]> git.ipfire.org Git - thirdparty/systemd.git/blame_incremental - src/network/netdev/wireguard.c
projects / thirdparty / systemd.git / blame_incremental
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (non-incremental) | history | HEAD
ci: use -p and -f when creating dirs/removing files in mkosi job btrfs setup
[thirdparty/systemd.git] / src / network / netdev / wireguard.c
... / ...
CommitLineData
1/* SPDX-License-Identifier: LGPL-2.1-or-later */
2/***
3 Copyright © 2015-2017 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
4***/
5
6#include <linux/if_arp.h>
7#include <netdb.h>
8#include <netinet/in.h>
9
10#include "sd-netlink.h"
11#include "sd-resolve.h"
12
13#include "alloc-util.h"
14#include "conf-parser.h"
15#include "creds-util.h"
16#include "dns-domain.h"
17#include "event-util.h"
18#include "extract-word.h"
19#include "fileio.h"
20#include "hashmap.h"
21#include "hexdecoct.h"
22#include "memory-util.h"
23#include "netlink-util.h"
24#include "networkd-manager.h"
25#include "networkd-route.h"
26#include "networkd-route-util.h"
27#include "networkd-util.h"
28#include "parse-helpers.h"
29#include "parse-util.h"
30#include "path-util.h"
31#include "random-util.h"
32#include "set.h"
33#include "string-util.h"
34#include "wireguard.h"
35
36static void wireguard_resolve_endpoints(NetDev *netdev);
37static int peer_resolve_endpoint(WireguardPeer *peer);
38
39static void wireguard_peer_clear_ipmasks(WireguardPeer *peer) {
40 assert(peer);
41
42 LIST_CLEAR(ipmasks, peer->ipmasks, free);
43}
44
45static WireguardPeer* wireguard_peer_free(WireguardPeer *peer) {
46 if (!peer)
47 return NULL;
48
49 if (peer->wireguard) {
50 LIST_REMOVE(peers, peer->wireguard->peers, peer);
51
52 if (peer->section)
53 hashmap_remove(peer->wireguard->peers_by_section, peer->section);
54 }
55
56 config_section_free(peer->section);
57
58 wireguard_peer_clear_ipmasks(peer);
59
60 free(peer->endpoint_host);
61 free(peer->endpoint_port);
62 free(peer->public_key_file);
63 free(peer->preshared_key_file);
64 explicit_bzero_safe(peer->preshared_key, WG_KEY_LEN);
65
66 sd_event_source_disable_unref(peer->resolve_retry_event_source);
67 sd_resolve_query_unref(peer->resolve_query);
68
69 return mfree(peer);
70}
71
72DEFINE_SECTION_CLEANUP_FUNCTIONS(WireguardPeer, wireguard_peer_free);
73
74DEFINE_PRIVATE_HASH_OPS_WITH_VALUE_DESTRUCTOR(
75 wireguard_peer_hash_ops_by_section,
76 ConfigSection, config_section_hash_func, config_section_compare_func,
77 WireguardPeer, wireguard_peer_free);
78
79static int wireguard_peer_new_static(Wireguard *w, const char *filename, unsigned section_line, WireguardPeer **ret) {
80 _cleanup_(config_section_freep) ConfigSection *n = NULL;
81 _cleanup_(wireguard_peer_freep) WireguardPeer *peer = NULL;
82 int r;
83
84 assert(w);
85 assert(ret);
86 assert(filename);
87 assert(section_line > 0);
88
89 r = config_section_new(filename, section_line, &n);
90 if (r < 0)
91 return r;
92
93 peer = hashmap_get(w->peers_by_section, n);
94 if (peer) {
95 *ret = TAKE_PTR(peer);
96 return 0;
97 }
98
99 peer = new(WireguardPeer, 1);
100 if (!peer)
101 return -ENOMEM;
102
103 *peer = (WireguardPeer) {
104 .flags = WGPEER_F_REPLACE_ALLOWEDIPS,
105 .wireguard = w,
106 .section = TAKE_PTR(n),
107 };
108
109 LIST_PREPEND(peers, w->peers, peer);
110
111 r = hashmap_ensure_put(&w->peers_by_section, &wireguard_peer_hash_ops_by_section, peer->section, peer);
112 if (r < 0)
113 return r;
114
115 *ret = TAKE_PTR(peer);
116 return 0;
117}
118
119static int wireguard_set_ipmask_one(NetDev *netdev, sd_netlink_message *message, const WireguardIPmask *mask, uint16_t index) {
120 int r;
121
122 assert(message);
123 assert(mask);
124 assert(index > 0);
125
126 /* This returns 1 on success, 0 on recoverable error, and negative errno on failure. */
127
128 r = sd_netlink_message_open_array(message, index);
129 if (r < 0)
130 return 0;
131
132 r = sd_netlink_message_append_u16(message, WGALLOWEDIP_A_FAMILY, mask->family);
133 if (r < 0)
134 goto cancel;
135
136 r = netlink_message_append_in_addr_union(message, WGALLOWEDIP_A_IPADDR, mask->family, &mask->ip);
137 if (r < 0)
138 goto cancel;
139
140 r = sd_netlink_message_append_u8(message, WGALLOWEDIP_A_CIDR_MASK, mask->cidr);
141 if (r < 0)
142 goto cancel;
143
144 r = sd_netlink_message_close_container(message);
145 if (r < 0)
146 return log_netdev_error_errno(netdev, r, "Could not add wireguard allowed ip: %m");
147
148 return 1;
