From a2a3e540f2d1a507b34eccae26de09066a2a12fa Mon Sep 17 00:00:00 2001 From: Bin Jin Date: Sun, 12 Mar 2017 17:48:20 +0800 Subject: Initial commit --- .gitignore | 5 + LICENSE | 674 ++++++++++++++++++++++++++ Setup.hs | 2 + cbits/tun-linux.c | 40 ++ cbits/tun-macos.c | 115 +++++ cbits/tun.h | 11 + include/uapi.h | 159 ++++++ nara.cabal | 82 ++++ src/Main.hs | 81 ++++ src/Network/WireGuard/Core.hs | 336 +++++++++++++ src/Network/WireGuard/Daemon.hs | 55 +++ src/Network/WireGuard/Foreign/In6Addr.hsc | 90 ++++ src/Network/WireGuard/Foreign/Key.hs | 29 ++ src/Network/WireGuard/Foreign/Tun.hs | 45 ++ src/Network/WireGuard/Foreign/UAPI.hsc | 172 +++++++ src/Network/WireGuard/Internal/Constant.hs | 55 +++ src/Network/WireGuard/Internal/IPPacket.hs | 56 +++ src/Network/WireGuard/Internal/Noise.hs | 98 ++++ src/Network/WireGuard/Internal/Packet.hs | 112 +++++ src/Network/WireGuard/Internal/PacketQueue.hs | 49 ++ src/Network/WireGuard/Internal/State.hs | 242 +++++++++ src/Network/WireGuard/Internal/Types.hs | 78 +++ src/Network/WireGuard/Internal/Util.hs | 62 +++ src/Network/WireGuard/RPC.hs | 187 +++++++ src/Network/WireGuard/TunListener.hs | 60 +++ src/Network/WireGuard/UdpListener.hs | 61 +++ stack.yaml | 10 + 27 files changed, 2966 insertions(+) create mode 100644 .gitignore create mode 100644 LICENSE create mode 100644 Setup.hs create mode 100644 cbits/tun-linux.c create mode 100644 cbits/tun-macos.c create mode 100644 cbits/tun.h create mode 100644 include/uapi.h create mode 100644 nara.cabal create mode 100644 src/Main.hs create mode 100644 src/Network/WireGuard/Core.hs create mode 100644 src/Network/WireGuard/Daemon.hs create mode 100644 src/Network/WireGuard/Foreign/In6Addr.hsc create mode 100644 src/Network/WireGuard/Foreign/Key.hs create mode 100644 src/Network/WireGuard/Foreign/Tun.hs create mode 100644 src/Network/WireGuard/Foreign/UAPI.hsc create mode 100644 src/Network/WireGuard/Internal/Constant.hs create mode 100644 src/Network/WireGuard/Internal/IPPacket.hs create mode 100644 src/Network/WireGuard/Internal/Noise.hs create mode 100644 src/Network/WireGuard/Internal/Packet.hs create mode 100644 src/Network/WireGuard/Internal/PacketQueue.hs create mode 100644 src/Network/WireGuard/Internal/State.hs create mode 100644 src/Network/WireGuard/Internal/Types.hs create mode 100644 src/Network/WireGuard/Internal/Util.hs create mode 100644 src/Network/WireGuard/RPC.hs create mode 100644 src/Network/WireGuard/TunListener.hs create mode 100644 src/Network/WireGuard/UdpListener.hs create mode 100644 stack.yaml diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..40c03ef --- /dev/null +++ b/.gitignore @@ -0,0 +1,5 @@ +/.stack-work +/dist +/.cabal-sandbox +cabal.sandbox.config + diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..45644ff --- /dev/null +++ b/LICENSE @@ -0,0 +1,674 @@ + GNU GENERAL PUBLIC LICENSE + Version 3, 29 June 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The GNU General Public License is a free, copyleft license for +software and other kinds of works. + + The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +the GNU General Public License is intended to guarantee your freedom to +share and change all versions of a program--to make sure it remains free +software for all its users. We, the Free Software Foundation, use the +GNU General Public License for most of our software; it applies also to +any other work released this way by its authors. You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + + To protect your rights, we need to prevent others from denying you +these rights or asking you to surrender the rights. Therefore, you have +certain responsibilities if you distribute copies of the software, or if +you modify it: responsibilities to respect the freedom of others. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must pass on to the recipients the same +freedoms that you received. You must make sure that they, too, receive +or can get the source code. And you must show them these terms so they +know their rights. + + Developers that use the GNU GPL protect your rights with two steps: +(1) assert copyright on the software, and (2) offer you this License +giving you legal permission to copy, distribute and/or modify it. + + For the developers' and authors' protection, the GPL clearly explains +that there is no warranty for this free software. For both users' and +authors' sake, the GPL requires that modified versions be marked as +changed, so that their problems will not be attributed erroneously to +authors of previous versions. + + Some devices are designed to deny users access to install or run +modified versions of the software inside them, although the manufacturer +can do so. This is fundamentally incompatible with the aim of +protecting users' freedom to change the software. The systematic +pattern of such abuse occurs in the area of products for individuals to +use, which is precisely where it is most unacceptable. Therefore, we +have designed this version of the GPL to prohibit the practice for those +products. If such problems arise substantially in other domains, we +stand ready to extend this provision to those domains in future versions +of the GPL, as needed to protect the freedom of users. + + Finally, every program is threatened constantly by software patents. +States should not allow patents to restrict development and use of +software on general-purpose computers, but in those that do, we wish to +avoid the special danger that patents applied to a free program could +make it effectively proprietary. To prevent this, the GPL assures that +patents cannot be used to render the program non-free. + + The precise terms and conditions for copying, distribution and +modification follow. + + TERMS AND CONDITIONS + + 0. Definitions. + + "This License" refers to version 3 of the GNU General Public License. + + "Copyright" also means copyright-like laws that apply to other kinds of +works, such as semiconductor masks. + + "The Program" refers to any copyrightable work licensed under this +License. Each licensee is addressed as "you". "Licensees" and +"recipients" may be individuals or organizations. + + To "modify" a work means to copy from or adapt all or part of the work +in a fashion requiring copyright permission, other than the making of an +exact copy. The resulting work is called a "modified version" of the +earlier work or a work "based on" the earlier work. + + A "covered work" means either the unmodified Program or a work based +on the Program. + + To "propagate" a work means to do anything with it that, without +permission, would make you directly or secondarily liable for +infringement under applicable copyright law, except executing it on a +computer or modifying a private copy. Propagation includes copying, +distribution (with or without modification), making available to the +public, and in some countries other activities as well. + + To "convey" a work means any kind of propagation that enables other +parties to make or receive copies. Mere interaction with a user through +a computer network, with no transfer of a copy, is not conveying. + + An interactive user interface displays "Appropriate Legal Notices" +to the extent that it includes a convenient and prominently visible +feature that (1) displays an appropriate copyright notice, and (2) +tells the user that there is no warranty for the work (except to the +extent that warranties are provided), that licensees may convey the +work under this License, and how to view a copy of this License. If +the interface presents a list of user commands or options, such as a +menu, a prominent item in the list meets this criterion. + + 1. Source Code. + + The "source code" for a work means the preferred form of the work +for making modifications to it. "Object code" means any non-source +form of a work. + + A "Standard Interface" means an interface that either is an official +standard defined by a recognized standards body, or, in the case of +interfaces specified for a particular programming language, one that +is widely used among developers working in that language. + + The "System Libraries" of an executable work include anything, other +than the work as a whole, that (a) is included in the normal form of +packaging a Major Component, but which is not part of that Major +Component, and (b) serves only to enable use of the work with that +Major Component, or to implement a Standard Interface for which an +implementation is available to the public in source code form. A +"Major Component", in this context, means a major essential component +(kernel, window system, and so on) of the specific operating system +(if any) on which the executable work runs, or a compiler used to +produce the work, or an object code interpreter used to run it. + + The "Corresponding Source" for a work in object code form means all +the source code needed to generate, install, and (for an executable +work) run the object code and to modify the work, including scripts to +control those activities. However, it does not include the work's +System Libraries, or general-purpose tools or generally available free +programs which are used unmodified in performing those activities but +which are not part of the work. For example, Corresponding Source +includes interface definition files associated with source files for +the work, and the source code for shared libraries and dynamically +linked subprograms that the work is specifically designed to require, +such as by intimate data communication or control flow between those +subprograms and other parts of the work. + + The Corresponding Source need not include anything that users +can regenerate automatically from other parts of the Corresponding +Source. + + The Corresponding Source for a work in source code form is that +same work. + + 2. Basic Permissions. + + All rights granted under this