unref(message);
 241
 242                 r = sd_genl_message_new(netdev->manager->genl, WG_GENL_NAME, WG_CMD_SET_DEVICE, &message);
 243                 if (r < 0)
 244                         return log_netdev_error_errno(netdev, r, "Failed to allocate generic netlink message: %m");
 245
 246                 r = sd_netlink_message_append_string(message, WGDEVICE_A_IFNAME, netdev->ifname);
 247                 if (r < 0)
 248                         return log_netdev_error_errno(netdev, r, "Could not append wireguard interface name: %m");
 249
 250                 if (peer_start == w->peers) {
 251                         r = sd_netlink_message_append_data(message, WGDEVICE_A_PRIVATE_KEY, &w->private_key, WG_KEY_LEN);
 252                         if (r < 0)
 253                                 return log_netdev_error_errno(netdev, r, "Could not append wireguard private key: %m");
 254
 255                         r = sd_netlink_message_append_u16(message, WGDEVICE_A_LISTEN_PORT, w->port);
 256                         if (r < 0)
 257                                 return log_netdev_error_errno(netdev, r, "Could not append wireguard port: %m");
 258
 259                         r = sd_netlink_message_append_u32(message, WGDEVICE_A_FWMARK, w->fwmark);
 260                         if (r < 0)
 261                                 return log_netdev_error_errno(netdev, r, "Could not append wireguard fwmark: %m");
 262
 263                         r = sd_netlink_message_append_u32(message, WGDEVICE_A_FLAGS, w->flags);
 264                         if (r < 0)
 265                                 return log_netdev_error_errno(netdev, r, "Could not append wireguard flags: %m");
 266                 }
 267
 268                 r = sd_netlink_message_open_container(message, WGDEVICE_A_PEERS);
 269                 if (r < 0)
 270                         return log_netdev_error_errno(netdev, r, "Could not append wireguard peer attributes: %m");
 271
 272                 WireguardPeer *peer_last = NULL;
 273                 LIST_FOREACH(peers, peer, peer_start) {
 274                         r = wireguard_set_peer_one(netdev, message, peer, ++i, &mask_start);
 275                         if (r < 0)
 276                                 return r;
 277                         if (r == 0) {
 278                                 peer_last = peer;
 279                                 break;
 280                         }
 281                 }
 282                 peer_start = peer_last; /* Start next cycle from this peer. */
 283
 284                 r = sd_netlink_message_close_container(message);
 285                 if (r < 0)
 286                         return log_netdev_error_errno(netdev, r, "Could not close wireguard container: %m");
 287
 288                 r = sd_netlink_send(netdev->manager->genl, message, &serial);
 289                 if (r < 0)
 290                         return log_netdev_error_errno(netdev, r, "Could not set wireguard device: %m");
 291
 292                 sent_once = true;
 293         }
 294
 295         return 0;
 296 }
 297
 298 static int on_resolve_retry(sd_event_source *s, usec_t usec, void *userdata) {
 299         WireguardPeer *peer = userdata;
 300         NetDev *netdev;
 301
 302         assert(peer);
 303         assert(peer->wireguard);
 304
 305         netdev = NETDEV(peer->wireguard);
 306
 307         if (!netdev_is_managed(netdev))
 308                 return 0;
 309
 310         peer->resolve_query = sd_resolve_query_unref(peer->resolve_query);
 311
 312         (void) peer_resolve_endpoint(peer);
 313         return 0;
 314 }
 315
 316 static usec_t peer_next_resolve_usec(WireguardPeer *peer) {
 317         usec_t usec;
 318
 319         /* Given the number of retries this function will return an exponential increasing amount of
 320          * milliseconds to wait starting at 200ms and capped at 25 seconds. */
 321
 322         assert(peer);
 323
 324         usec = (2 << MIN(peer->n_retries, 7U)) * 100 * USEC_PER_MSEC;
 325
 326         return random_u64_range(usec / 10) + usec * 9 / 10;
 327 }
 328
 329 static int wireguard_peer_resolve_handler(
 330               sd_resolve_query *q,
 331               int ret,
 332               const struct addrinfo *ai,
 333               void *userdata) {
 334
 335         WireguardPeer *peer = userdata;
 336         NetDev *netdev;
 337         int r;
 338
 339         assert(peer);
 340         assert(peer->wireguard);
 341
 342         netdev = NETDEV(peer->wireguard);
 343