149
150cancel:
151 r = sd_netlink_message_cancel_array(message);
152 if (r < 0)
153 return log_netdev_error_errno(netdev, r, "Could not cancel wireguard allowed ip message attribute: %m");
154
155 return 0;
156}
157
158static int wireguard_set_peer_one(NetDev *netdev, sd_netlink_message *message, const WireguardPeer *peer, uint16_t index, WireguardIPmask **mask_start) {
159 WireguardIPmask *start, *last = NULL;
160 uint16_t j = 0;
161 int r;
162
163 assert(message);
164 assert(peer);
165 assert(index > 0);
166 assert(mask_start);
167
168 /* This returns 1 on success, 0 on recoverable error, and negative errno on failure. */
169
170 start = *mask_start ?: peer->ipmasks;
171
172 r = sd_netlink_message_open_array(message, index);
173 if (r < 0)
174 return 0;
175
176 r = sd_netlink_message_append_data(message, WGPEER_A_PUBLIC_KEY, &peer->public_key, sizeof(peer->public_key));
177 if (r < 0)
178 goto cancel;
179
180 if (!*mask_start) {
181 r = sd_netlink_message_append_data(message, WGPEER_A_PRESHARED_KEY, &peer->preshared_key, WG_KEY_LEN);
182 if (r < 0)
183 goto cancel;
184
185 r = sd_netlink_message_append_u32(message, WGPEER_A_FLAGS, peer->flags);
186 if (r < 0)
187 goto cancel;
188
189 r = sd_netlink_message_append_u16(message, WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL, peer->persistent_keepalive_interval);
190 if (r < 0)
191 goto cancel;
192
193 if (IN_SET(peer->endpoint.sa.sa_family, AF_INET, AF_INET6)) {
194 r = netlink_message_append_sockaddr_union(message, WGPEER_A_ENDPOINT, &peer->endpoint);
195 if (r < 0)
196 goto cancel;
197 }
198 }
199
200 r = sd_netlink_message_open_container(message, WGPEER_A_ALLOWEDIPS);
201 if (r < 0)
202 goto cancel;
203
204 LIST_FOREACH(ipmasks, mask, start) {
205 r = wireguard_set_ipmask_one(netdev, message, mask, ++j);
206 if (r < 0)
207 return r;
208 if (r == 0) {
209 last = mask;
210 break;
211 }
212 }
213
214 r = sd_netlink_message_close_container(message);
215 if (r < 0)
216 return log_netdev_error_errno(netdev, r, "Could not add wireguard allowed ip: %m");
217
218 r = sd_netlink_message_close_container(message);
219 if (r < 0)
220 return log_netdev_error_errno(netdev, r, "Could not add wireguard peer: %m");
221
222 *mask_start = last; /* Start next cycle from this mask. */
223 return !last;
224
225cancel:
226 r = sd_netlink_message_cancel_array(message);
227 if (r < 0)
228 return log_netdev_error_errno(netdev, r, "Could not cancel wireguard peers: %m");
229
230 return 0;
231}
232
233static int wireguard_set_interface(NetDev *netdev) {
234 _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *message = NULL;
235 WireguardIPmask *mask_start = NULL;
236 bool sent_once = false;
237 uint32_t serial;
238 Wireguard *w = WIREGUARD(netdev);
239 int r;
240
241 if (!netdev_is_managed(netdev))
242 return 0; /* Already detached, due to e.g. reloading .netdev files. */
243
244 for (WireguardPeer *peer_start = w->peers; peer_start || !sent_once; ) {
245 uint16_t i = 0;
246
247 message = sd_netlink_message_unref(message);
248
249 r = sd_genl_message_new(netdev->manager->genl, WG_GENL_NAME, WG_CMD_SET_DEVICE, &message);
250 if (r < 0)
251 return log_netdev_error_errno(netdev, r, "Failed to allocate generic netlink message: %m");
252
253 r = sd_netlink_message_append_string(message, WGDEVICE_A_IFNAME, netdev->ifname);
254 if (r < 0)
255 return log_netdev_error_errno(netdev, r, "Could not append wireguard interface name: %m");
256
257 if (peer_start == w->peers) {
258 r = sd_netlink_message_append_data(message, WGDEVICE_A_PRIVATE_KEY, &w->private_key, WG_KEY_LEN);
259 if (r < 0)
260 return log_netdev_error_errno(netdev, r, "Could not append wireguard private key: %m");
261
262 r = sd_netlink_message_append_u16(message, WGDEVICE_A_LISTEN_PORT, w->port);
263 if (r < 0)
264 return log_netdev_error_errno(netdev, r, "Could not append wireguard port: %m");
265
266 r = sd_netlink_message_append_u32(message, WGDEVICE_A_FWMARK, w->fwmark);
267 if (r < 0)
268 return log_netdev_error_errno(netdev, r, "Could not append wireguard fwmark: %m");
269
270 r = sd_netlink_message_append_u32(message, WGDEVICE_A_FLAGS, w->flags);
271 if (r < 0)
272 return log_netdev_error_errno(netdev, r, "Could not append wireguard flags: %m");
273 }
274
275 r = sd_netlink_message_open_container(message, WGDEVICE_A_PEERS);
276 if (r < 0)
277 return log_netdev_error_errno(netdev, r, "Could not append wireguard peer attributes: %m");
278