License are granted for the term of +copyright on the Program, and are irrevocable provided the stated +conditions are met. This License explicitly affirms your unlimited +permission to run the unmodified Program. The output from running a +covered work is covered by this License only if the output, given its +content, constitutes a covered work. This License acknowledges your +rights of fair use or other equivalent, as provided by copyright law. + + You may make, run and propagate covered works that you do not +convey, without conditions so long as your license otherwise remains +in force. You may convey covered works to others for the sole purpose +of having them make modifications exclusively for you, or provide you +with facilities for running those works, provided that you comply with +the terms of this License in conveying all material for which you do +not control copyright. Those thus making or running the covered works +for you must do so exclusively on your behalf, under your direction +and control, on terms that prohibit them from making any copies of +your copyrighted material outside their relationship with you. + + Conveying under any other circumstances is permitted solely under +the conditions stated below. Sublicensing is not allowed; section 10 +makes it unnecessary. + + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + + No covered work shall be deemed part of an effective technological +measure under any applicable law fulfilling obligations under article +11 of the WIPO copyright treaty adopted on 20 December 1996, or +similar laws prohibiting or restricting circumvention of such +measures. + + When you convey a covered work, you waive any legal power to forbid +circumvention of technological measures to the extent such circumvention +is effected by exercising rights under this License with respect to +the covered work, and you disclaim any intention to limit operation or +modification of the work as a means of enforcing, against the work's +users, your or third parties' legal rights to forbid circumvention of +technological measures. + + 4. Conveying Verbatim Copies. + + You may convey verbatim copies of the Program's source code as you +receive it, in any medium, provided that you conspicuously and +appropriately publish on each copy an appropriate copyright notice; +keep intact all notices stating that this License and any +non-permissive terms added in accord with section 7 apply to the code; +keep intact all notices of the absence of any warranty; and give all +recipients a copy of this License along with the Program. + + You may charge any price or no price for each copy that you convey, +and you may offer support or warranty protection for a fee. + + 5. Conveying Modified Source Versions. + + You may convey a work based on the Program, or the modifications to +produce it from the Program, in the form of source code under the +terms of section 4, provided that you also meet all of these conditions: + + a) The work must carry prominent notices stating that you modified + it, and giving a relevant date. + + b) The work must carry prominent notices stating that it is + released under this License and any conditions added under section + 7. This requirement modifies the requirement in section 4 to + "keep intact all notices". + + c) You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable section 7 + additional terms, to the whole of the work, and all its parts, + regardless of how they are packaged. This License gives no + permission to license the work in any other way, but it does not + invalidate such permission if you have separately received it. + + d) If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has interactive + interfaces that do not display Appropriate Legal Notices, your + work need not make them do so. + + A compilation of a covered work with other separate and independent +works, which are not by their nature extensions of the covered work, +and which are not combined with it such as to form a larger program, +in or on a volume of a storage or distribution medium, is called an +"aggregate" if the compilation and its resulting copyright are not +used to limit the access or legal rights of the compilation's users +beyond what the individual works permit. Inclusion of a covered work +in an aggregate does not cause this License to apply to the other +parts of the aggregate. + + 6. Conveying Non-Source Forms. + + You may convey a covered work in object code form under the terms +of sections 4 and 5, provided that you also convey the +machine-readable Corresponding Source under the terms of this License, +in one of these ways: + + a) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + + b) Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that product + model, to give anyone who possesses the object code either (1) a + copy of the Corresponding Source for all the software in the + product that is covered by this License, on a durable physical + medium customarily used for software interchange, for a price no + more than your reasonable cost of physically performing this + conveying of source, or (2) access to copy the + Corresponding Source from a network server at no charge. + + c) Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, and + only if you received the object code with such an offer, in accord + with subsection 6b. + + d) Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to the + Corresponding Source in the same way through the same place at no + further charge. You need not require recipients to copy the + Corresponding Source along with the object code. If the place to + copy the object code is a network server, the Corresponding Source + may be on a different server (operated by you or a third party) + that supports equivalent copying facilities, provided you maintain + clear directions next to the object code saying where to find the + Corresponding Source. Regardless of what server hosts the + Corresponding Source, you remain obligated to ensure that it is + available for as long as needed to satisfy these requirements. + + e) Convey the object code using peer-to-peer transmission, provided + you inform other peers where the object code and Corresponding + Source of the work are being offered to the general public at no + charge under subsection 6d. + + A separable portion of the object code, whose source code is excluded +from the Corresponding Source as a System Library, need not be +included in conveying the object code work. + + A "User Product" is either (1) a "consumer product", which means any +tangible personal property which is normally used for personal, family, +or household purposes, or (2) anything designed or sold for incorporation +into a dwelling. In determining whether a product is a consumer product, +doubtful cases shall be resolved in favor of coverage. For a particular +product received by a particular user, "normally used" refers to a +typical or common use of that class of product, regardless of the status +of the particular user or of the way in which the particular user +actually uses, or expects or is expected to use, the product. A product +is a consumer product regardless of whether the product has substantial +commercial, industrial or non-consumer uses, unless such uses represent +the only significant mode of use of the product. + + "Installation Information" for a User Product means any methods, +procedures, authorization keys, or other information required to install +and execute modified versions of a covered work in that User Product from +a modified version of its Corresponding Source. The information must +suffice to ensure that the continued functioning of the modified object +code is in no case prevented or interfered with solely because +modification has been made. + + If you convey an object code work under this section in, or with, or +specifically for use in, a User Product, and the conveying occurs as +part of a transaction in which the right of possession and use of the +User Product is transferred to the recipient in perpetuity or for a +fixed term (regardless of how the transaction is characterized), the +Corresponding Source conveyed under this section must be accompanied +by the Installation Information. But this requirement does not apply +if neither you nor any third party retains the ability to install +modified object code on the User Product (for example, the work has +been installed in ROM). + + The requirement to provide Installation Information does not include a +requirement to continue to provide support service, warranty, or updates +for a work that has been modified or installed by the recipient, or for +the User Product in which it has been modified or installed. Access to a +network may be denied when the modification itself materially and +adversely affects the operation of the network or violates the rules and +protocols for communication across the network. + + Corresponding Source conveyed, and Installation Information provided, +in accord with this section must be in a format that is publicly +documented (and with an implementation available to the public in +source code form), and must require no special password or key for +unpacking, reading or copying. + + 7. Additional Terms. + + "Additional permissions" are terms that supplement the terms of this +License by making exceptions from one or more of its conditions. +Additional permissions that are applicable to the entire Program shall +be treated as though they were included in this License, to the extent +that they are valid under applicable law. If additional permissions +apply only to part of the Program, that part may be used separately +under those permissions, but the entire Program remains governed by +this License without regard to the additional permissions. + + When you convey a copy of a covered work, you may at