 344         if (!netdev_is_managed(netdev))
 345                 return 0;
 346
 347         if (ret != 0) {
 348                 log_netdev_warning(netdev, "Failed to resolve host '%s:%s', ignoring: %s",
 349                                    peer->endpoint_host, peer->endpoint_port, gai_strerror(ret));
 350                 peer->n_retries++;
 351
 352         } else {
 353                 bool found = false;
 354                 for (; ai; ai = ai->ai_next) {
 355                         if (!IN_SET(ai->ai_family, AF_INET, AF_INET6))
 356                                 continue;
 357
 358                         if (ai->ai_addrlen != (ai->ai_family == AF_INET ? sizeof(struct sockaddr_in) : sizeof(struct sockaddr_in6)))
 359                                 continue;
 360
 361                         memcpy(&peer->endpoint, ai->ai_addr, ai->ai_addrlen);
 362                         (void) wireguard_set_interface(netdev);
 363                         peer->n_retries = 0;
 364                         found = true;
 365                         break;
 366                 }
 367
 368                 if (!found) {
 369                         log_netdev_warning(netdev, "Neither IPv4 nor IPv6 address found for peer endpoint %s:%s, ignoring the endpoint.",
 370                                            peer->endpoint_host, peer->endpoint_port);
 371                         peer->n_retries++;
 372                 }
 373         }
 374
 375         if (peer->n_retries > 0) {
 376                 r = event_reset_time_relative(netdev->manager->event,
 377                                               &peer->resolve_retry_event_source,
 378                                               CLOCK_BOOTTIME,
 379                                               peer_next_resolve_usec(peer), 0,
 380                                               on_resolve_retry, peer, 0, "wireguard-resolve-retry", true);
 381                 if (r < 0)
 382                         log_netdev_warning_errno(netdev, r, "Could not arm resolve retry handler for endpoint %s:%s, ignoring: %m",
 383                                                  peer->endpoint_host, peer->endpoint_port);
 384         }
 385
 386         wireguard_resolve_endpoints(netdev);
 387         return 0;
 388 }
 389
 390 static int peer_resolve_endpoint(WireguardPeer *peer) {
 391         static const struct addrinfo hints = {
 392                 .ai_family = AF_UNSPEC,
 393                 .ai_socktype = SOCK_DGRAM,
 394                 .ai_protocol = IPPROTO_UDP
 395         };
 396         NetDev *netdev;
 397         int r;
 398
 399         assert(peer);
 400         assert(peer->wireguard);
 401
 402         netdev = NETDEV(peer->wireguard);
 403
 404         if (!peer->endpoint_host || !peer->endpoint_port)
 405                 /* Not necessary to resolve the endpoint. */
 406                 return 0;
 407
 408         if (event_source_is_enabled(peer->resolve_retry_event_source) > 0)
 409                 /* Timer event source is enabled. The endpoint will be resolved later. */
 410                 return 0;
 411
 412         if (peer->resolve_query)
 413                 /* Being resolved, or already resolved. */
 414                 return 0;
 415
 416         r = sd_resolve_getaddrinfo(netdev->manager->resolve,
 417                                    &peer->resolve_query,
 418                                    peer->endpoint_host,
 419                                    peer->endpoint_port,
 420                                    &hints,
 421                                    wireguard_peer_resolve_handler,
 422                                    peer);
 423         if (r < 0)
 424                 return log_netdev_full_errno(netdev, r == -ENOBUFS ? LOG_DEBUG : LOG_WARNING, r,
 425                                              "Failed to create endpoint resolver for %s:%s, ignoring: %m",
 426                                              peer->endpoint_host, peer->endpoint_port);
 427
 428         return 0;
 429 }
 430
 431 static void wireguard_resolve_endpoints(NetDev *netdev) {
 432         Wireguard *w;
 433
 434         assert(netdev);
 435         w = WIREGUARD(netdev);
 436         assert(w);
 437
 438         LIST_FOREACH(peers, peer, w->peers)
 439                 if (peer_resolve_endpoint(peer) == -ENOBUFS)
 440                         /* Too many requests. Let's resolve remaining endpoints later. */
 441                         break;
 442 }
 443
 444 static int netdev_wireguard_post_create(NetDev *netdev, Link *link) {
