aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--common.h1
-rw-r--r--lease.c130
-rw-r--r--lease.h14
-rw-r--r--wg-dynamic-server.c54
4 files changed, 152 insertions, 47 deletions
diff --git a/common.h b/common.h
index fcb0f0e..426ad20 100644
--- a/common.h
+++ b/common.h
@@ -74,6 +74,7 @@ struct wg_dynamic_request {
uint32_t version;
int fd;
wg_key pubkey;
+ struct in6_addr lladdr;
unsigned char *buf;
size_t buflen;
struct wg_dynamic_attr *first, *last;
diff --git a/lease.c b/lease.c
index 8a48a27..ea8be30 100644
--- a/lease.c
+++ b/lease.c
@@ -14,6 +14,7 @@
#include <stdlib.h>
#include <sys/socket.h>
#include <time.h>
+#include <string.h>
#include "common.h"
#include "dbg.h"
@@ -91,7 +92,8 @@ void leases_free()
}
struct wg_dynamic_lease *new_lease(wg_key pubkey, uint32_t leasetime,
- struct in_addr *ipv4, struct in6_addr *ipv6)
+ struct in_addr *ipv4, struct in6_addr *ipv6,
+ const struct in6_addr *lladdr)
{
struct wg_dynamic_lease *lease, *parent;
uint64_t index_l;
@@ -152,6 +154,8 @@ struct wg_dynamic_lease *new_lease(wg_key pubkey, uint32_t leasetime,
}
}
+ memcpy(&lease->lladdr, lladdr, sizeof(lease->lladdr));
+
if (clock_gettime(CLOCK_REALTIME, &tp))
fatal("clock_gettime(CLOCK_REALTIME)");
@@ -203,15 +207,117 @@ bool extend_lease(struct wg_dynamic_lease *lease, uint32_t leasetime)
return false;
}
-int leases_refresh()
+struct allowedips_update {
+ wg_key peer_pubkey;
+ struct in_addr ipv4;
+ struct in6_addr ipv6;
+ struct in6_addr lladdr;
+};
+
+static char *updates_to_str(const struct allowedips_update *u)
+{
+ static char buf[4096];
+ wg_key_b64_string pubkey_asc;
+ char v4[INET_ADDRSTRLEN], v6[INET6_ADDRSTRLEN], ll[INET6_ADDRSTRLEN];
+
+
+ if (!u)
+ return "(null)";
+
+ wg_key_to_base64(pubkey_asc, u->peer_pubkey);
+ inet_ntop(AF_INET, &u->ipv4, v4, sizeof v4);
+ inet_ntop(AF_INET6, &u->ipv6, v6, sizeof v6);
+ inet_ntop(AF_INET6, &u->lladdr, ll, sizeof ll);
+ snprintf(buf, sizeof buf, "(%p) %s [%s] [%s]", u, v4, v6, ll);
+
+ return buf;
+}
+
+static void update_allowed_ips_bulk(const char *devname,
+ const struct allowedips_update *updates,
+ int nupdates)
+{
+ wg_peer peers[WG_DYNAMIC_LEASE_CHUNKSIZE] = { 0 };
+ wg_allowedip allowedips[3 * WG_DYNAMIC_LEASE_CHUNKSIZE] = { 0 };
+ wg_device dev = { 0 };
+ wg_peer **pp = &dev.first_peer;
+
+ int peer_idx = 0;
+ int allowedips_idx = 0;
+ for (int i = 0; i < nupdates; i++) {
+
+ debug("setting allowedips for %s\n", updates_to_str(&updates[i]));
+
+ peers[peer_idx].flags |= WGPEER_REPLACE_ALLOWEDIPS;
+ memcpy(peers[peer_idx].public_key, updates[i].peer_pubkey, sizeof(wg_key));
+ wg_allowedip **aipp = &peers[peer_idx].first_allowedip;
+
+ /* TODO: move to a function */
+ if (updates[i].ipv4.s_addr) {
+ allowedips[allowedips_idx] = (wg_allowedip){
+ .family = AF_INET,
+ .cidr = 32,
+ .ip4 = updates[i].ipv4,
+ };
+ *aipp = &allowedips[allowedips_idx];
+ aipp = &allowedips[allowedips_idx].next_allowedip;
+ ++allowedips_idx;
+ }
+ if (!IN6_IS_ADDR_UNSPECIFIED(&updates[i].ipv6)) {
+ allowedips[allowedips_idx] = (wg_allowedip){
+ .family = AF_INET6,
+ .cidr = 128,
+ .ip6 = updates[i].ipv6,
+ };
+ *aipp = &allowedips[allowedips_idx];
+ aipp = &allowedips[allowedips_idx].next_allowedip;
+ ++allowedips_idx;
+ }