your option +remove any additional permissions from that copy, or from any part of +it. (Additional permissions may be written to require their own +removal in certain cases when you modify the work.) You may place +additional permissions on material, added by you to a covered work, +for which you have or can give appropriate copyright permission. + + Notwithstanding any other provision of this License, for material you +add to a covered work, you may (if authorized by the copyright holders of +that material) supplement the terms of this License with terms: + + a) Disclaiming warranty or limiting liability differently from the + terms of sections 15 and 16 of this License; or + + b) Requiring preservation of specified reasonable legal notices or + author attributions in that material or in the Appropriate Legal + Notices displayed by works containing it; or + + c) Prohibiting misrepresentation of the origin of that material, or + requiring that modified versions of such material be marked in + reasonable ways as different from the original version; or + + d) Limiting the use for publicity purposes of names of licensors or + authors of the material; or + + e) Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + + f) Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified versions of + it) with contractual assumptions of liability to the recipient, for + any liability that these contractual assumptions directly impose on + those licensors and authors. + + All other non-permissive additional terms are considered "further +restrictions" within the meaning of section 10. If the Program as you +received it, or any part of it, contains a notice stating that it is +governed by this License along with a term that is a further +restriction, you may remove that term. If a license document contains +a further restriction but permits relicensing or conveying under this +License, you may add to a covered work material governed by the terms +of that license document, provided that the further restriction does +not survive such relicensing or conveying. + + If you add terms to a covered work in accord with this section, you +must place, in the relevant source files, a statement of the +additional terms that apply to those files, or a notice indicating +where to find the applicable terms. + + Additional terms, permissive or non-permissive, may be stated in the +form of a separately written license, or stated as exceptions; +the above requirements apply either way. + + 8. Termination. + + You may not propagate or modify a covered work except as expressly +provided under this License. Any attempt otherwise to propagate or +modify it is void, and will automatically terminate your rights under +this License (including any patent licenses granted under the third +paragraph of section 11). + + However, if you cease all violation of this License, then your +license from a particular copyright holder is reinstated (a) +provisionally, unless and until the copyright holder explicitly and +finally terminates your license, and (b) permanently, if the copyright +holder fails to notify you of the violation by some reasonable means +prior to 60 days after the cessation. + + Moreover, your license from a particular copyright holder is +reinstated permanently if the copyright holder notifies you of the +violation by some reasonable means, this is the first time you have +received notice of violation of this License (for any work) from that +copyright holder, and you cure the violation prior to 30 days after +your receipt of the notice. + + Termination of your rights under this section does not terminate the +licenses of parties who have received copies or rights from you under +this License. If your rights have been terminated and not permanently +reinstated, you do not qualify to receive new licenses for the same +material under section 10. + + 9. Acceptance Not Required for Having Copies. + + You are not required to accept this License in order to receive or +run a copy of the Program. Ancillary propagation of a covered work +occurring solely as a consequence of using peer-to-peer transmission +to receive a copy likewise does not require acceptance. However, +nothing other than this License grants you permission to propagate or +modify any covered work. These actions infringe copyright if you do +not accept this License. Therefore, by modifying or propagating a +covered work, you indicate your acceptance of this License to do so. + + 10. Automatic Licensing of Downstream Recipients. + + Each time you convey a covered work, the recipient automatically +receives a license from the original licensors, to run, modify and +propagate that work, subject to this License. You are not responsible +for enforcing compliance by third parties with this License. + + An "entity transaction" is a transaction transferring control of an +organization, or substantially all assets of one, or subdividing an +organization, or merging organizations. If propagation of a covered +work results from an entity transaction, each party to that +transaction who receives a copy of the work also receives whatever +licenses to the work the party's predecessor in interest had or could +give under the previous paragraph, plus a right to possession of the +Corresponding Source of the work from the predecessor in interest, if +the predecessor has it or can get it with reasonable efforts. + + You may not impose any further restrictions on the exercise of the +rights granted or affirmed under this License. For example, you may +not impose a license fee, royalty, or other charge for exercise of +rights granted under this License, and you may not initiate litigation +(including a cross-claim or counterclaim in a lawsuit) alleging that +any patent claim is infringed by making, using, selling, offering for +sale, or importing the Program or any portion of it. + + 11. Patents. + + A "contributor" is a copyright holder who authorizes use under this +License of the Program or a work on which the Program is based. The +work thus licensed is called the contributor's "contributor version". + + A contributor's "essential patent claims" are all patent claims +owned or controlled by the contributor, whether already acquired or +hereafter acquired, that would be infringed by some manner, permitted +by this License, of making, using, or selling its contributor version, +but do not include claims that would be infringed only as a +consequence of further modification of the contributor version. For +purposes of this definition, "control" includes the right to grant +patent sublicenses in a manner consistent with the requirements of +this License. + + Each contributor grants you a non-exclusive, worldwide, royalty-free +patent license under the contributor's essential patent claims, to +make, use, sell, offer for sale, import and otherwise run, modify and +propagate the contents of its contributor version. + + In the following three paragraphs, a "patent license" is any express +agreement or commitment, however denominated, not to enforce a patent +(such as an express permission to practice a patent or covenant not to +sue for patent infringement). To "grant" such a patent license to a +party means to make such an agreement or commitment not to enforce a +patent against the party. + + If you convey a covered work, knowingly relying on a patent license, +and the Corresponding Source of the work is not available for anyone +to copy, free of charge and under the terms of this License, through a +publicly available network server or other readily accessible means, +then you must either (1) cause the Corresponding Source to be so +available, or (2) arrange to deprive yourself of the benefit of the +patent license for this particular work, or (3) arrange, in a manner +consistent with the requirements of this License, to extend the patent +license to downstream recipients. "Knowingly relying" means you have +actual knowledge that, but for the patent license, your conveying the +covered work in a country, or your recipient's use of the covered work +in a country, would infringe one or more identifiable patents in that +country that you have reason to believe are valid. + + If, pursuant to or in connection with a single transaction or +arrangement, you convey, or propagate by procuring conveyance of, a +covered work, and grant a patent license to some of the parties +receiving the covered work authorizing them to use, propagate, modify +or convey a specific copy of the covered work, then the patent license +you grant is automatically extended to all recipients of the covered +work and works based on it. + + A patent license is "discriminatory" if it does not include within +the scope of its coverage, prohibits the exercise of, or is +conditioned on the non-exercise of one or more of the rights that are +specifically granted under this License. You may not convey a covered +work if you are a party to an arrangement with a third party that is +in the business of distributing software, under which you make payment +to the third party based on the extent of your activity of conveying +the work, and under which the third party grants, to any of the +parties who would receive the covered work from you, a discriminatory +patent license (a) in connection with copies of the covered work +conveyed by you (or copies made from those copies), or (b) primarily +for and in connection with specific products or compilations that +contain the covered work, unless you entered into that arrangement, +or that patent license was granted, prior to 28 March 2007. + + Nothing in this License shall be construed as excluding or limiting +any implied license or other defenses to infringement that may +otherwise be available to you under applicable patent law. + + 12. No Surrender of Others' Freedom. + + If conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot convey a +covered work so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you may +not convey it at all. For example, if you agree to terms that obligate you +to collect a royalty for further conveying from those to whom you convey +the Program, the only way you could satisfy both those terms and this +License would be to refrain entirely from conveying the Program. + + 13. Use with the GNU Affero General Public License. + + Notwithstanding any other provision of this License, you have +permission to link or combine any covered work with a work licensed +under version 3 of the GNU Affero General Public License into a single +combined work, and to convey the resulting work. The terms of this +License will continue to apply to the part which is the covered work, +but the special requirements of the GNU Affero General Public License, +section 13, concerning interaction through a network will apply to the +combination as such. + + 14. Revised Versions of this License. + + The Free Software Foundation may publish revised and/or new versions of +the GNU General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + + Each version is given a distinguishing version number. If the +Program specifies that a certain numbered version of the GNU General +Public License "or any later version" applies to it, you have the +option of following the terms and conditions either of that numbered +version or of any later version published by the Free Software +Foundation. If the Program does not specify a version number of the +GNU General Public License, you may choose any version ever published +by the Free Software Foundation. + + If the Program specifies that a proxy can decide which future +versions of the GNU General Public License can be used, that proxy's +public statement of acceptance of a version permanently authorizes you +to choose that version for the Program. + + Later license versions may give you additional or different +permissions. However, no additional obligations are imposed on any +author or copyright holder as a result of your choosing to follow a +later version. + + 15. Disclaimer of Warranty. + + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY +APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT +HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY +OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, +THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR +PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM +IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF +ALL NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. Limitation of Liability. + + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS +THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY +GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE +USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF +DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD +PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), +EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF +SUCH DAMAGES. + + 17. Interpretation of Sections 15 and 16. + + If the disclaimer of warranty and limitation of liability provided +above cannot be given local legal effect according to their terms, +reviewing courts shall apply local law that most closely approximates +an absolute waiver of all civil liability in connection with the +Program, unless a warranty or assumption of liability accompanies a +copy of the Program in return for a fee. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . + +Also add information on how to contact you by electronic and paper mail. + + If the program does terminal interaction, make it output a short +notice like this when it starts in an interactive mode: + + Copyright (C) + This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, your program's commands +might be different; for a GUI interface, you would use an "about box". + + You should also get your employer (if you work as a programmer) or school, +if any, to sign a "copyright disclaimer" for the program, if necessary. +For more information on this, and how to apply and follow the GNU GPL, see +. + + The GNU General Public License does not permit incorporating your program +into proprietary programs. If your program is a subroutine library, you +may consider it more useful to permit linking proprietary applications with +the library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. But first, please read +. diff --git a/Setup.hs b/Setup.hs new file mode 100644 index 0000000..9a994af --- /dev/null +++ b/Setup.hs @@ -0,0 +1,2 @@ +import Distribution.Simple +main = defaultMain diff --git a/cbits/tun-linux.c b/cbits/tun-linux.c new file mode 100644 index 0000000..adbd7c2 --- /dev/null +++ b/cbits/tun-linux.c @@ -0,0 +1,40 @@ +#include + +#include +#include +#include +#include +#include + +#include "tun.h" + +int tun_alloc(const char *dev_name, int threads, int *fds) { + struct ifreq ifr; + int fd, i; + + if (!dev_name) + return -1; + + memset(&ifr, 0, sizeof(ifr)); + + ifr.ifr_flags = IFF_TUN | IFF_NO_PI; + if (threads > 1) + ifr.ifr_flags |= IFF_MULTI_QUEUE; + strncpy(ifr.ifr_name, dev_name, IFNAMSIZ); + + for (i = 0; i < threads; i++) { + if ((fd = open("/dev/net/tun", O_RDWR)) < 0) + goto err; + if (ioctl(fd, TUNSETIFF, (void *)&ifr) != 0) { + close(fd); + goto err; + } + fds[i] = fd; + } + + return threads; +err: + for (--i; i >= 0; i--) + close(fds[i]); + return -1; +} diff --git a/cbits/tun-macos.c b/cbits/tun-macos.c new file mode 100644 index 0000000..7d57350 --- /dev/null +++ b/cbits/tun-macos.c @@ -0,0 +1,115 @@ +/** + Copyright (C) 2015 clowwindy + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +// Extracted from ShadowVPN project, with some minor modifications. + +#include +#include +#include + +#include +#include +#include +#include +#include +#include +#include + +#include "tun.h" + +int tun_alloc(const char *dev_name, int threads, int *fds) { + struct ctl_info ctlInfo; + struct sockaddr_ctl sc; + int fd, utun_num; + + if (!dev_name || sscanf(dev_name, "utun%d", &utun_num) != 1) + return -1; + + memset(&ctlInfo, 0, sizeof(ctlInfo)); + + if (strlcpy(ctlInfo.ctl_name, + UTUN_CONTROL_NAME, + sizeof(ctlInfo.ctl_name)) >= sizeof(ctlInfo.ctl_name)) { + return -1; + } + + fd = socket(PF_SYSTEM, SOCK_DGRAM, SYSPROTO_CONTROL); + + if (fd < 0) + return -1; + + if (ioctl(fd, CTLIOCGINFO, &ctlInfo) < 0) { + close(fd); + return -1; + } + + sc.sc_id = ctlInfo.ctl_id; + sc.sc_len = sizeof(sc); + sc.sc_family = AF_SYSTEM; + sc.ss_sysaddr = AF_SYS_CONTROL; + + sc.sc_unit = utun_num + 1; + + if (connect(fd, (struct sockaddr*)&sc, sizeof(sc)) < 0) { + close(fd); + return -1; + } + + *fds = fd; + + return 1; +} + +inline int utun_modified_len(int len) { + if (len > 0) + return (len > sizeof(u_int32_t)) ? len - sizeof(u_int32_t) : 0; + else + return len; +} + +int utun_read(int fd, void *buf, size_t len) { + u_int32_t type; + struct iovec iv[2]; + + iv[0].iov_base = &type; + iv[0].iov_len = sizeof(type); + iv[1].iov_base = buf; + iv[1].iov_len = len; + + return utun_modified_len(readv(fd, iv, 2)); +} + +int utun_write(int fd, void *buf, size_t len) { + u_int32_t type; + struct iovec iv[2]; + struct ip *iph; + + iph = (struct ip *) buf; + + if (iph->ip_v == 6) + type = htonl(AF_INET6); + else + type = htonl(AF_INET); + + iv[0].iov_base = &type; + iv[0].iov_len = sizeof(type); + iv[1].iov_base = buf; + iv[1].iov_len = len; + + return utun_modified_len(writev(fd, iv, 2)); +} + diff --git a/cbits/tun.h b/cbits/tun.h new file mode 100644 index 0000000..e0256cc --- /dev/null +++ b/cbits/tun.h @@ -0,0 +1,11 @@ +#ifndef _WG_TUN_ +#define _WG_TUN_ + +#include + +int tun_alloc(const char *dev_name, int threads, int *fds); + +int utun_read(int fd, void *buf, size_t len); +int utun_write(int fd, void *buf, size_t len); + +#endif // _WG_TUN_ diff --git a/include/uapi.h b/include/uapi.h new file mode 100644 index 0000000..9cf9b2c --- /dev/null +++ b/include/uapi.h @@ -0,0 +1,159 @@ +/* Copyright (C) 2015-2017 Jason A. Donenfeld . All Rights Reserved. + * + * Userspace API for WireGuard + * --------------------------- + * + * ioctl(WG_GET_DEVICE, { .ifr_name: "wg0", .ifr_data: NULL }): + * + * Returns the number of bytes required to hold the peers of a device (`ret_peers_size`). + * + * ioctl(WG_GET_DEVICE, { .ifr_name: "wg0", .ifr_data: user_pointer }): + * + * Retrevies device info, peer info, and ipmask info. + * + * `user_pointer` must point to a region of memory of size `sizeof(struct wgdevice) + ret_peers_size` + * and containing the structure `struct wgdevice { .peers_size: ret_peers_size }`. + * + * Writes to `user_pointer` a succession of structs: + * + * struct wgdevice { .num_peers = 3 } + * struct wgpeer { .num_ipmasks = 4 } + * struct wgipmask + * struct wgipmask + * struct wgipmask + * struct wgipmask + * struct wgpeer { .num_ipmasks = 2 } + * struct wgipmask + * struct wgipmask + * struct wgpeer { .num_ipmasks = 0 } + * + * Returns 0 on success. Returns -EMSGSIZE if there is too much data for the size of passed-in + * memory, in which case, this should be recalculated using the call above. Returns -errno if + * another error occured. + * + * ioctl(WG_SET_DEVICE, { .ifr_name: "wg0", .ifr_data: user_pointer }): + * + * Sets device info, peer info, and ipmask info. + * + * `user_pointer` must point to a region of memory containing a succession of structs: + * + * struct wgdevice { .num_peers = 3 } + * struct wgpeer { .num_ipmasks = 4 } + * struct wgipmask + * struct wgipmask + * struct wgipmask + * struct wgipmask + * struct wgpeer { .num_ipmasks = 2 } + * struct wgipmask + * struct wgipmask + * struct wgpeer { .num_ipmasks = 0 } + * + * If `wgdevice->flags & WGDEVICE_REPLACE_PEERS` is true, removes all peers of device before adding new ones. + * If `wgpeer->flags & WGPEER_REMOVE_ME` is true, the peer identified by `wgpeer->public_key` is