279 WireguardPeer *peer_last = NULL;
280 LIST_FOREACH(peers, peer, peer_start) {
281 r = wireguard_set_peer_one(netdev, message, peer, ++i, &mask_start);
282 if (r < 0)
283 return r;
284 if (r == 0) {
285 peer_last = peer;
286 break;
287 }
288 }
289 peer_start = peer_last; /* Start next cycle from this peer. */
290
291 r = sd_netlink_message_close_container(message);
292 if (r < 0)
293 return log_netdev_error_errno(netdev, r, "Could not close wireguard container: %m");
294
295 r = sd_netlink_send(netdev->manager->genl, message, &serial);
296 if (r < 0)
297 return log_netdev_error_errno(netdev, r, "Could not set wireguard device: %m");
298
299 sent_once = true;
300 }
301
302 return 0;
303}
304
305static int on_resolve_retry(sd_event_source *s, usec_t usec, void *userdata) {
306 WireguardPeer *peer = ASSERT_PTR(userdata);
307 NetDev *netdev;
308
309 assert(peer->wireguard);
310
311 netdev = NETDEV(peer->wireguard);
312
313 if (!netdev_is_managed(netdev))
314 return 0;
315
316 peer->resolve_query = sd_resolve_query_unref(peer->resolve_query);
317
318 (void) peer_resolve_endpoint(peer);
319 return 0;
320}
321
322static usec_t peer_next_resolve_usec(WireguardPeer *peer) {
323 usec_t usec;
324
325 /* Given the number of retries this function will return an exponential increasing amount of
326 * milliseconds to wait starting at 200ms and capped at 25 seconds. */
327
328 assert(peer);
329
330 usec = (2 << MIN(peer->n_retries, 7U)) * 100 * USEC_PER_MSEC;
331
332 return random_u64_range(usec / 10) + usec * 9 / 10;
333}
334
335static int wireguard_peer_resolve_handler(
336 sd_resolve_query *q,
337 int ret,
338 const struct addrinfo *ai,
339 void *userdata) {
340
341 WireguardPeer *peer = ASSERT_PTR(userdata);
342 NetDev *netdev;
343 int r;
344
345 assert(peer->wireguard);
346
347 netdev = NETDEV(peer->wireguard);
348
349 if (!netdev_is_managed(netdev))
350 return 0;
351
352 if (ret != 0) {
353 log_netdev_warning(netdev, "Failed to resolve host '%s:%s', ignoring: %s",
354 peer->endpoint_host, peer->endpoint_port, gai_strerror(ret));
355 peer->n_retries++;
356
357 } else {
358 bool found = false;
359 for (; ai; ai = ai->ai_next) {
360 if (!IN_SET(ai->ai_family, AF_INET, AF_INET6))
361 continue;
362
363 if (ai->ai_addrlen != (ai->ai_family == AF_INET ? sizeof(struct sockaddr_in) : sizeof(struct sockaddr_in6)))
364 continue;
365
366 memcpy(&peer->endpoint, ai->ai_addr, ai->ai_addrlen);
367 (void) wireguard_set_interface(netdev);
368 peer->n_retries = 0;
369 found = true;
370 break;
371 }
372
373 if (!found) {
374 log_netdev_warning(netdev, "Neither IPv4 nor IPv6 address found for peer endpoint %s:%s, ignoring the endpoint.",
375 peer->endpoint_host, peer->endpoint_port);
376 peer->n_retries++;
377 }
378 }
379
380 if (peer->n_retries > 0) {
381 r = event_reset_time_relative(netdev->manager->event,
382 &peer->resolve_retry_event_source,
383 CLOCK_BOOTTIME,
384 peer_next_resolve_usec(peer), 0,
385 on_resolve_retry, peer, 0, "wireguard-resolve-retry", true);
386 if (r < 0)
387 log_netdev_warning_errno(netdev, r, "Could not arm resolve retry handler for endpoint %s:%s, ignoring: %m",
388 peer->endpoint_host, peer->endpoint_port);
389 }
390
391 wireguard_resolve_endpoints(netdev);
392 return 0;
393}
394
395static int peer_resolve_endpoint(WireguardPeer *peer) {
396 static const struct addrinfo hints = {
397 .ai_family = AF_UNSPEC,
398 .ai_socktype = SOCK_DGRAM,
399 .ai_protocol = IPPROTO_UDP
400 };
401 NetDev *netdev;
402 int r;
403
404 assert(peer);
405 assert(peer->wireguard);
406
407 netdev = NETDEV(peer->wireguard);
408
409 if (!netdev_is_managed(netdev))
410 return 0; /* Already detached, due to e.g. reloading .netdev files. */
411
412 if (!peer->endpoint_host || !peer->endpoint_port)
413 /* Not necessary to resolve the endpoint. */
414 return 0;
415
416 if (sd_event_source_get_enabled(peer->resolve_retry_event_source, NULL) > 0)
417 /* Timer event source is enabled. The endpoint will be resolved later. */
418 return 0;
419
420 if (peer->resolve_query)
421 /* Being resolved, or already resolved. */
422 return 0;
423
424 r = sd_resolve_getaddrinfo(netdev->manager->resolve,
425 &peer->resolve_query,
426 peer->endpoint_host,
427 peer->endpoint_port,
428 &hints,
429 wireguard_peer_resolve_handler,
430 peer);
431 if (r < 0)
432 return log_netdev_full_errno(netdev, r == -ENOBUFS ? LOG_DEBUG : LOG_WARNING, r,
433 "Failed to create endpoint resolver for %s:%s, ignoring: %m",