 445         assert(netdev);
 446         assert(WIREGUARD(netdev));
 447
 448         (void) wireguard_set_interface(netdev);
 449         wireguard_resolve_endpoints(netdev);
 450         return 0;
 451 }
 452
 453 int config_parse_wireguard_listen_port(
 454                 const char *unit,
 455                 const char *filename,
 456                 unsigned line,
 457                 const char *section,
 458                 unsigned section_line,
 459                 const char *lvalue,
 460                 int ltype,
 461                 const char *rvalue,
 462                 void *data,
 463                 void *userdata) {
 464
 465         uint16_t *s = data;
 466         int r;
 467
 468         assert(rvalue);
 469         assert(data);
 470
 471         if (isempty(rvalue) || streq(rvalue, "auto")) {
 472                 *s = 0;
 473                 return 0;
 474         }
 475
 476         r = parse_ip_port(rvalue, s);
 477         if (r < 0) {
 478                 log_syntax(unit, LOG_WARNING, filename, line, r,
 479                            "Invalid port specification, ignoring assignment: %s", rvalue);
 480                 return 0;
 481         }
 482
 483         return 0;
 484 }
 485
 486 static int wireguard_decode_key_and_warn(
 487                 const char *rvalue,
 488                 uint8_t ret[static WG_KEY_LEN],
 489                 const char *unit,
 490                 const char *filename,
 491                 unsigned line,
 492                 const char *lvalue) {
 493
 494         _cleanup_(erase_and_freep) void *key = NULL;
 495         size_t len;
 496         int r;
 497
 498         assert(rvalue);
 499         assert(ret);
 500         assert(filename);
 501         assert(lvalue);
 502
 503         if (isempty(rvalue)) {
 504                 memzero(ret, WG_KEY_LEN);
 505                 return 0;
 506         }
 507
 508         if (!streq(lvalue, "PublicKey"))
 509                 (void) warn_file_is_world_accessible(filename, NULL, unit, line);
 510
 511         r = unbase64mem_full(rvalue, strlen(rvalue), true, &key, &len);
 512         if (r == -ENOMEM)
 513                 return log_oom();
 514         if (r < 0) {
 515                 log_syntax(unit, LOG_WARNING, filename, line, r,
 516                            "Failed to decode wireguard key provided by %s=, ignoring assignment: %m", lvalue);
 517                 return 0;
 518         }
 519         if (len != WG_KEY_LEN) {
 520                 log_syntax(unit, LOG_WARNING, filename, line, 0,
 521                            "Wireguard key provided by %s= has invalid length (%zu bytes), ignoring assignment.",
 522                            lvalue, len);
 523                 return 0;
 524         }
 525
 526         memcpy(ret, key, WG_KEY_LEN);
 527         return 0;
 528 }
 529
 530 int config_parse_wireguard_private_key(
 531                 const char *unit,
 532                 const char *filename,
 533                 unsigned line,
 534                 const char *section,
 535                 unsigned section_line,
 536                 const char *lvalue,
 537                 int ltype,
 538                 const char *rvalue,
 539                 void *data,
 540                 void *userdata) {
 541
 542         Wireguard *w;
 543
 544         assert(data);
 545         w = WIREGUARD(data);
 546         assert(w);
 547
 548         return wireguard_decode_key_and_warn(rvalue, w->private_key, unit, filename, line, lvalue);
 549 }
 550
 551 int config_parse_wireguard_private_key_file(
 552                 const char *unit,
 553                 const char *filename,
 554                 unsigned line,
 555                 const char *section,
 556                 unsigned section_line,
 557                 const char *lvalue,
 558                 int ltype,
 559                 const char *rvalue,
 560                 void *data,
 561                 void *userdata) {
 562
 563         _cleanup_free_ char *path = NULL;
 564         Wireguard *w;
 565
 566         assert(data);
 567         w = WIREGUARD(data);
 568         assert(w);
 569
 570         if (isempty(rvalue)) {
 571                 w->private_key_file = mfree(w->private_key_file);
 572                 return 0;
 573         }
 574
 575         path = strdup(rvalue);
 576         if (!path)
 577                 return log_oom();
 578
 579         if (path_simplify_and_warn(path, PATH_CHECK_ABSOLUTE, unit, filename, line, lvalue) < 0)
 580                 return 0;