removed. + * If `wgpeer->flags & WGPEER_REPLACE_IPMASKS` is true, removes all ipmasks before adding new ones. + * If `wgdevice->private_key` is filled with zeros, no action is taken on the private key. + * If `wgdevice->preshared_key` is filled with zeros, no action is taken on the pre-shared key. + * If `wgdevice->flags & WGDEVICE_REMOVE_PRIVATE_KEY` is true, the private key is removed. + * If `wgdevice->flags & WGDEVICE_REMOVE_PRESHARED_KEY` is true, the pre-shared key is removed. + * + * Returns 0 on success, or -errno if an error occurred. + */ + + +#ifndef WGUAPI_H +#define WGUAPI_H + +#ifdef __linux__ +#include +#else +#include +typedef uint8_t __u8; +typedef uint16_t __u16; +typedef uint32_t __u32; +typedef uint64_t __u64; +typedef int32_t __s32; +#endif +#ifdef __KERNEL__ +#include +#include +#else +#include +#include +#include +#include +#endif + +#define WG_GET_DEVICE (SIOCDEVPRIVATE + 0) +#define WG_SET_DEVICE (SIOCDEVPRIVATE + 1) + +#define WG_KEY_LEN 32 + +struct wgipmask { + __s32 family; + union { + struct in_addr ip4; + struct in6_addr ip6; + }; + __u8 cidr; +}; + +enum { + WGPEER_REMOVE_ME = (1 << 0), + WGPEER_REPLACE_IPMASKS = (1 << 1) +}; +struct wgpeer { + __u8 public_key[WG_KEY_LEN]; /* Get/Set */ + __u32 flags; /* Set */ + + union { + struct sockaddr addr; + struct sockaddr_in addr4; + struct sockaddr_in6 addr6; + } endpoint; /* Get/Set */ + + struct timeval last_handshake_time; /* Get */ + __u64 rx_bytes, tx_bytes; /* Get */ + __u16 persistent_keepalive_interval; /* Get/Set -- 0 = off, 0xffff = unset */ + + __u16 num_ipmasks; /* Get/Set */ +}; + +enum { + WGDEVICE_REPLACE_PEERS = (1 << 0), + WGDEVICE_REMOVE_PRIVATE_KEY = (1 << 1), + WGDEVICE_REMOVE_PRESHARED_KEY = (1 << 2), + WGDEVICE_REMOVE_FWMARK = (1 << 3) +}; +struct wgdevice { + char interface[IFNAMSIZ]; /* Get */ + __u32 flags; /* Set */ + + __u8 public_key[WG_KEY_LEN]; /* Get */ + __u8 private_key[WG_KEY_LEN]; /* Get/Set */ + __u8 preshared_key[WG_KEY_LEN]; /* Get/Set */ + __u32 fwmark; /* Get/Set */ + __u16 port; /* Get/Set */ + + union { + __u16 num_peers; /* Get/Set */ + __u32 peers_size; /* Get */ + }; +}; + +/* These are simply for convenience in iterating. It allows you to write something like: + * + * for_each_wgpeer(device, peer, i) { + * for_each_wgipmask(peer, ipmask, j) { + * do_something_with_ipmask(ipmask); + * } + * } + */ +#define for_each_wgpeer(__dev, __peer, __i) for ((__i) = 0, (__peer) = (struct wgpeer *)((uint8_t *)(__dev) + sizeof(struct wgdevice)); \ + (__i) < (__dev)->num_peers; \ + ++(__i), (__peer) = (struct wgpeer *)((uint8_t *)(__peer) + sizeof(struct wgpeer) + (sizeof(struct wgipmask) * (__peer)->num_ipmasks))) + +#define for_each_wgipmask(__peer, __ipmask, __i) for ((__i) = 0, (__ipmask) = (struct wgipmask *)((uint8_t *)(__peer) + sizeof(struct wgpeer)); \ + (__i) < (__peer)->num_ipmasks; \ + ++(__i), (__ipmask) = (struct wgipmask *)((uint8_t *)(__ipmask) + sizeof(struct wgipmask))) + +#endif diff --git a/nara.cabal b/nara.cabal new file mode 100644 index 0000000..fd1cc0e --- /dev/null +++ b/nara.cabal @@ -0,0 +1,82 @@ +name: nara +version: 0.0.0.0 +synopsis: A userspace WireGuard implementation in Haskell +license: GPL-3 +license-file: LICENSE +author: Bin Jin +maintainer: bjin@ctrl-d.org +category: Network +build-type: Simple +extra-source-files: include/uapi.h, cbits/tun.h +cabal-version: >=1.10 +description: + This is a userspace implementation of , + which is a layer-3 VPN utilizing TUN device and + protocol. + + The configuration tool "wg" from original project is also required, check + manpage of "wg" for details. + +executable nara + main-is: + Main.hs + other-modules: + Network.WireGuard.Core, + Network.WireGuard.Daemon, + Network.WireGuard.Foreign.In6Addr, + Network.WireGuard.Foreign.Key, + Network.WireGuard.Foreign.Tun, + Network.WireGuard.Foreign.UAPI, + Network.WireGuard.Internal.Constant, + Network.WireGuard.Internal.IPPacket, + Network.WireGuard.Internal.Noise, + Network.WireGuard.Internal.Packet, + Network.WireGuard.Internal.PacketQueue, + Network.WireGuard.Internal.State, + Network.WireGuard.Internal.Types, + Network.WireGuard.Internal.Util, + Network.WireGuard.RPC, + Network.WireGuard.TunListener, + Network.WireGuard.UdpListener + build-depends: + async, + base == 4.9.*, + blake2, + bytestring, + cacophony >=0.9.2 && <0.10, + cereal, + conduit, + conduit-extra, + cryptonite, + directory, + exceptions, + filepath, + iproute == 1.7.*, + lens, + memory == 0.14.*, + network == 2.6.*, + optparse-applicative, + random, + stm, + streaming-commons, + transformers, + unix == 2.7.*, + unordered-containers + + if os(linux) + c-sources: cbits/tun-linux.c + cpp-options: -DOS_LINUX + if os(darwin) + c-sources: cbits/tun-macos.c + cpp-options: -DOS_MACOS + if !os(linux) && !os(darwin) + buildable: False + + ghc-options: + -Wall -O2 -threaded -rtsopts "-with-rtsopts=-N -c" + hs-source-dirs: + src + include-dirs: + include + default-language: + Haskell2010 diff --git a/src/Main.hs b/src/Main.hs new file mode 100644 index 0000000..29a2c30 --- /dev/null +++ b/src/Main.hs @@ -0,0 +1,81 @@ +{-# LANGUAGE RecordWildCards #-} + +module Main where + +import Control.Concurrent (getNumCapabilities) +import Control.Monad (void) +import Data.Monoid ((<>)) +import System.Directory (createDirectoryIfMissing, + doesDirectoryExist) +import System.Exit (die) +import System.FilePath.Posix (takeDirectory, ()) +import System.Info (os) +import System.Posix.IO (OpenMode (..), closeFd, + defaultFileFlags, dupTo, + openFd, stdError, stdInput, + stdOutput) +import System.Posix.Process (forkProcess) +import System.Posix.Types (Fd) + +import Options.Applicative + +import Network.WireGuard.Daemon (runDaemon) +import Network.WireGuard.Foreign.Tun (openTun) +import Network.WireGuard.Internal.Util (catchIOExceptionAnd) + +data Opts = Opts + { foreground :: Bool + , intfName :: String + } + +parser :: ParserInfo Opts +parser = info (helper <*> opts) fullDesc + where + opts = Opts <$> _foreground + <*> _intfName + + _foreground = switch + ( long "foreground" + <> short 'f' + <> help "run in the foreground") + + _intfName = argument str + ( metavar "interface" + <> help ("device interface name (e.g. " ++ intfNameExample ++ ")")) + + intfNameExample | os == "darwin" = "utun1" + | otherwise = "wg0" + + +main :: IO () +main = do + Opts{..} <- execParser parser + + runPath <- maybe (die "failed to find path to bind socket") return =<< findVarRun + let sockPath = runPath "wireguard" (intfName ++ ".sock") + createDirectoryIfMissing False (takeDirectory sockPath) + + fds <- maybe (die "failed to open device") return =<< openTun intfName =<< getNumCapabilities + + let runner daemon | foreground = daemon + | otherwise = void $ forkProcess $ do + mapM_ redirectToNull [stdInput, stdOutput, stdError] + daemon + + runner $ runDaemon intfName sockPath fds + +redirectToNull :: Fd -> IO () +redirectToNull fd = catchIOExceptionAnd (return ()) $ do + nullFd <- openFd "/dev/null" ReadWrite Nothing defaultFileFlags + closeFd fd + void $ dupTo nullFd fd + +findVarRun :: IO (Maybe FilePath) +findVarRun = loop ["/var/run", "/run"] + where + loop [] = return Nothing + loop (d:ds) = do + exists <- doesDirectoryExist d + if exists + then return (Just d) + else loop ds diff --git a/src/Network/WireGuard/Core.hs b/src/Network/WireGuard/Core.hs new file mode 100644 index 0000000..f36b3c9 --- /dev/null +++ b/src/Network/WireGuard/Core.hs @@ -0,0 +1,336 @@ +{-# LANGUAGE RecordWildCards #-} + +module Network.WireGuard.Core + ( runCore + ) where + +import Control.Concurrent (getNumCapabilities, + threadDelay) +import Control.Concurrent.Async (wait, withAsync) +import Control.Monad (forM_, forever, unless, + void, when) +import Control.Monad.IO.Class (liftIO) +import Control.Monad.STM (atomically) +import Control.Monad.Trans.Except (ExceptT, runExceptT, + throwE) +import Crypto.Noise (HandshakeRole (..)) +import Crypto.Noise.DH (dhGenKey, dhPubEq, + dhPubToBytes) +import qualified Data.ByteArray as BA +import qualified Data.ByteString as BS +import qualified Data.HashMap.Strict as HM +import Data.IP (makeAddrRange) +import qualified Data.IP.RouteTable as RT +import Data.Maybe (fromMaybe, isJust, + isNothing) +import Data.Serialize (putWord32be, + putWord64be, runGet, + runPut) +import Foreign.C.Types (CTime (..)) +import Network.Socket (SockAddr) +import System.IO (hPutStrLn, stderr) +import System.Posix.Time (epochTime) +import System.Random (randomIO) + +import Control.Concurrent.STM.TVar +import Crypto.Hash.BLAKE2.BLAKE2s + +import Network.WireGuard.Internal.Constant +import Network.WireGuard.Internal.IPPacket +import Network.WireGuard.Internal.Noise +import Network.WireGuard.Internal.Packet +import Network.WireGuard.Internal.PacketQueue +import Network.WireGuard.Internal.State +import Network.WireGuard.Internal.Types +import Network.WireGuard.Internal.Util + +runCore :: Device + -> PacketQueue TunPacket -> PacketQueue TunPacket + -> PacketQueue UdpPacket -> PacketQueue UdpPacket + -> IO () +runCore device readTunChan writeTunChan readUdpChan writeUdpChan = do + threads <- getNumCapabilities + loop threads [] + where + heartbeatLoop = forever $ ignoreSyncExceptions $ do + withJust (readTVarIO (localKey device)) $ \key -> + runHeartbeat device key writeUdpChan + -- TODO: use accurate timer + threadDelay heartbeatWaitTime + + loop 0 asyncs = + withAsync heartbeatLoop $ \ht -> + mapM_ wait asyncs >> wait ht + loop x asyncs = + withAsync (retryWithBackoff $ handleReadTun device readTunChan writeUdpChan) $ \rt -> + withAsync (retryWithBackoff $ handleReadUdp device readUdpChan writeTunChan writeUdpChan) $ \ru -> + loop (x-1) (rt:ru:asyncs) + +handleReadTun :: Device -> PacketQueue TunPacket -> PacketQueue UdpPacket -> IO () +handleReadTun device readTunChan writeUdpChan = forever $ do + tunPacket <- atomically $ popPacketQueue readTunChan + res <- runExceptT $ processTunPacket device writeUdpChan tunPacket + case res of + Right udpPacket -> atomically $ pushPacketQueue writeUdpChan udpPacket + Left err -> hPutStrLn stderr (show err) -- TODO: proper logging + +handleReadUdp :: Device -> PacketQueue UdpPacket -> PacketQueue TunPacket + -> PacketQueue UdpPacket + -> IO () +handleReadUdp device readUdpChan writeTunChan writeUdpChan = forever $ do + udpPacket <- atomically $ popPacketQueue readUdpChan + res <- runExceptT $ processUdpPacket device udpPacket + case res of + Left err -> hPutStrLn stderr (show err) -- TODO: proper logging + Right mpacket -> case mpacket of + Just (Right tunp) -> atomically $ pushPacketQueue writeTunChan tunp + Just (Left udpp) -> atomically $ pushPacketQueue writeUdpChan udpp + Nothing -> return () + +processTunPacket :: Device -> PacketQueue UdpPacket -> TunPacket + -> ExceptT WireGuardError IO UdpPacket +processTunPacket device@Device{..