434 peer->endpoint_host, peer->endpoint_port);
435
436 return 0;
437}
438
439static void wireguard_resolve_endpoints(NetDev *netdev) {
440 Wireguard *w = WIREGUARD(netdev);
441
442 LIST_FOREACH(peers, peer, w->peers)
443 if (peer_resolve_endpoint(peer) == -ENOBUFS)
444 /* Too many requests. Let's resolve remaining endpoints later. */
445 break;
446}
447
448static int netdev_wireguard_post_create(NetDev *netdev, Link *link) {
449 assert(WIREGUARD(netdev));
450
451 (void) wireguard_set_interface(netdev);
452 wireguard_resolve_endpoints(netdev);
453 return 0;
454}
455
456int config_parse_wireguard_listen_port(
457 const char *unit,
458 const char *filename,
459 unsigned line,
460 const char *section,
461 unsigned section_line,
462 const char *lvalue,
463 int ltype,
464 const char *rvalue,
465 void *data,
466 void *userdata) {
467
468 uint16_t *s = ASSERT_PTR(data);
469 int r;
470
471 assert(rvalue);
472
473 if (isempty(rvalue) || streq(rvalue, "auto")) {
474 *s = 0;
475 return 0;
476 }
477
478 r = parse_ip_port(rvalue, s);
479 if (r < 0) {
480 log_syntax(unit, LOG_WARNING, filename, line, r,
481 "Invalid port specification, ignoring assignment: %s", rvalue);
482 return 0;
483 }
484
485 return 0;
486}
487
488static int wireguard_decode_key_and_warn(
489 const char *rvalue,
490 uint8_t ret[static WG_KEY_LEN],
491 const char *unit,
492 const char *filename,
493 unsigned line,
494 const char *lvalue) {
495
496 _cleanup_(erase_and_freep) void *key = NULL;
497 _cleanup_(erase_and_freep) char *cred = NULL;
498 const char *cred_name;
499 size_t len;
500 int r;
501
502 assert(rvalue);
503 assert(ret);
504 assert(filename);
505 assert(lvalue);
506
507 if (isempty(rvalue)) {
508 memzero(ret, WG_KEY_LEN);
509 return 0;
510 }
511
512 cred_name = startswith(rvalue, "@");
513 if (cred_name) {
514 r = read_credential(cred_name, (void**) &cred, /* ret_size = */ NULL);
515 if (r == -ENOMEM)
516 return log_oom();
517 if (r < 0) {
518 log_syntax(unit, LOG_WARNING, filename, line, r,
519 "Failed to read credential for wireguard key (%s=), ignoring assignment: %m",
520 lvalue);
521 return 0;
522 }
523
524 } else if (!streq(lvalue, "PublicKey"))
525 (void) warn_file_is_world_accessible(filename, NULL, unit, line);
526
527 r = unbase64mem_full(cred ?: rvalue, SIZE_MAX, /* secure = */ true, &key, &len);
528 if (r == -ENOMEM)
529 return log_oom();
530 if (r < 0) {
531 log_syntax(unit, LOG_WARNING, filename, line, r,
532 "Failed to decode wireguard key provided by %s=, ignoring assignment: %m", lvalue);
533 return 0;
534 }
535 if (len != WG_KEY_LEN) {
536 log_syntax(unit, LOG_WARNING, filename, line, 0,
537 "Wireguard key provided by %s= has invalid length (%zu bytes), ignoring assignment.",
538 lvalue, len);
539 return 0;
540 }
541
542 memcpy(ret, key, WG_KEY_LEN);
543 return 0;
544}
545
546int config_parse_wireguard_private_key(
547 const char *unit,
548 const char *filename,
549 unsigned line,
550 const char *section,
551 unsigned section_line,
552 const char *lvalue,
553 int ltype,
554 const char *rvalue,
555 void *data,
556 void *userdata) {
557
558 Wireguard *w = WIREGUARD(data);
559
560 return wireguard_decode_key_and_warn(rvalue, w->private_key, unit, filename, line, lvalue);
561}
562
563int config_parse_wireguard_private_key_file(
564 const char *unit,
565 const char *filename,
566 unsigned line,
567 const char *section,
568 unsigned section_line,
569 const char *lvalue,
570 int ltype,
571 const char *rvalue,
572 void *data,
573 void *userdata) {
574
575 Wireguard *w = WIREGUARD(data);
576 _cleanup_free_ char *path = NULL;
577
578 if (isempty(rvalue)) {
579 w->private_key_file = mfree(w->private_key_file);
580 return 0;
581 }
582
583 path = strdup(rvalue);
584 if (!path)
585 return log_oom();
586
587 if (path_simplify_and_warn(path, PATH_CHECK_ABSOLUTE|PATH_CHECK_NON_API_VFS, unit, filename, line, lvalue) < 0)
588 return 0;
589
590 return free_and_replace(w->private_key_file, path);
591}
592
593int config_parse_wireguard_peer_key(
594 const char *unit,
595 const char *filename,
596 unsigned line,
597 const char *section,
598 unsigned section_line,
599 const char *lvalue,
600 int ltype,
601 const char *rvalue,
602 void *data,
603 void *userdata) {
604
605 Wireguard *w = WIREGUARD(data);
606 _cleanup_(wireguard_peer_free_or_set_invalidp) WireguardPeer *peer = NULL;
607 int r;
608
609 r = wireguard_peer_new_static(w, filename, section_line, &peer);
610 if (r < 0)