 581
 582         return free_and_replace(w->private_key_file, path);
 583 }
 584
 585 int config_parse_wireguard_peer_key(
 586                 const char *unit,
 587                 const char *filename,
 588                 unsigned line,
 589                 const char *section,
 590                 unsigned section_line,
 591                 const char *lvalue,
 592                 int ltype,
 593                 const char *rvalue,
 594                 void *data,
 595                 void *userdata) {
 596
 597         _cleanup_(wireguard_peer_free_or_set_invalidp) WireguardPeer *peer = NULL;
 598         Wireguard *w;
 599         int r;
 600
 601         assert(data);
 602         w = WIREGUARD(data);
 603         assert(w);
 604
 605         r = wireguard_peer_new_static(w, filename, section_line, &peer);
 606         if (r < 0)
 607                 return log_oom();
 608
 609         r = wireguard_decode_key_and_warn(rvalue,
 610                                           streq(lvalue, "PublicKey") ? peer->public_key : peer->preshared_key,
 611                                           unit, filename, line, lvalue);
 612         if (r < 0)
 613                 return r;
 614
 615         TAKE_PTR(peer);
 616         return 0;
 617 }
 618
 619 int config_parse_wireguard_preshared_key_file(
 620                 const char *unit,
 621                 const char *filename,
 622                 unsigned line,
 623                 const char *section,
 624                 unsigned section_line,
 625                 const char *lvalue,
 626                 int ltype,
 627                 const char *rvalue,
 628                 void *data,
 629                 void *userdata) {
 630
 631         _cleanup_(wireguard_peer_free_or_set_invalidp) WireguardPeer *peer = NULL;
 632         _cleanup_free_ char *path = NULL;
 633         Wireguard *w;
 634         int r;
 635
 636         assert(data);
 637         w = WIREGUARD(data);
 638         assert(w);
 639
 640         r = wireguard_peer_new_static(w, filename, section_line, &peer);
 641         if (r < 0)
 642                 return log_oom();
 643
 644         if (isempty(rvalue)) {
 645                 peer->preshared_key_file = mfree(peer->preshared_key_file);
 646                 TAKE_PTR(peer);
 647                 return 0;
 648         }
 649
 650         path = strdup(rvalue);
 651         if (!path)
 652                 return log_oom();
 653
 654         if (path_simplify_and_warn(path, PATH_CHECK_ABSOLUTE, unit, filename, line, lvalue) < 0)
 655                 return 0;
 656
 657         free_and_replace(peer->preshared_key_file, path);
 658         TAKE_PTR(peer);
 659         return 0;
 660 }
 661
 662 int config_parse_wireguard_allowed_ips(
 663                 const char *unit,
 664                 const char *filename,
 665                 unsigned line,
 666                 const char *section,
 667                 unsigned section_line,
 668                 const char *lvalue,
 669                 int ltype,
 670                 const char *rvalue,
 671                 void *data,
 672                 void *userdata) {
 673
 674         _cleanup_(wireguard_peer_free_or_set_invalidp) WireguardPeer *peer = NULL;
 675         union in_addr_union addr;
 676         unsigned char prefixlen;
 677         int r, family;
 678         Wireguard *w;
 679         WireguardIPmask *ipmask;
 680
 681         assert(rvalue);
 682         assert(data);
 683
 684         w = WIREGUARD(data);
 685         assert(w);
 686
 687         r = wireguard_peer_new_static(w, filename, section_line, &peer);
 688         if (r < 0)
 689                 return log_oom();
 690
 691         for (const char *p = rvalue;;) {
 692                 _cleanup_free_ char *word = NULL;
 693                 union in_addr_union masked;
 694
 695                 r = extract_first_word(&p, &word, "," WHITESPACE, 0);
 696                 if (r == 0)
 697                         break;
 698                 if (r == -ENOMEM)
 699                         return log_oom();
 700                 if (r < 0) {
 701                         log_syntax(unit, LOG_WARNING, filename, line, r,
 702                                    "Failed to split allowed ips \"%s\" option: %m", rvalue);
 703                         break;
 704                 }
 705
 706                 r = in_addr_prefix_from_string_auto(word, &family, &addr, &prefixlen);
 707                 if (r < 0) {
 708                         log_syntax(unit, LOG_WARNING, filename, line, r,