} writeUdpChan packet = do + key <- assertJust DeviceNotReadyError $ liftIO (readTVarIO localKey) + psk <- liftIO (readTVarIO presharedKey) + parsedPacket <- liftIO $ parseIPPacket packet + peer <- assertJust DestinationNotReachableError $ case parsedPacket of + InvalidIPPacket -> throwE InvalidIPPacketError + IPv4Packet _ dest4 -> RT.lookup (makeAddrRange dest4 32) + <$> liftIO (readTVarIO routeTable4) + IPv6Packet _ dest6 -> RT.lookup (makeAddrRange dest6 128) + <$> liftIO (readTVarIO routeTable6) + msession <- liftIO (getSession peer) + session <- case msession of + Just session -> return session + Nothing -> do + now0 <- liftIO epochTime + endp0 <- assertJust EndPointUnknownError $ liftIO $ readTVarIO (endPoint peer) + liftIO $ void $ checkAndTryInitiateHandshake device key psk writeUdpChan peer endp0 now0 + liftIO $ atomically $ waitForSession peer + nonce <- liftIO $ atomically $ nextNonce session + let (msg, authtag) = encryptMessage (sessionKey session) nonce packet + encrypted = runPut $ buildPacket (error "internal error") $ + PacketData (theirIndex session) nonce msg authtag + now <- liftIO epochTime + endp <- assertJust EndPointUnknownError $ liftIO $ readTVarIO (endPoint peer) + when (now >= renewTime session) $ liftIO $ + void $ checkAndTryInitiateHandshake device key psk writeUdpChan peer endp now + liftIO $ atomically $ modifyTVar' (transferredBytes peer) (+fromIntegral (BA.length packet)) + liftIO $ atomically $ writeTVar (lastTransferTime peer) now + return (encrypted, endp) + +processUdpPacket :: Device -> UdpPacket + -> ExceptT WireGuardError IO (Maybe (Either UdpPacket TunPacket)) +processUdpPacket device@Device{..} (packet, sock) = do + key <- assertJust DeviceNotReadyError $ liftIO (readTVarIO localKey) + psk <- liftIO (readTVarIO presharedKey) + let mp = runGet (parsePacket (getMac1 (snd key) psk)) packet + case mp of + Left errMsg -> throwE (InvalidWGPacketError errMsg) + Right parsedPacket -> processPacket device key psk sock parsedPacket + +processPacket :: Device -> KeyPair -> Maybe PresharedKey -> SockAddr -> Packet + -> ExceptT WireGuardError IO (Maybe (Either UdpPacket TunPacket)) +processPacket device@Device{..} key psk sock HandshakeInitiation{..} = do + ekey <- liftIO dhGenKey + let state0 = newNoiseState key psk ekey Nothing ResponderRole + outcome = recvFirstMessageAndReply state0 encryptedPayload mempty + case outcome of + Left err -> throwE (NoiseError err) + Right (reply, decryptedPayload, rpub, sks) -> do + when (BA.length decryptedPayload /= timestampLength) $ + throwE $ InvalidWGPacketError "timestamp expected" + peer <- assertJust RemotePeerNotFoundError $ + HM.lookup (getPeerId rpub) <$> liftIO (readTVarIO peers) + notReplayAttack <- liftIO $ atomically $ updateTai64n peer (BA.convert decryptedPayload) + unless notReplayAttack $ throwE HandshakeInitiationReplayError + now <- liftIO epochTime + seed <- liftIO randomIO + ourindex <- liftIO $ atomically $ do + ourindex <- acquireEmptyIndex device peer seed + void $ eraseResponderWait device peer Nothing + let rwait = ResponderWait ourindex senderIndex + (addTime now handshakeStopTime) sks + writeTVar (responderWait peer) (Just rwait) + return ourindex + let responsePacket = runPut $ buildPacket (getMac1 rpub psk) $ + HandshakeResponse ourindex senderIndex reply + return (Just (Left (responsePacket, sock))) + +processPacket device@Device{..} _key _psk sock HandshakeResponse{..} = do + peer <- assertJust UnknownIndexError $ + HM.lookup receiverIndex <$> liftIO (readTVarIO indexMap) + iwait <- assertJust OutdatedPacketError $ liftIO (readTVarIO (initiatorWait peer)) + when (initOurIndex iwait /= receiverIndex) $ throwE OutdatedPacketError + let state1 = initNoise iwait + outcome = recvSecondMessage state1 encryptedPayload + case outcome of + Left err -> throwE (NoiseError err) + Right (decryptedPayload, rpub, sks) -> do + now <- liftIO epochTime + newCounter <- liftIO $ atomically $ newTVar 0 + let newsession = Session receiverIndex senderIndex sks + (addTime now sessionRenewTime) + (addTime now sessionExpireTime) + newCounter + when (BA.length decryptedPayload /= 0) $ + throwE $ InvalidWGPacketError "empty payload expected" + unless (rpub `dhPubEq` remotePub peer) $ throwE RemotePeerNotFoundError + succeeded <- liftIO $ atomically $ do + erased <- eraseInitiatorWait device peer (Just receiverIndex) + when erased $ do + addSession device peer newsession + writeTVar (lastHandshakeTime peer) (Just now) + return erased + unless succeeded $ throwE OutdatedPacketError + liftIO $ atomically $ updateEndPoint peer sock + return Nothing + +processPacket device@Device{..} _key _psk sock PacketData{..} = do + peer <- assertJust UnknownIndexError $ + HM.lookup receiverIndex <$> liftIO (readTVarIO indexMap) + outcome <- liftIO $ atomically $ findSession peer receiverIndex + now <- liftIO epochTime + (isFromResponderWait, session) <- case outcome of + Nothing -> throwE OutdatedPacketError + Just (Right session) -> return (False, session) + Just (Left ResponderWait{..}) -> do + newCounter <- liftIO $ atomically $ newTVar 0 + let newsession = Session respOurIndex respTheirIndex respSessionKey + (addTime now (sessionRenewTime + 2 * handshakeRetryTime)) + (addTime now sessionExpireTime) + newCounter + return (True, newsession) + case decryptMessage (sessionKey session) counter (encryptedPayload, authTag) of + Nothing -> throwE DecryptFailureError + Just decryptedPayload -> do + when isFromResponderWait $ liftIO $ atomically $ do + erased <- eraseResponderWait device peer (Just receiverIndex) + when erased $ do + addSession device peer session + writeTVar (lastHandshakeTime peer) (Just now) + liftIO $ atomically $ updateEndPoint peer sock + if BA.length decryptedPayload /= 0 + then do + parsedPacket <- liftIO $ parseIPPacket decryptedPayload + case parsedPacket of + InvalidIPPacket -> throwE InvalidIPPacketError + IPv4Packet src4 _ -> do + peer' <- assertJust SourceAddrBlockedError $ + RT.lookup (makeAddrRange src4 32) <$> liftIO (readTVarIO routeTable4) + when (remotePub peer /= remotePub peer') $ throwE SourceAddrBlockedError + IPv6Packet src6 _ -> do + peer' <- assertJust SourceAddrBlockedError $ + RT.lookup (makeAddrRange src6 128) <$> liftIO (readTVarIO routeTable6) + when (remotePub peer /= remotePub peer') $ throwE SourceAddrBlockedError + liftIO $ atomically $ writeTVar (lastReceiveTime peer) now + liftIO $ atomically $ modifyTVar' (receivedBytes peer) (+fromIntegral (BA.length decryptedPayload)) + else do + liftIO $ atomically $ writeTVar (lastKeepaliveTime peer) now + return (Just (Right decryptedPayload)) + +runHeartbeat :: Device -> KeyPair -> PacketQueue UdpPacket -> IO () +runHeartbeat device key chan = do + psk <- readTVarIO (presharedKey device) + now <- epochTime + peers' <- readTVarIO (peers device) + forM_ peers' $ \peer -> do + reinitiate <- atomically $ do + miwait <- readTVar (initiatorWait peer) + case miwait of + Just iwait | now >= initStopTime iwait -> do + void $ eraseInitiatorWait device peer Nothing + return Nothing + Just iwait | now >= initRetryTime iwait -> do + void $ eraseInitiatorWait device peer Nothing + return (Just (initStopTime iwait)) + _ -> return Nothing + when (isJust reinitiate) $ withJust (readTVarIO (endPoint peer)) $ \endp -> + void $ tryInitiateHandshakeIfEmpty device key psk chan peer endp reinitiate + atomically $ withJust (readTVar (responderWait peer)) $ \rwait -> + when (now >= respStopTime rwait) $ void $ eraseResponderWait device peer Nothing + atomically $ filterSessions device peer ((now<).expireTime) + lastrecv <- readTVarIO (lastReceiveTime peer) + lastsent <- readTVarIO (lastTransferTime peer) + lastkeep <- readTVarIO (lastKeepaliveTime peer) + when (lastsent < lastrecv && lastrecv <= addTime now (-sessionKeepaliveTime)) $ do + atomically $ writeTVar (lastTransferTime peer) now + atomically $ writeTVar (lastReceiveTime peer) now + withJust (readTVarIO (endPoint peer)) $ \endp -> + withJust (getSession peer) $ \session -> do + nonce <- atomically $ nextNonce session + let (msg, authtag) = encryptMessage (sessionKey session) nonce mempty + keepalivePacket = runPut $ buildPacket (error "internal error") $ + PacketData (theirIndex session) nonce msg authtag + atomically $ pushPacketQueue chan (keepalivePacket, endp) + when (lastrecv < lastsent && lastkeep < lastsent && lastsent <= addTime now (-(sessionKeepaliveTime + handshakeRetryTime))) $ do + atomically $ writeTVar (lastTransferTime peer) now + atomically $ writeTVar (lastReceiveTime peer) now + withJust (readTVarIO (endPoint peer)) $ \endp -> + void $ checkAndTryInitiateHandshake device key psk chan peer endp now + +checkAndTryInitiateHandshake :: Device -> KeyPair -> Maybe PresharedKey + -> PacketQueue UdpPacket -> Peer -> SockAddr -> Time + -> IO Bool +checkAndTryInitiateHandshake device key psk chan peer@Peer{..