611 return log_oom();
612
613 r = wireguard_decode_key_and_warn(rvalue,
614 streq(lvalue, "PublicKey") ? peer->public_key : peer->preshared_key,
615 unit, filename, line, lvalue);
616 if (r < 0)
617 return r;
618
619 TAKE_PTR(peer);
620 return 0;
621}
622
623int config_parse_wireguard_peer_key_file(
624 const char *unit,
625 const char *filename,
626 unsigned line,
627 const char *section,
628 unsigned section_line,
629 const char *lvalue,
630 int ltype,
631 const char *rvalue,
632 void *data,
633 void *userdata) {
634
635 Wireguard *w = WIREGUARD(data);
636 _cleanup_(wireguard_peer_free_or_set_invalidp) WireguardPeer *peer = NULL;
637 _cleanup_free_ char *path = NULL;
638 char **key_file;
639 int r;
640
641 assert(filename);
642 assert(lvalue);
643
644 r = wireguard_peer_new_static(w, filename, section_line, &peer);
645 if (r < 0)
646 return log_oom();
647
648 if (streq(lvalue, "PublicKeyFile"))
649 key_file = &peer->public_key_file;
650 else if (streq(lvalue, "PresharedKeyFile"))
651 key_file = &peer->preshared_key_file;
652 else
653 assert_not_reached();
654
655 if (isempty(rvalue)) {
656 *key_file = mfree(*key_file);
657 TAKE_PTR(peer);
658 return 0;
659 }
660
661 path = strdup(rvalue);
662 if (!path)
663 return log_oom();
664
665 if (path_simplify_and_warn(path, PATH_CHECK_ABSOLUTE|PATH_CHECK_NON_API_VFS, unit, filename, line, lvalue) < 0)
666 return 0;
667
668 free_and_replace(*key_file, path);
669 TAKE_PTR(peer);
670 return 0;
671}
672
673int config_parse_wireguard_allowed_ips(
674 const char *unit,
675 const char *filename,
676 unsigned line,
677 const char *section,
678 unsigned section_line,
679 const char *lvalue,
680 int ltype,
681 const char *rvalue,
682 void *data,
683 void *userdata) {
684
685 assert(rvalue);
686
687 Wireguard *w = WIREGUARD(data);
688 _cleanup_(wireguard_peer_free_or_set_invalidp) WireguardPeer *peer = NULL;
689 union in_addr_union addr;
690 unsigned char prefixlen;
691 int r, family;
692 WireguardIPmask *ipmask;
693
694 r = wireguard_peer_new_static(w, filename, section_line, &peer);
695 if (r < 0)
696 return log_oom();
697
698 if (isempty(rvalue)) {
699 wireguard_peer_clear_ipmasks(peer);
700 TAKE_PTR(peer);
701 return 0;
702 }
703
704 for (const char *p = rvalue;;) {
705 _cleanup_free_ char *word = NULL;
706 union in_addr_union masked;
707
708 r = extract_first_word(&p, &word, "," WHITESPACE, 0);
709 if (r == 0)
710 break;
711 if (r == -ENOMEM)
712 return log_oom();
713 if (r < 0) {
714 log_syntax(unit, LOG_WARNING, filename, line, r,
715 "Failed to split allowed ips \"%s\" option: %m", rvalue);
716 break;
717 }
718
719 r = in_addr_prefix_from_string_auto(word, &family, &addr, &prefixlen);
720 if (r < 0) {
721 log_syntax(unit, LOG_WARNING, filename, line, r,
722 "Network address is invalid, ignoring assignment: %s", word);
723 continue;
724 }
725
726 masked = addr;
727 assert_se(in_addr_mask(family, &masked, prefixlen) >= 0);
728 if (!in_addr_equal(family, &masked, &addr))
729 log_syntax(unit, LOG_WARNING, filename, line, 0,
730 "Specified address '%s' is not properly masked, assuming '%s'.",
731 word,
732 IN_ADDR_PREFIX_TO_STRING(family, &masked, prefixlen));
733
734 ipmask = new(WireguardIPmask, 1);
735 if (!ipmask)
736 return log_oom();
737
738 *ipmask = (WireguardIPmask) {
739 .family = family,
740 .ip = masked,
741 .cidr = prefixlen,
742 };
743
744 LIST_PREPEND(ipmasks, peer->ipmasks, ipmask);
745 }
746
747 TAKE_PTR(peer);
748 return 0;
749}
750
751int config_parse_wireguard_endpoint(
752 const char *unit,
753 const char *filename,
754 unsigned line,
755 const char *section,
756 unsigned section_line,
757 const char *lvalue,
758 int ltype,
759 const char *rvalue,
760 void *data,
761 void *userdata) {
762
763 Wireguard *w = WIREGUARD(userdata);
764 _cleanup_(wireguard_peer_free_or_set_invalidp) WireguardPeer *peer = NULL;
765 _cleanup_free_ char *cred = NULL;
766 const char *cred_name, *endpoint;
767 uint16_t port;
768 int r;
769
770 assert(filename);
771 assert(rvalue);
772
773 r = wireguard_peer_new_static(w, filename, section_line, &peer);
774 if (r < 0)
775 return log_oom();
776
777 cred_name = startswith(rvalue, "@");
778 if (cred_name) {
779 r = read_credential(cred_name, (void**) &cred, /* ret_size = */ NULL);
780 if (r == -ENOMEM)
781 return log_oom();
782 if (r < 0) {
783 log_syntax(unit, LOG_WARNING, filename, line, r,
784 "Failed to read credential for wireguard endpoint, ignoring assignment: %m");