 709                                    "Network address is invalid, ignoring assignment: %s", word);
 710                         continue;
 711                 }
 712
 713                 masked = addr;
 714                 assert_se(in_addr_mask(family, &masked, prefixlen) >= 0);
 715                 if (!in_addr_equal(family, &masked, &addr)) {
 716                         _cleanup_free_ char *buf = NULL;
 717
 718                         (void) in_addr_prefix_to_string(family, &masked, prefixlen, &buf);
 719                         log_syntax(unit, LOG_WARNING, filename, line, 0,
 720                                    "Specified address '%s' is not properly masked, assuming '%s'.", word, strna(buf));
 721                 }
 722
 723                 ipmask = new(WireguardIPmask, 1);
 724                 if (!ipmask)
 725                         return log_oom();
 726
 727                 *ipmask = (WireguardIPmask) {
 728                         .family = family,
 729                         .ip = masked,
 730                         .cidr = prefixlen,
 731                 };
 732
 733                 LIST_PREPEND(ipmasks, peer->ipmasks, ipmask);
 734         }
 735
 736         TAKE_PTR(peer);
 737         return 0;
 738 }
 739
 740 int config_parse_wireguard_endpoint(
 741                 const char *unit,
 742                 const char *filename,
 743                 unsigned line,
 744                 const char *section,
 745                 unsigned section_line,
 746                 const char *lvalue,
 747                 int ltype,
 748                 const char *rvalue,
 749                 void *data,
 750                 void *userdata) {
 751
 752         _cleanup_(wireguard_peer_free_or_set_invalidp) WireguardPeer *peer = NULL;
 753         _cleanup_free_ char *host = NULL;
 754         union in_addr_union addr;
 755         const char *p;
 756         uint16_t port;
 757         Wireguard *w;
 758         int family, r;
 759
 760         assert(filename);
 761         assert(rvalue);
 762         assert(userdata);
 763
 764         w = WIREGUARD(userdata);
 765         assert(w);
 766
 767         r = wireguard_peer_new_static(w, filename, section_line, &peer);
 768         if (r < 0)
 769                 return log_oom();
 770
 771         r = in_addr_port_ifindex_name_from_string_auto(rvalue, &family, &addr, &port, NULL, NULL);
 772         if (r >= 0) {
 773                 if (family == AF_INET)
 774                         peer->endpoint.in = (struct sockaddr_in) {
 775                                 .sin_family = AF_INET,
 776                                 .sin_addr = addr.in,
 777                                 .sin_port = htobe16(port),
 778                         };
 779                 else if (family == AF_INET6)
 780                         peer->endpoint.in6 = (struct sockaddr_in6) {
 781                                 .sin6_family = AF_INET6,
 782                                 .sin6_addr = addr.in6,
 783                                 .sin6_port = htobe16(port),
 784                         };
 785                 else
 786                         assert_not_reached();
 787
 788                 peer->endpoint_host = mfree(peer->endpoint_host);
 789                 peer->endpoint_port = mfree(peer->endpoint_port);
 790
 791                 TAKE_PTR(peer);
 792                 return 0;
 793         }
 794
 795         p = strrchr(rvalue, ':');
 796         if (!p) {
 797                 log_syntax(unit, LOG_WARNING, filename, line, 0,
 798                            "Unable to find port of endpoint, ignoring assignment: %s",
 799                            rvalue);
 800                 return 0;
 801         }
 802
 803         host = strndup(rvalue, p - rvalue);
 804         if (!host)
 805                 return log_oom();
 806
 807         if (!dns_name_is_valid(host)) {
 808                 log_syntax(unit, LOG_WARNING, filename, line, 0,
 809                            "Invalid domain name of endpoint, ignoring assignment: %s",
 810                            rvalue);
 811                 return 0;
 812         }
 813
 814         p++;
 815         r = parse_ip_port(p, &port);
 816         if (r < 0) {
 817                 log_syntax(unit, LOG_WARNING, filename, line, r,
 818                            "Invalid port of endpoint, ignoring assignment: %s",
 819                            rvalue);
 820                 return 0;
 821         }
 822
 823         peer->endpoint = (union sockaddr_union) {};
 824