+ if (!IN6_IS_ADDR_UNSPECIFIED(&updates[i].lladdr)) {
+ allowedips[allowedips_idx] = (wg_allowedip){
+ .family = AF_INET6,
+ .cidr = 128,
+ .ip6 = updates[i].lladdr,
+ };
+ *aipp = &allowedips[allowedips_idx];
+ //aipp = &allowedips[allowedips_idx].next_allowedip;
+ ++allowedips_idx;
+ }
+
+ *pp = &peers[peer_idx];
+ pp = &peers[peer_idx].next_peer;
+ ++peer_idx;
+ }
+
+ strncpy(dev.name, devname, sizeof(dev.name) - 1);
+ if (wg_set_device(&dev))
+ fatal("wg_set_device()");
+}
+
+void update_allowed_ips(const char *devname, wg_key peer_pubkey,
+ const struct wg_dynamic_lease *lease)
+{
+ struct allowedips_update update;
+
+ memcpy(update.peer_pubkey, peer_pubkey, sizeof(wg_key));
+ memcpy(&update.ipv4, &lease->ipv4, sizeof(struct in_addr));
+ memcpy(&update.ipv6, &lease->ipv6, sizeof(struct in6_addr));
+ memcpy(&update.lladdr, &lease->lladdr, sizeof(struct in6_addr));
+
+ update_allowed_ips_bulk(devname, &update, 1);
+}
+
+int leases_refresh(const char *devname)
{
time_t cur_time = get_monotonic_time();
+ struct allowedips_update updates[WG_DYNAMIC_LEASE_CHUNKSIZE] = { 0 };
if (cur_time < gexpires)
return MIN(INT_MAX / 1000, gexpires - cur_time);
gexpires = TIME_T_MAX;
+ int i = 0;
for (khint_t k = kh_begin(leases_ht); k != kh_end(leases_ht); ++k) {
if (!kh_exist(leases_ht, k))
continue;
@@ -228,6 +334,23 @@ int leases_refresh()
if (!IN6_IS_ADDR_UNSPECIFIED(ipv6))
ipp_del_v6(&pool, ipv6, 128);
+ memcpy(updates[i].peer_pubkey, kh_key(leases_ht, k),
+ sizeof(wg_key));
+ updates[i].lladdr = (*pp)->lladdr;
+ {
+ wg_key_b64_string pubkey_asc;
+ wg_key_to_base64(pubkey_asc,
+ updates[i].peer_pubkey);
+ debug("Peer losing its lease: %s\n",
+ pubkey_asc);
+ }
+ i++;
+ if (i == WG_DYNAMIC_LEASE_CHUNKSIZE) {
+ update_allowed_ips_bulk(devname, updates, i);
+ i = 0;
+ memset(updates, 0, sizeof updates);
+ }
+
tmp = *pp;
*pp = (*pp)->next;
free(tmp);
@@ -239,6 +362,9 @@ int leases_refresh()
}
}
+ if (i)
+ update_allowed_ips_bulk(devname, updates, i);
+
if (!kh_val(leases_ht, k)) {
free((char *)kh_key(leases_ht, k));
kh_del(leaseht, leases_ht, k);
diff --git a/lease.h b/lease.h
index 3e1402d..bffcd66 100644
--- a/lease.h
+++ b/lease.h
@@ -13,12 +13,15 @@
#include "common.h"
#include "netlink.h"
+#define WG_DYNAMIC_LEASE_CHUNKSIZE 256
+
struct wg_dynamic_lease {
time_t start_real;
time_t start_mono;
uint32_t leasetime; /* in seconds */
struct in_addr ipv4;
struct in6_addr ipv6;
+ struct in6_addr lladdr;
struct wg_dynamic_lease *next;
};
@@ -38,7 +41,8 @@ void leases_free();
* of assignable IPs or the requested IP is already taken.
*/
struct wg_dynamic_lease *new_lease(wg_key pubkey, uint32_t leasetime,
- struct in_addr *ipv4, struct in6_addr *ipv6);
+ struct in_addr *ipv4, struct in6_addr *ipv6,
+ const struct in6_addr *lladdr);
/*
* Returns all leases belonging to pubkey, or NULL if there are none.
@@ -54,7 +58,13 @@ bool extend_lease(struct wg_dynamic_lease *lease, uint32_t leasetime);
/* Refreshes all leases, meaning expired ones will be removed. Returns the
* amount of seconds until the next lease will expire, or at most INT_MAX/1000.
*/
-int leases_refresh();
+int leases_refresh(const char *devname);
+
+/*
+ * Updates allowedips for peer_pubkey on devname, adding what's in
+ * lease (including lladdr), removing all others.