785 return 0;
786 }
787
788 endpoint = strstrip(cred);
789 } else
790 endpoint = rvalue;
791
792 union in_addr_union addr;
793 int family;
794
795 r = in_addr_port_ifindex_name_from_string_auto(endpoint, &family, &addr, &port, NULL, NULL);
796 if (r >= 0) {
797 if (family == AF_INET)
798 peer->endpoint.in = (struct sockaddr_in) {
799 .sin_family = AF_INET,
800 .sin_addr = addr.in,
801 .sin_port = htobe16(port),
802 };
803 else if (family == AF_INET6)
804 peer->endpoint.in6 = (struct sockaddr_in6) {
805 .sin6_family = AF_INET6,
806 .sin6_addr = addr.in6,
807 .sin6_port = htobe16(port),
808 };
809 else
810 assert_not_reached();
811
812 peer->endpoint_host = mfree(peer->endpoint_host);
813 peer->endpoint_port = mfree(peer->endpoint_port);
814
815 TAKE_PTR(peer);
816 return 0;
817 }
818
819 _cleanup_free_ char *host = NULL;
820 const char *p;
821
822 p = strrchr(endpoint, ':');
823 if (!p) {
824 log_syntax(unit, LOG_WARNING, filename, line, 0,
825 "Unable to find port of endpoint, ignoring assignment: %s",
826 rvalue); /* We log the original assignment instead of resolved credential here,
827 as the latter might be previously encrypted and we'd expose them in
828 unprotected logs otherwise. */
829 return 0;
830 }
831
832 host = strndup(endpoint, p - endpoint);
833 if (!host)
834 return log_oom();
835 p++;
836
837 if (!dns_name_is_valid(host)) {
838 log_syntax(unit, LOG_WARNING, filename, line, 0,
839 "Invalid domain name of endpoint, ignoring assignment: %s",
840 rvalue);
841 return 0;
842 }
843
844 r = parse_ip_port(p, &port);
845 if (r < 0) {
846 log_syntax(unit, LOG_WARNING, filename, line, r,
847 "Invalid port of endpoint, ignoring assignment: %s",
848 rvalue);
849 return 0;
850 }
851
852 peer->endpoint = (union sockaddr_union) {};
853
854 free_and_replace(peer->endpoint_host, host);
855
856 r = free_and_strdup(&peer->endpoint_port, p);
857 if (r < 0)
858 return log_oom();
859
860 TAKE_PTR(peer); /* The peer may already have been in the hash map, that is fine too. */
861 return 0;
862}
863
864int config_parse_wireguard_keepalive(
865 const char *unit,
866 const char *filename,
867 unsigned line,
868 const char *section,
869 unsigned section_line,
870 const char *lvalue,
871 int ltype,
872 const char *rvalue,
873 void *data,
874 void *userdata) {
875
876 assert(rvalue);
877
878 Wireguard *w = WIREGUARD(data);
879 _cleanup_(wireguard_peer_free_or_set_invalidp) WireguardPeer *peer = NULL;
880 uint16_t keepalive = 0;
881 int r;
882
883 r = wireguard_peer_new_static(w, filename, section_line, &peer);
884 if (r < 0)
885 return log_oom();
886
887 if (streq(rvalue, "off"))
888 keepalive = 0;
889 else {
890 r = safe_atou16(rvalue, &keepalive);
891 if (r < 0) {
892 log_syntax(unit, LOG_WARNING, filename, line, r,
893 "Failed to parse \"%s\" as keepalive interval (range 0–65535), ignoring assignment: %m",
894 rvalue);
895 return 0;
896 }
897 }
898
899 peer->persistent_keepalive_interval = keepalive;
900
901 TAKE_PTR(peer);
902 return 0;
903}
904
905int config_parse_wireguard_route_table(
906 const char *unit,
907 const char *filename,
908 unsigned line,
909 const char *section,
910 unsigned section_line,
911 const char *lvalue,
912 int ltype,
913 const char *rvalue,
914 void *data,
915 void *userdata) {
916
917 NetDev *netdev = ASSERT_PTR(userdata);
918 uint32_t *table = ASSERT_PTR(data);
919 int r;
920
921 assert(filename);
922 assert(lvalue);
923 assert(rvalue);
924
925 if (isempty(rvalue) || parse_boolean(rvalue) == 0) {
926 *table = 0; /* Disabled. */
927 return 0;
928 }
929
930 r = manager_get_route_table_from_string(netdev->manager, rvalue, table);
931 if (r < 0) {
932 log_syntax(unit, LOG_WARNING, filename, line, r,
933 "Failed to parse %s=, ignoring assignment: %s",
934 lvalue, rvalue);
935 return 0;
936 }
937
938 return 0;
939}
940
941int config_parse_wireguard_peer_route_table(
942 const char *unit,
943 const char *filename,
944 unsigned line,
945 const char *section,
946 unsigned section_line,
947 const char *lvalue,
948 int ltype,
949 const char *rvalue,
950 void *data,
951 void *userdata) {
952
953 Wireguard *w = WIREGUARD(userdata);
954 _cleanup_(wireguard_peer_free_or_set_invalidp) WireguardPeer *peer = NULL;
955 int r;
956
957 assert(filename);
958 assert(lvalue);
959 assert(rvalue);
960 assert(NETDEV(w)->manager);
961
962 r = wireguard_peer_new_static(w, filename, section_line, &peer);
963 if (r < 0)
964 return log_oom();
965
966 if (isempty(rvalue)) {