 825         free_and_replace(peer->endpoint_host, host);
 826
 827         r = free_and_strdup(&peer->endpoint_port, p);
 828         if (r < 0)
 829                 return log_oom();
 830
 831         TAKE_PTR(peer); /* The peer may already have been in the hash map, that is fine too. */
 832         return 0;
 833 }
 834
 835 int config_parse_wireguard_keepalive(
 836                 const char *unit,
 837                 const char *filename,
 838                 unsigned line,
 839                 const char *section,
 840                 unsigned section_line,
 841                 const char *lvalue,
 842                 int ltype,
 843                 const char *rvalue,
 844                 void *data,
 845                 void *userdata) {
 846
 847         _cleanup_(wireguard_peer_free_or_set_invalidp) WireguardPeer *peer = NULL;
 848         uint16_t keepalive = 0;
 849         Wireguard *w;
 850         int r;
 851
 852         assert(rvalue);
 853         assert(data);
 854
 855         w = WIREGUARD(data);
 856         assert(w);
 857
 858         r = wireguard_peer_new_static(w, filename, section_line, &peer);
 859         if (r < 0)
 860                 return log_oom();
 861
 862         if (streq(rvalue, "off"))
 863                 keepalive = 0;
 864         else {
 865                 r = safe_atou16(rvalue, &keepalive);
 866                 if (r < 0) {
 867                         log_syntax(unit, LOG_WARNING, filename, line, r,
 868                                    "Failed to parse \"%s\" as keepalive interval (range 0–65535), ignoring assignment: %m",
 869                                    rvalue);
 870                         return 0;
 871                 }
 872         }
 873
 874         peer->persistent_keepalive_interval = keepalive;
 875
 876         TAKE_PTR(peer);
 877         return 0;
 878 }
 879
 880 int config_parse_wireguard_route_table(
 881                 const char *unit,
 882                 const char *filename,
 883                 unsigned line,
 884                 const char *section,
 885                 unsigned section_line,
 886                 const char *lvalue,
 887                 int ltype,
 888                 const char *rvalue,
 889                 void *data,
 890                 void *userdata) {
 891
 892         NetDev *netdev = userdata;
 893         uint32_t *table = data;
 894         int r;
 895
 896         assert(filename);
 897         assert(lvalue);
 898         assert(rvalue);
 899         assert(data);
 900         assert(userdata);
 901
 902         if (isempty(rvalue) || parse_boolean(rvalue) == 0) {
 903                 *table = 0; /* Disabled. */
 904                 return 0;
 905         }
 906
 907         r = manager_get_route_table_from_string(netdev->manager, rvalue, table);
 908         if (r < 0) {
 909                 log_syntax(unit, LOG_WARNING, filename, line, r,
 910                            "Failed to parse %s=, ignoring assignment: %s",
 911                            lvalue, rvalue);
 912                 return 0;
 913         }
 914
 915         return 0;
 916 }
 917
 918 int config_parse_wireguard_peer_route_table(
 919                 const char *unit,
 920                 const char *filename,
 921                 unsigned line,
 922                 const char *section,
 923                 unsigned section_line,
 924                 const char *lvalue,
 925                 int ltype,
 926                 const char *rvalue,
 927                 void *data,
 928                 void *userdata) {
 929
 930         _cleanup_(wireguard_peer_free_or_set_invalidp) WireguardPeer *peer = NULL;
 931         NetDev *netdev = userdata;
 932         Wireguard *w;
 933         int r;
 934
 935         assert(filename);
 936         assert(lvalue);
 937         assert(rvalue);
 938         assert(netdev);
 939         assert(netdev->manager);
 940
 941         w = WIREGUARD(netdev);
 942         assert(w);
 943
 944         r = wireguard_peer_new_static(w, filename, section_line, &peer);
 945         if (r < 0)
 946                 return log_oom();
 947
 948         if (isempty(rvalue)) {
 949                 peer->route_table_set = false; /* Use the table specified in [WireGuard] section. */
 950                 TAKE_PTR(peer);
 951                 return 0;
 952         }
 953
 954         if (parse_boolean(rvalue) == 0) {
 955                 peer->route_table = 0; /* Disabled. */
 956                 peer->route_table_set = true;
 957                 TAKE_PTR(peer);