+ */
+void update_allowed_ips(const char *devname, wg_key peer_pubkey, const struct wg_dynamic_lease *lease);
/*
* Updates all pools with information from the mnl socket nlsock.
diff --git a/wg-dynamic-server.c b/wg-dynamic-server.c
index fca1dfc..49474ae 100644
--- a/wg-dynamic-server.c
+++ b/wg-dynamic-server.c
@@ -9,7 +9,6 @@
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
-#include <string.h>
#include <time.h>
#include <arpa/inet.h>
@@ -167,7 +166,7 @@ static wg_key *addr_to_pubkey(struct sockaddr_storage *addr)
return NULL;
}
-static int accept_connection(int sockfd, wg_key *dest)
+static int accept_connection(int sockfd, wg_key *dest_pubkey, struct in6_addr *dest_lladdr)
{
int fd;
wg_key *pubkey;
@@ -211,7 +210,9 @@ static int accept_connection(int sockfd, wg_key *dest)
return -ENOENT;
}
}
- memcpy(dest, pubkey, sizeof *dest);
+ memcpy(dest_pubkey, pubkey, sizeof *dest_pubkey);
+
+ memcpy(dest_lladdr, &((struct sockaddr_in6 *) &addr)->sin6_addr, sizeof *dest_lladdr);
wg_key_b64_string key;
char out[INET6_ADDRSTRLEN];
@@ -260,41 +261,8 @@ static size_t serialize_lease(char *buf, size_t len,
return off;
}
-static void add_allowed_ips(wg_key pubkey, struct in_addr *ipv4,
- struct in6_addr *ipv6)
-{
- wg_allowedip allowed_v4, allowed_v6;
- wg_peer peer = { 0 };
- wg_device dev = { .first_peer = &peer };
-
- strcpy(dev.name, wg_interface);
- memcpy(peer.public_key, pubkey, sizeof peer.public_key);
- wg_allowedip **cur = &peer.first_allowedip;
-
- if (ipv4) {
- allowed_v4 = (wg_allowedip){
- .family = AF_INET,
- .cidr = 32,
- .ip4 = *ipv4,
- };
- *cur = &allowed_v4;
- cur = &allowed_v4.next_allowedip;
- }
-
- if (ipv6) {
- allowed_v6 = (wg_allowedip){
- .family = AF_INET6,
- .cidr = 128,
- .ip6 = *ipv6,
- };
- *cur = &allowed_v6;
- }
-
- if (wg_set_device(&dev))
- fatal("wg_set_device()");
-}
-
-static int response_request_ip(struct wg_dynamic_attr *cur, wg_key pubkey,
+static int response_request_ip(struct wg_dynamic_attr *cur,
+ wg_key pubkey, const struct in6_addr *lladdr,
struct wg_dynamic_lease **lease)
{
struct in_addr *ipv4 = NULL;
@@ -324,7 +292,7 @@ static int response_request_ip(struct wg_dynamic_attr *cur, wg_key pubkey,
if (ipv4 && ipv6 && !ipv4->s_addr && IN6_IS_ADDR_UNSPECIFIED(ipv6))
return E_INVALID_REQ;
- *lease = new_lease(pubkey, leasetime, ipv4, ipv6);
+ *lease = new_lease(pubkey, leasetime, ipv4, ipv6, lladdr);
if (!*lease)
return E_IP_UNAVAIL;
@@ -341,11 +309,11 @@ static bool send_response(struct wg_dynamic_request *req)
switch (req->cmd) {
case WGKEY_REQUEST_IP:
- ret = response_request_ip(cur, req->pubkey, &lease);
+ ret = response_request_ip(cur, req->pubkey, &req->lladdr, &lease);
if (ret)
break;
- add_allowed_ips(req->pubkey, &lease->ipv4, &lease->ipv6);
+ update_allowed_ips(wg_interface, req->pubkey, lease);
msglen = serialize_lease(buf, sizeof buf, lease);
break;
default:
@@ -479,7 +447,7 @@ static void accept_incoming(int sockfd, int epollfd,
struct epoll_event ev;
while ((n = get_avail_request()) >= 0) {
- fd = accept_connection(sockfd, &requests[n].pubkey);
+ fd = accept_connection(sockfd, &requests[n].pubkey, &requests[n].lladdr);
if (fd < 0) {
if (fd == -ENOENT) {
debug("Failed to match IP to pubkey\n");
@@ -546,7 +514,7 @@ static void poll_loop()
fatal("epoll_ctl()");
while (1) {
- time_t next = leases_refresh() * 1000;
+ time_t next = leases_refresh(wg_interface) * 1000;
int nfds = epoll_wait(epollfd, events, MAX_CONNECTIONS, next);
if (nfds == -1) {
if (errno == EINTR)