967 peer->route_table_set = false; /* Use the table specified in [WireGuard] section. */
968 TAKE_PTR(peer);
969 return 0;
970 }
971
972 if (parse_boolean(rvalue) == 0) {
973 peer->route_table = 0; /* Disabled. */
974 peer->route_table_set = true;
975 TAKE_PTR(peer);
976 return 0;
977 }
978
979 r = manager_get_route_table_from_string(NETDEV(w)->manager, rvalue, &peer->route_table);
980 if (r < 0) {
981 log_syntax(unit, LOG_WARNING, filename, line, r,
982 "Failed to parse %s=, ignoring assignment: %s",
983 lvalue, rvalue);
984 return 0;
985 }
986
987 peer->route_table_set = true;
988 TAKE_PTR(peer);
989 return 0;
990}
991
992int config_parse_wireguard_route_priority(
993 const char *unit,
994 const char *filename,
995 unsigned line,
996 const char *section,
997 unsigned section_line,
998 const char *lvalue,
999 int ltype,
1000 const char *rvalue,
1001 void *data,
1002 void *userdata) {
1003
1004 uint32_t *priority = ASSERT_PTR(data);
1005 int r;
1006
1007 assert(filename);
1008 assert(lvalue);
1009 assert(rvalue);
1010
1011 if (isempty(rvalue)) {
1012 *priority = 0;
1013 return 0;
1014 }
1015
1016 r = safe_atou32(rvalue, priority);
1017 if (r < 0) {
1018 log_syntax(unit, LOG_WARNING, filename, line, r,
1019 "Could not parse route priority \"%s\", ignoring assignment: %m", rvalue);
1020 return 0;
1021 }
1022
1023 return 0;
1024}
1025
1026int config_parse_wireguard_peer_route_priority(
1027 const char *unit,
1028 const char *filename,
1029 unsigned line,
1030 const char *section,
1031 unsigned section_line,
1032 const char *lvalue,
1033 int ltype,
1034 const char *rvalue,
1035 void *data,
1036 void *userdata) {
1037
1038 _cleanup_(wireguard_peer_free_or_set_invalidp) WireguardPeer *peer = NULL;
1039 Wireguard *w;
1040 int r;
1041
1042 assert(filename);
1043 assert(lvalue);
1044 assert(rvalue);
1045 assert(userdata);
1046
1047 w = WIREGUARD(userdata);
1048 assert(w);
1049
1050 r = wireguard_peer_new_static(w, filename, section_line, &peer);
1051 if (r < 0)
1052 return log_oom();
1053
1054 if (isempty(rvalue)) {
1055 peer->route_priority_set = false; /* Use the priority specified in [WireGuard] section. */
1056 TAKE_PTR(peer);
1057 return 0;
1058 }
1059
1060 r = safe_atou32(rvalue, &peer->route_priority);
1061 if (r < 0) {
1062 log_syntax(unit, LOG_WARNING, filename, line, r,
1063 "Could not parse route priority \"%s\", ignoring assignment: %m", rvalue);
1064 return 0;
1065 }
1066
1067 peer->route_priority_set = true;
1068 TAKE_PTR(peer);
1069 return 0;
1070}
1071
1072static void wireguard_init(NetDev *netdev) {
1073 Wireguard *w = WIREGUARD(netdev);
1074
1075 w->flags = WGDEVICE_F_REPLACE_PEERS;
1076}
1077
1078static void wireguard_done(NetDev *netdev) {
1079 Wireguard *w = WIREGUARD(netdev);
1080
1081 explicit_bzero_safe(w->private_key, WG_KEY_LEN);
1082 free(w->private_key_file);
1083
1084 hashmap_free(w->peers_by_section);
1085
1086 set_free(w->routes);
1087}
1088
1089static int wireguard_read_key_file(const char *filename, uint8_t dest[static WG_KEY_LEN]) {
1090 _cleanup_(erase_and_freep) char *key = NULL;
1091 size_t key_len;
1092 int r;
1093
1094 if (!filename)
1095 return 0;
1096
1097 assert(dest);
1098
1099 r = read_full_file_full(
1100 AT_FDCWD, filename, UINT64_MAX, WG_KEY_LEN,
1101 READ_FULL_FILE_SECURE |
1102 READ_FULL_FILE_UNBASE64 |
1103 READ_FULL_FILE_WARN_WORLD_READABLE |
1104 READ_FULL_FILE_CONNECT_SOCKET |
1105 READ_FULL_FILE_FAIL_WHEN_LARGER,
1106 NULL, &key, &key_len);
1107 if (r < 0)
1108 return r;
1109
1110 if (key_len != WG_KEY_LEN)
1111 return -EINVAL;
1112
1113 memcpy(dest, key, WG_KEY_LEN);
1114 return 0;
1115}
1116
1117static int wireguard_peer_verify(WireguardPeer *peer) {
1118 NetDev *netdev = NETDEV(peer->wireguard);
1119 int r;
1120
1121 if (section_is_invalid(peer->section))
1122 return -EINVAL;
1123
1124 r = wireguard_read_key_file(peer->public_key_file, peer->public_key);
1125 if (r < 0)
1126 return log_netdev_error_errno(netdev, r,
1127 "%s: Failed to read public key from '%s'. "
1128 "Ignoring [WireGuardPeer] section from line %u.",
1129 peer->section->filename, peer->public_key_file,
1130 peer->section->line);
1131
1132 if (eqzero(peer->public_key))
1133 return log_netdev_error_errno(netdev, SYNTHETIC_ERRNO(EINVAL),
1134 "%s: WireGuardPeer section without PublicKey= configured. "
1135 "Ignoring [WireGuardPeer] section from line %u.",
1136 peer->section->filename, peer->section->line);
1137