 958                 return 0;
 959         }
 960
 961         r = manager_get_route_table_from_string(netdev->manager, rvalue, &peer->route_table);
 962         if (r < 0) {
 963                 log_syntax(unit, LOG_WARNING, filename, line, r,
 964                            "Failed to parse %s=, ignoring assignment: %s",
 965                            lvalue, rvalue);
 966                 return 0;
 967         }
 968
 969         peer->route_table_set = true;
 970         TAKE_PTR(peer);
 971         return 0;
 972 }
 973
 974 int config_parse_wireguard_route_priority(
 975                 const char *unit,
 976                 const char *filename,
 977                 unsigned line,
 978                 const char *section,
 979                 unsigned section_line,
 980                 const char *lvalue,
 981                 int ltype,
 982                 const char *rvalue,
 983                 void *data,
 984                 void *userdata) {
 985
 986         uint32_t *priority = data;
 987         int r;
 988
 989         assert(filename);
 990         assert(lvalue);
 991         assert(rvalue);
 992         assert(data);
 993
 994         if (isempty(rvalue)) {
 995                 *priority = 0;
 996                 return 0;
 997         }
 998
 999         r = safe_atou32(rvalue, priority);
1000         if (r < 0) {
1001                 log_syntax(unit, LOG_WARNING, filename, line, r,
1002                            "Could not parse route priority \"%s\", ignoring assignment: %m", rvalue);
1003                 return 0;
1004         }
1005
1006         return 0;
1007 }
1008
1009 int config_parse_wireguard_peer_route_priority(
1010                 const char *unit,
1011                 const char *filename,
1012                 unsigned line,
1013                 const char *section,
1014                 unsigned section_line,
1015                 const char *lvalue,
1016                 int ltype,
1017                 const char *rvalue,
1018                 void *data,
1019                 void *userdata) {
1020
1021         _cleanup_(wireguard_peer_free_or_set_invalidp) WireguardPeer *peer = NULL;
1022         Wireguard *w;
1023         int r;
1024
1025         assert(filename);
1026         assert(lvalue);
1027         assert(rvalue);
1028         assert(userdata);
1029
1030         w = WIREGUARD(userdata);
1031         assert(w);
1032
1033         r = wireguard_peer_new_static(w, filename, section_line, &peer);
1034         if (r < 0)
1035                 return log_oom();
1036
1037         if (isempty(rvalue)) {
1038                 peer->route_priority_set = false; /* Use the priority specified in [WireGuard] section. */
1039                 TAKE_PTR(peer);
1040                 return 0;
1041         }
1042
1043         r = safe_atou32(rvalue, &peer->route_priority);
1044         if (r < 0) {
1045                 log_syntax(unit, LOG_WARNING, filename, line, r,
1046                            "Could not parse route priority \"%s\", ignoring assignment: %m", rvalue);
1047                 return 0;
1048         }
1049
1050         peer->route_priority_set = true;
1051         TAKE_PTR(peer);
1052         return 0;
1053 }
1054
1055 static void wireguard_init(NetDev *netdev) {
1056         Wireguard *w;
1057
1058         assert(netdev);
1059         w = WIREGUARD(netdev);
1060         assert(w);
1061
1062         w->flags = WGDEVICE_F_REPLACE_PEERS;
1063 }
1064
1065 static void wireguard_done(NetDev *netdev) {
1066         Wireguard *w;
1067
1068         assert(netdev);
1069         w = WIREGUARD(netdev);
1070         assert(w);
1071
1072         explicit_bzero_safe(w->private_key, WG_KEY_LEN);
1073         free(w->private_key_file);
1074
1075         hashmap_free_with_destructor(w->peers_by_section, wireguard_peer_free);
1076
1077         set_free(w->routes);
1078 }
1079
1080 static int wireguard_read_key_file(const char *filename, uint8_t dest[static WG_KEY_LEN]) {
1081         _cleanup_(erase_and_freep) char *key = NULL;
1082         size_t key_len;
1083         int r;
1084
1085         if (!filename)
1086                 return 0;
1087
1088         assert(dest);
1089
1090         (void) warn_file_is_world_accessible(filename, NULL, NULL, 0);
1091
1092         r = read_full_file_full(
1093                         AT_FDCWD, filename, UINT64_MAX, SIZE_MAX,
1094                         READ_FULL_FILE_SECURE | READ_FULL_FILE_UNBASE64 | READ_FULL_FILE_WARN_WORLD_READABLE | READ_FULL_FILE_CONNECT_SOCKET,
1095                         NULL, &key, &key_len);
1096         if (r < 0)
1097                 return r;
1098
1099         if (key_len != WG_KEY_LEN)
1100                 return -EINVAL;
1101
1102         memcpy(dest, key, WG_KEY_LEN);
1103         return 0;
1104 }
1105
1106 static int wireguard_peer_verify(WireguardPeer *peer) {
1107         NetDev *netdev = NETDEV(peer->wireguard);
1108         int r;
1109
1110         if (section_is_invalid(peer->section))
1111                 return -EINVAL;
1112
1113         if (eqzero(peer->public_key))
1114                 return log_netdev_error_errno(netdev, SYNTHETIC_ERRNO(EINVAL),
1115                                               "%s: WireGuardPeer section without PublicKey= configured. "
1116                                               "Ignoring [WireGuardPeer] section from line %u.",
1117                                               peer->section->filename, peer->section->line);
1118
1119         r = wireguard_read_key_file(peer->preshared_key_file, peer->preshared_key);
1120         if (r < 0)
1121                 return log_netdev_error_errno(netdev, r,
1122                                               "%s: Failed to read preshared key from '%s'. "
1123                                               "Ignoring [WireGuardPeer] section from line %u.",
1124                                               peer->section->filename, peer->preshared_key_file,
1125                                               peer->section->line);
1126
1127         return 0;
1128 }
1129
1130 static int wireguard_verify(NetDev *netdev, const char *filename) {
1131         Wireguard *w;
1132         int r;
1133
1134         assert(netdev);
1135         w = WIREGUARD(netdev);
1136         assert(w);
1137
1138         r = wireguard_read_key_file(w->private_key_file, w->private_key);
1139         if (r < 0)
1140                 return log_netdev_error_errno(netdev, r,
1141                                               "Failed to read private key from %s. Ignoring network device.",
1142                                               w->private_key_file);
1143
1144         if (eqzero(w->private_key))
1145                 return log_netdev_error_errno(netdev, SYNTHETIC_ERRNO(EINVAL),
1146                                               "%s: Missing PrivateKey= or PrivateKeyFile=, "
1147                                               "Ignoring network device.", filename);
1148
1149         LIST_FOREACH(peers, peer, w->peers) {
1150                 if (wireguard_peer_verify(peer) < 0) {
1151                         wireguard_peer_free(peer);
1152                         continue;
1153                 }
1154
1155                 if ((peer->route_table_set ? peer->route_table : w->route_table) == 0)
1156                         continue;
1157
1158                 LIST_FOREACH(ipmasks, ipmask, peer->ipmasks) {
1159                         _cleanup_(route_freep) Route *route = NULL;
1160
1161                         r = route_new(&route);
1162                         if (r < 0)
1163                                 return log_oom();
1164
1165                         route->family = ipmask->family;
1166                         route->dst = ipmask->ip;
1167                         route->dst_prefixlen = ipmask->cidr;
1168                         route->scope = RT_SCOPE_UNIVERSE;
1169                         route->protocol = RTPROT_STATIC;
1170                         route->table = peer->route_table_set ? peer->route_table : w->route_table;
1171                         route->priority = peer->route_priority_set ? peer->route_priority : w->route_priority;
1172                         if (route->priority == 0 && route->family == AF_INET6)
1173                                 route->priority = IP6_RT_PRIO_USER;
1174                         route->source = NETWORK_CONFIG_SOURCE_STATIC;
1175
1176                         r = set_ensure_consume(&w->routes, &route_hash_ops, TAKE_PTR(route));
1177                         if (r < 0)
1178                                 return log_oom();
1179                 }
1180         }
1181
1182         return 0;
1183 }
1184
1185 const NetDevVTable wireguard_vtable = {
1186         .object_size = sizeof(Wireguard),
1187         .sections = NETDEV_COMMON_SECTIONS "WireGuard\0WireGuardPeer\0",
1188         .post_create = netdev_wireguard_post_create,
1189         .init = wireguard_init,
1190         .done = wireguard_done,
1191         .create_type = NETDEV_CREATE_INDEPENDENT,
1192         .config_verify = wireguard_verify,
1193         .iftype = ARPHRD_NONE,
1194 };