1138 r = wireguard_read_key_file(peer->preshared_key_file, peer->preshared_key);
1139 if (r < 0)
1140 return log_netdev_error_errno(netdev, r,
1141 "%s: Failed to read preshared key from '%s'. "
1142 "Ignoring [WireGuardPeer] section from line %u.",
1143 peer->section->filename, peer->preshared_key_file,
1144 peer->section->line);
1145
1146 return 0;
1147}
1148
1149static int wireguard_read_default_key_cred(NetDev *netdev, const char *filename) {
1150 Wireguard *w = WIREGUARD(netdev);
1151 _cleanup_free_ char *config_name = NULL;
1152 int r;
1153
1154 assert(filename);
1155
1156 r = path_extract_filename(filename, &config_name);
1157 if (r < 0)
1158 return log_netdev_error_errno(netdev, r,
1159 "%s: Failed to extract config name, ignoring network device: %m",
1160 filename);
1161
1162 char *p = endswith(config_name, ".netdev");
1163 if (!p)
1164 /* Fuzzer run? Then we just ignore this device. */
1165 return log_netdev_error_errno(netdev, SYNTHETIC_ERRNO(EINVAL),
1166 "%s: Invalid netdev config name, refusing default key lookup.",
1167 filename);
1168 *p = '\0';
1169
1170 _cleanup_(erase_and_freep) char *cred = NULL;
1171
1172 r = read_credential(strjoina("network.wireguard.private.", config_name), (void**) &cred, /* ret_size = */ NULL);
1173 if (r < 0)
1174 return log_netdev_error_errno(netdev, r,
1175 "%s: No private key specified and default key isn't available, "
1176 "ignoring network device: %m",
1177 filename);
1178
1179 _cleanup_(erase_and_freep) void *key = NULL;
1180 size_t len;
1181
1182 r = unbase64mem_full(cred, SIZE_MAX, /* secure = */ true, &key, &len);
1183 if (r < 0)
1184 return log_netdev_error_errno(netdev, r,
1185 "%s: No private key specified and default key cannot be parsed, "
1186 "ignoring network device: %m",
1187 filename);
1188 if (len != WG_KEY_LEN || memeqzero(key, len))
1189 return log_netdev_error_errno(netdev, SYNTHETIC_ERRNO(EINVAL),
1190 "%s: No private key specified and default key is invalid. "
1191 "Ignoring network device.",
1192 filename);
1193
1194 memcpy(w->private_key, key, WG_KEY_LEN);
1195 return 0;
1196}
1197
1198static int wireguard_verify(NetDev *netdev, const char *filename) {
1199 Wireguard *w = WIREGUARD(netdev);
1200 int r;
1201
1202 r = wireguard_read_key_file(w->private_key_file, w->private_key);
1203 if (r < 0)
1204 return log_netdev_error_errno(netdev, r,
1205 "Failed to read private key from '%s', ignoring network device: %m",
1206 w->private_key_file);
1207
1208 if (eqzero(w->private_key)) {
1209 r = wireguard_read_default_key_cred(netdev, filename);
1210 if (r < 0)
1211 return r;
1212 }
1213
1214 LIST_FOREACH(peers, peer, w->peers) {
1215 if (wireguard_peer_verify(peer) < 0) {
1216 wireguard_peer_free(peer);
1217 continue;
1218 }
1219
1220 if ((peer->route_table_set ? peer->route_table : w->route_table) == 0)
1221 continue;
1222
1223 LIST_FOREACH(ipmasks, ipmask, peer->ipmasks) {
1224 _cleanup_(route_unrefp) Route *route = NULL;
1225
1226 r = route_new(&route);
1227 if (r < 0)
1228 return log_oom();
1229
1230 /* For route_section_verify() below. */
1231 r = config_section_new(peer->section->filename, peer->section->line, &route->section);
1232 if (r < 0)
1233 return log_oom();
1234
1235 route->source = NETWORK_CONFIG_SOURCE_STATIC;
1236 route->family = ipmask->family;
1237 route->dst = ipmask->ip;
1238 route->dst_prefixlen = ipmask->cidr;
1239 route->protocol = RTPROT_STATIC;
1240 route->protocol_set = true;
1241 route->table = peer->route_table_set ? peer->route_table : w->route_table;
1242 route->table_set = true;
1243 route->priority = peer->route_priority_set ? peer->route_priority : w->route_priority;
1244 route->priority_set = true;
1245
1246 if (route_section_verify(route) < 0)
1247 continue;
1248
1249 r = set_ensure_put(&w->routes, &route_hash_ops, route);
1250 if (r < 0)
1251 return log_oom();
1252 if (r == 0)
1253 continue;
1254
1255 route->wireguard = w;
1256 TAKE_PTR(route);
1257 }
1258 }
1259
1260 return 0;
1261}
1262
1263const NetDevVTable wireguard_vtable = {
1264 .object_size = sizeof(Wireguard),
1265 .sections = NETDEV_COMMON_SECTIONS "WireGuard\0WireGuardPeer\0",
1266 .post_create = netdev_wireguard_post_create,
1267 .init = wireguard_init,
1268 .done = wireguard_done,
1269 .create_type = NETDEV_CREATE_INDEPENDENT,
1270 .config_verify = wireguard_verify,
1271 .iftype = ARPHRD_NONE,
1272 .keep_existing = true,
1273};
Unnamed repository; edit this file 'description' to name the repository.