} endp now = do + initiated <- readAndVerifyStopTime initStopTime initiatorWait (eraseInitiatorWait device peer Nothing) + responded <- readAndVerifyStopTime respStopTime responderWait (eraseResponderWait device peer Nothing) + if initiated || responded + then return False + else tryInitiateHandshakeIfEmpty device key psk chan peer endp Nothing + where + readAndVerifyStopTime getStopTime tvar erase = atomically $ do + ma <- readTVar tvar + case ma of + Just a | now > getStopTime a -> erase >> return False + Just _ -> return True + Nothing -> return False + + +tryInitiateHandshakeIfEmpty :: Device -> KeyPair -> Maybe PresharedKey + -> PacketQueue UdpPacket -> Peer -> SockAddr -> Maybe Time + -> IO Bool +tryInitiateHandshakeIfEmpty device key psk chan peer@Peer{..} endp stopTime = do + ekey <- dhGenKey + now <- epochTime + seed <- randomIO + let state0 = newNoiseState key psk ekey (Just remotePub) InitiatorRole + Right (payload, state1) = sendFirstMessage state0 timestamp + timestamp = BA.convert (genTai64n now) + atomically $ do + isEmpty <- isNothing <$> readTVar initiatorWait + if isEmpty + then do + index <- acquireEmptyIndex device peer seed + let iwait = InitiatorWait index + (addTime now handshakeRetryTime) + (fromMaybe (addTime now handshakeStopTime) stopTime) + state1 + writeTVar initiatorWait (Just iwait) + let packet = runPut $ buildPacket (getMac1 remotePub psk) $ + HandshakeInitiation index payload + void $ tryPushPacketQueue chan $ (packet, endp) + return True + else return False + +genTai64n :: Time -> TAI64n +genTai64n (CTime now) = runPut $ do + putWord64be (fromIntegral now + 4611686018427387914) + putWord32be 0 + +addTime :: Time -> Int -> Time +addTime (CTime now) secs = CTime (now + fromIntegral secs) + +getMac1 :: PublicKey -> Maybe PresharedKey -> BS.ByteString -> BS.ByteString +getMac1 pub mpsk payload = + finalize mac1Length $ update payload $ update (BA.convert (dhPubToBytes pub)) $ + case mpsk of + Nothing -> initialize mac1Length + Just psk -> initialize' mac1Length (BA.convert psk) + +assertJust :: Monad m => e -> ExceptT e m (Maybe a) -> ExceptT e m a +assertJust err ma = do + res <- ma + case res of + Just a -> return a + Nothing -> throwE err diff --git a/src/Network/WireGuard/Daemon.hs b/src/Network/WireGuard/Daemon.hs new file mode 100644 index 0000000..5b3f225 --- /dev/null +++ b/src/Network/WireGuard/Daemon.hs @@ -0,0 +1,55 @@ +module Network.WireGuard.Daemon + ( runDaemon + ) where + +import Control.Concurrent.Async (async, cancel) +import Control.Concurrent.STM (atomically) +import Control.Monad (void) +import GHC.Conc.IO (closeFdWith) +import System.Directory (removeFile) +import System.Posix.IO (closeFd) +import System.Posix.Types (Fd) + +import Control.Concurrent.MVar +import System.Posix.Signals + +import Network.WireGuard.Core (runCore) +import Network.WireGuard.Internal.State (createDevice) +import Network.WireGuard.RPC (runRPC) +import Network.WireGuard.TunListener (runTunListener) +import Network.WireGuard.UdpListener (runUdpListener) + +import Network.WireGuard.Internal.Constant +import Network.WireGuard.Internal.PacketQueue +import Network.WireGuard.Internal.Util + +runDaemon :: String -> FilePath -> [Fd] -> IO () +runDaemon intfName sockPath tunFds = do + device <- atomically $ createDevice intfName + + rpcThread <- async $ runRPC sockPath device + + readTunChan <- atomically $ newPacketQueue maxQueuedTunPackets + writeTunChan <- atomically $ newPacketQueue maxQueuedTunPackets + tunListenerThread <- async $ runTunListener tunFds readTunChan writeTunChan + + -- TODO: Support per-host packet queue + -- TODO: Add timestamp and discard really ancient UDP packets + readUdpChan <- atomically $ newPacketQueue maxQueuedUdpPackets + writeUdpChan <- atomically $ newPacketQueue maxQueuedUdpPackets + udpListenerThread <- async $ runUdpListener device readUdpChan writeUdpChan + + coreThread <- async $ runCore device readTunChan writeTunChan readUdpChan writeUdpChan + + died <- newEmptyMVar + + let dieGracefully = do + mapM_ cancel [rpcThread, tunListenerThread, udpListenerThread, coreThread] + mapM_ (closeFdWith closeFd) tunFds + catchIOExceptionAnd (return ()) (removeFile sockPath) + putMVar died () + + void $ installHandler sigTERM (Catch dieGracefully) Nothing + void $ installHandler sigINT (Catch dieGracefully) Nothing + + takeMVar died diff --git a/src/Network/WireGuard/Foreign/In6Addr.hsc b/src/Network/WireGuard/Foreign/In6Addr.hsc new file mode 100644 index 0000000..ef2cb32 --- /dev/null +++ b/src/Network/WireGuard/Foreign/In6Addr.hsc @@ -0,0 +1,90 @@ +-- +-- Copyright (c) 2002-2010, The University Court of the University of Glasgow. +-- Copyright (c) 2007-2010, Johan Tibell +-- +-- Redistribution and use in source and binary forms, with or without +-- modification, are permitted provided that the following conditions are met: +-- +-- - Redistributions of source code must retain the above copyright notice, +-- this list of conditions and the following disclaimer. +-- +-- - Redistributions in binary form must reproduce the above copyright notice, +-- this list of conditions and the following disclaimer in the documentation +-- and/or other materials provided with the distribution. +-- +-- - Neither name of the University nor the names of its contributors may be +-- used to endorse or promote products derived from this software without +-- specific prior written permission. +-- +-- THIS SOFTWARE IS PROVIDED BY THE UNIVERSITY COURT OF THE UNIVERSITY OF +-- GLASGOW AND THE CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, +-- INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +-- FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE +-- UNIVERSITY COURT OF THE UNIVERSITY OF GLASGOW OR THE CONTRIBUTORS BE LIABLE +-- FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +-- DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +-- SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER +-- CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +-- LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +-- OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH +-- DAMAGE. +-- + +module Network.WireGuard.Foreign.In6Addr + ( In6Addr(..) + ) where + +import Foreign +import Network.Socket.Internal + +#include "uapi.h" + +-- Extracted from network:Network/Socket/Types.hsc, with some modification. + +-- The peek32 and poke32 functions work around the fact that the RFCs +-- don't require 32-bit-wide address fields to be present. We can +-- only portably rely on an 8-bit field, s6_addr. + +s6_addr_offset :: Int +s6_addr_offset = (#offset struct in6_addr, s6_addr) + +peek32 :: Ptr a -> Int -> IO Word32 +peek32 p i0 = do + let i' = i0 * 4 + peekByte n = peekByteOff p (s6_addr_offset + i' + n) :: IO Word8 + a `sl` i = fromIntegral a `shiftL` i + a0 <- peekByte 0 + a1 <- peekByte 1 + a2 <- peekByte 2 + a3 <- peekByte 3 + return ((a0 `sl` 24) .|. (a1 `sl` 16) .|. (a2 `sl` 8) .|. (a3 `sl` 0)) + +poke32 :: Ptr a -> Int -> Word32 -> IO () +poke32 p i0 a = do + let i' = i0 * 4 + pokeByte n = pokeByteOff p (s6_addr_offset + i' + n) + x `sr` i = fromIntegral (x `shiftR` i) :: Word8 + pokeByte 0 (a `sr` 24) + pokeByte 1 (a `sr` 16) + pokeByte 2 (a `sr` 8) + pokeByte 3 (a `sr` 0) + +-- | Private newtype proxy for the Storable instance. To avoid orphan instances. +newtype In6Addr = In6Addr { fromIn6Addr :: HostAddress6 } + +instance Storable In6Addr where + sizeOf _ = #const sizeof(struct in6_addr) + alignment _ = #alignment struct in6_addr + + peek p = do + a <- peek32 p 0 + b <- peek32 p 1 + c <- peek32 p 2 + d <- peek32 p 3 + return $ In6Addr (a, b, c, d) + + poke p (In6Addr (a, b, c, d)) = do + poke32 p 0 a + poke32 p 1 b + poke32 p 2 c + poke32 p 3 d diff --git a/src/Network/WireGuard/Foreign/Key.hs b/src/Network/WireGuard/Foreign/Key.hs new file mode 100644 index 0000000..2a0e7b8 --- /dev/null +++ b/src/Network/WireGuard/Foreign/Key.hs @@ -0,0 +1,29 @@ +module Network.WireGuard.Foreign.Key + ( Key + , fromByteString + , toByteString + ) where + +import qualified Data.ByteString as BS + +import Foreign + +import Network.WireGuard.Internal.Constant (keyLength) + +newtype Key = Key { fromKey :: [Word8] } + +instance Storable Key where + sizeOf _ = sizeOf (undefined :: Word8) * keyLength + alignment _ = alignment (undefined :: Word8) + peek ptr = Key <$> peekArray keyLength (castPtr ptr) + poke ptr (Key k) + | length k == keyLength = pokeArray (castPtr ptr) k + | otherwise = error "Key.poke: key length mismatch" + +fromByteString :: BS.ByteString -> Key +fromByteString bs + | BS.length bs == keyLength = Key (BS.unpack bs) + | otherwise = error "Key.fromByteString: key length mismatch" + +toByteString :: Key -> BS.ByteString +toByteString = BS.pack . fromKey diff --git a/src/Network/WireGuard/Foreign/Tun.hs b/src/Network/WireGuard/Foreign/Tun.hs new file mode 100644 index 0000000..c2b3a46 --- /dev/null +++ b/src/Network/WireGuard/Foreign/Tun.hs @@ -0,0 +1,45 @@ +{-# LANGUAGE CPP #-} + +module Network.WireGuard.Foreign.Tun + ( openTun + , fdReadBuf + , fdWriteBuf + ) where + +import System.Posix.Types (Fd (..)) + +import Foreign +import Foreign.C + +#ifdef OS_LINUX +import System.Posix.IO (fdReadBuf, fdWriteBuf) +#endif + +openTun :: String -> Int -> IO (Maybe [Fd]) +openTun intfName threads = + withCString intfName $ \intf_name_c -> + allocaArray threads $ \fds_c -> do + res <- tun_alloc_c intf_name_c (fromIntegral threads) fds_c -- TODO: handle exception + if res > 0 + then Just . map Fd <$> peekArray (fromIntegral res) fds_c + else return Nothing + +foreign import ccall safe "tun.h tun_alloc" tun_alloc_c :: CString -> CInt -> Ptr CInt -> IO CInt + +#ifdef OS_MACOS +fdReadBuf :: Fd -> Ptr Word8 -> CSize -> IO CSize +fdReadBuf _fd _buf 0 = return 0 +fdReadBuf fd buf nbytes = + fmap fromIntegral $ + throwErrnoIfMinus1Retry "fdReadBuf" $ + utun_read_c (fromIntegral fd) (castPtr buf) nbytes + +fdWriteBuf :: Fd -> Ptr Word8 -> CSize -> IO CSize +fdWriteBuf fd buf len = + fmap fromIntegral $ + throwErrnoIfMinus1Retry "fdWriteBuf" $ + utun_write_c (fromIntegral fd) (castPtr buf) len + +foreign import ccall safe "tun.h utun_read" utun_read_c :: CInt -> Ptr CChar -> CSize -> IO CSize +foreign import ccall safe "tun.h utun_write" utun_write_c :: CInt -> Ptr CChar -> CSize -> IO CSize +#endif diff --git a/src/Network/WireGuard/Foreign/UAPI.hsc b/src/Network/WireGuard/Foreign/UAPI.hsc new file mode 100644 index 0000000..b3e2948 --- /dev/null +++ b/src/Network/WireGuard/Foreign/UAPI.hsc @@ -0,0 +1,172 @@ +{-# LANGUAGE RecordWildCards #-} +{-# OPTIONS_GHC -fno-warn-missing-signatures #-} + +module Network.WireGuard.Foreign.UAPI + ( WgIpmask(..) + , PeerFlags + , peerFlagRemoveMe + , peerFlagReplaceIpmasks + , WgPeer(..) + , DeviceFlags + , deviceFlagReplacePeers + , deviceFlagRemovePrivateKey + , deviceFlagRemovePresharedKey + , deviceFlagRemoveFwmark + , WgDevice(..) + , readConfig + , writeConfig + ) where + +import Data.ByteString.Internal (ByteString (..)) +import Network.Socket.Internal (HostAddress, HostAddress6, + SockAddr, peekSockAddr, + pokeSockAddr) +import System.IO.Unsafe (unsafePerformIO) + +import Data.Char +import Data.Int +import Data.Word +import Foreign +import Foreign.C.String + +import qualified Network.WireGuard.Foreign.Key as K +import Network.WireGuard.Internal.Util (zeroMemory) + +import Network.WireGuard.Foreign.In6Addr + +#include "uapi.h" + +data WgIpmask = WgIpmask + { ipmaskIp :: ! (Either HostAddress HostAddress6) + , ipmaskCidr :: ! #{type typeof((struct wgipmask){0}.cidr)} + } + +type PeerFlags = #{type typeof((struct wgpeer){0}.flags)} + +peerFlagRemoveMe = #{const WGPEER_REMOVE_ME} :: PeerFlags +peerFlagReplaceIpmasks = #{const WGPEER_REPLACE_IPMASKS} :: PeerFlags + +data WgPeer = WgPeer + { peerPubKey :: ! ByteString -- TODO: use Bytes + , peerFlags :: ! PeerFlags + , peerAddr :: ! (Maybe SockAddr) + , peerLastHandshakeTime :: ! #{type typeof((struct wgpeer){0}.last_handshake_time.tv_sec)} + , peerReceivedBytes :: ! #{type typeof((struct wgpeer){0}.rx_bytes)} + , peerTransferredBytes :: ! #{type typeof((struct wgpeer){0}.tx_bytes)} + , peerKeepaliveInterval :: ! #{type typeof((struct wgpeer){0}.persistent_keepalive_interval)} + , peerNumIpmasks :: ! #{type typeof((struct wgpeer){0}.num_ipmasks)} + } + +type DeviceFlags = #{type typeof((struct wgdevice){0}.flags)} + +deviceFlagReplacePeers = #{const WGDEVICE_REPLACE_PEERS} :: DeviceFlags +deviceFlagRemovePrivateKey = #{const WGDEVICE_REMOVE_PRIVATE_KEY} :: DeviceFlags +deviceFlagRemovePresharedKey = #{const WGDEVICE_REMOVE_PRESHARED_KEY} :: DeviceFlags +deviceFlagRemoveFwmark = #{const WGDEVICE_REMOVE_FWMARK} :: DeviceFlags + +data WgDevice = WgDevice + { deviceInterface :: ! String + , deviceFlags :: ! DeviceFlags + , devicePubkey :: ! ByteString -- TODO: use Bytes + , devicePrivkey :: ! ByteString -- TODO: use ScrubbedBytes + , devicePSK :: ! ByteString -- TODO: use ScrubbedBytes + , deviceFwmark :: ! #{type typeof((struct wgdevice){0}.fwmark)} + , devicePort :: ! #{type typeof((struct wgdevice){0}.port)} + , deviceNumPeers :: ! #{type typeof((struct wgdevice){0}.num_peers)} + } + +type IpmaskIpFamilyType = #{type typeof((struct wgipmask){0}.family)} + +instance Storable WgIpmask where + sizeOf _ = #{size struct wgipmask} + alignment _ = #{alignment struct wgipmask} + peek ptr = do + ipFamily <- #{peek struct wgipmask, family} ptr :: IO IpmaskIpFamilyType + ip <- case ipFamily of + #{const AF_INET} -> Left <$> #{peek struct wgipmask, ip4.s_addr} ptr + #{const AF_INET6} -> Right . fromIn6Addr <$> #{peek struct wgipmask, ip6} ptr + _ -> error "WgIpmask.peek: unknown ipfamily" + cidr <- #{peek struct wgipmask, cidr} ptr + return (WgIpmask ip cidr) + + poke ptr self@WgIpmask{..} = do + zeroMemory ptr $ fromIntegral $ sizeOf self + case ipmaskIp of + Left ip4 -> do + #{poke struct wgipmask, family} ptr (#{const AF_INET} :: IpmaskIpFamilyType) + #{poke struct wgipmask, ip4.s_addr} ptr ip4 + Right ip6 -> do + #{poke struct wgipmask, family} ptr (#{const AF_INET6} :: IpmaskIpFamilyType) + #{poke struct wgipmask, ip6} ptr (In6Addr ip6) + #{poke struct wgipmask, cidr} ptr ipmaskCidr + +type IpFamilyType = #{type sa_family_t} + +sockaddrOffset = #{offset struct wgpeer, endpoint.addr} +ipfamilyOffset = #{offset struct wgpeer, endpoint.addr.sa_family} + +instance Storable WgPeer where + sizeOf _ = #{size struct wgpeer} + alignment _ = #{alignment struct wgpeer} + peek ptr = do + ipfamily <- peek (ptr `plusPtr` ipfamilyOffset) :: IO IpFamilyType + let sockaddrM = case ipfamily of + 0 -> return Nothing + _ -> Just <$> peekSockAddr (ptr `plusPtr` sockaddrOffset) + WgPeer <$> (K.toByteString <$> #{peek struct wgpeer, public_key} ptr) + <*> #{peek struct wgpeer, flags} ptr + <*> sockaddrM + <*> #{peek struct wgpeer, last_handshake_time.tv_sec} ptr + <*> #{peek struct wgpeer, rx_bytes} ptr + <*> #{peek struct wgpeer, tx_bytes} ptr + <*> #{peek struct wgpeer, persistent_keepalive_interval} ptr + <*> #{peek struct wgpeer, num_ipmasks} ptr + poke ptr self@WgPeer{..} = do + zeroMemory ptr $ fromIntegral $ sizeOf self + #{poke struct wgpeer, public_key} ptr (K.fromByteString peerPubKey) + #{poke struct wgpeer, flags} ptr peerFlags + case peerAddr of + Just addr -> pokeSockAddr (ptr `plusPtr` sockaddrOffset) addr + Nothing -> poke (ptr `plusPtr` ipfamilyOffset) (0 :: IpFamilyType) + #{poke struct wgpeer, last_handshake_time.tv_sec} ptr peerLastHandshakeTime + #{poke struct wgpeer, rx_bytes} ptr peerReceivedBytes + #{poke struct wgpeer, tx_bytes} ptr peerTransferredBytes + #{poke struct wgpeer, persistent_keepalive_interval} ptr peerKeepaliveInterval + #{poke struct wgpeer, num_ipmasks} ptr peerNumIpmasks + +instance Storable WgDevice where + sizeOf _ = #{size struct wgdevice} + alignment _ = #{alignment struct wgdevice} + peek ptr = WgDevice <$> peekCString (ptr `plusPtr` #{offset struct wgdevice, interface}) + <*> #{peek struct wgdevice, flags} ptr + <*> (K.toByteString <$> #{peek struct wgdevice, public_key} ptr) + <*> (K.toByteString <$> #{peek struct wgdevice, private_key} ptr) + <*> (K.toByteString <$> #{peek struct wgdevice, preshared_key} ptr) + <*> #{peek struct wgdevice, fwmark} ptr + <*> #{peek struct wgdevice, port} ptr + <*> #{peek struct wgdevice, num_peers} ptr + poke ptr self@WgDevice{..} + | length deviceInterface >= #{const IFNAMSIZ} = error "interface name is too long" + | otherwise = do + zeroMemory ptr $ fromIntegral $ sizeOf self + pokeArray0 (0 :: Word8) (ptr `plusPtr` #{offset struct wgdevice, interface}) (map (fromIntegral.ord) deviceInterface) + #{poke struct wgdevice, flags} ptr deviceFlags + #{poke struct wgdevice, public_key} ptr (K.fromByteString devicePubkey) + #{poke struct wgdevice, private_key} ptr (K.fromByteString devicePrivkey) + #{poke struct wgdevice, preshared_key} ptr (K.fromByteString devicePSK) + #{poke struct wgdevice, fwmark} ptr deviceFwmark + #{poke struct wgdevice, port} ptr devicePort + #{poke struct wgdevice, num_peers} ptr deviceNumPeers + +readConfig :: Storable a => ByteString -> a +readConfig (PS fptr off len) + | len == sizeOf output = output + | otherwise = error "UAPI.readConfig: length mismatch" + where + output = unsafePerformIO $ withForeignPtr fptr $ \ptr -> peek (ptr `plusPtr` off) + +writeConfig :: Storable a => a -> ByteString +writeConfig input = unsafePerformIO $ do + fptr <- mallocForeignPtr + withForeignPtr fptr $ \ptr -> poke ptr input + return $ PS (castForeignPtr fptr) 0 (sizeOf input) diff --git a/src/Network/WireGuard/Internal/Constant.hs b/src/Network/WireGuard/Internal/Constant.hs new file mode 100644 index 0000000..c615a0f --- /dev/null +++ b/src/Network/WireGuard/Internal/Constant.hs @@ -0,0 +1,55 @@ +module Network.WireGuard.Internal.Constant where + +authLength :: Int +authLength = 16 + +aeadLength :: Int -> Int +aeadLength payload = payload + authLength + +keyLength :: Int +keyLength = 32 + +timestampLength :: Int +timestampLength = 12 + +mac1Length :: Int +mac1Length = 16 + +mac2Length :: Int +mac2Length = 16 + +maxQueuedUdpPackets :: Int +maxQueuedUdpPackets = 4096 + +maxQueuedTunPackets :: Int +maxQueuedTunPackets = 4096 + +udpReadBufferLength :: Int +udpReadBufferLength = 4096 + +tunReadBufferLength :: Int +tunReadBufferLength = 4096 + +retryMaxWaitTime :: Int +retryMaxWaitTime = 5 * 1000000 -- 5 seconds + +handshakeRetryTime :: Int +handshakeRetryTime = 5 + +handshakeStopTime :: Int +handshakeStopTime = 90 + +sessionRenewTime :: Int +sessionRenewTime = 120 + +sessionExpireTime :: Int +sessionExpireTime = 180 + +sessionKeepaliveTime :: Int +sessionKeepaliveTime = 10 + +maxActiveSessions :: Int +maxActiveSessions = 2 + +heartbeatWaitTime :: Int +heartbeatWaitTime = 250 * 1000 -- 0.25 second diff --git a/src/Network/WireGuard/Internal/IPPacket.hs b/src/Network/WireGuard/Internal/IPPacket.hs new file mode 100644 index 0000000..56f4461 --- /dev/null +++ b/src/Network/WireGuard/Internal/IPPacket.hs @@ -0,0 +1,56 @@ +module Network.WireGuard.Internal.IPPacket + ( IPPacket(..) + , parseIPPacket + ) where + +import qualified Data.ByteArray as BA +import Data.IP (IPv4, IPv6, fromHostAddress, + fromHostAddress6) +import Foreign.Ptr (Ptr) +import Foreign.Storable (peekByteOff) + +import Data.Bits +import Data.Word + +data IPPacket = InvalidIPPacket + | IPv4Packet { src4 :: IPv4, dest4 :: IPv4 } + | IPv6Packet { src6 :: IPv6, dest6 :: IPv6 } + +parseIPPacket :: BA.ByteArrayAccess ba => ba -> IO IPPacket +parseIPPacket packet | BA.length packet < 20 = return InvalidIPPacket +parseIPPacket packet = BA.withByteArray packet $ \ptr -> do + firstByte <- peekByteOff ptr 0 :: IO Word8 + let version = firstByte `shiftR` 4 + parse4 = do + s4 <- peekByteOff ptr 12 + d4 <- peekByteOff ptr 16 + return (IPv4Packet (fromHostAddress s4) (fromHostAddress d4)) + parse6 + | BA.length packet < 40 = return InvalidIPPacket + | otherwise = do + s6a <- peek32be ptr 8 + s6b <- peek32be ptr 12 + s6c <- peek32be ptr 16 + s6d <- peek32be ptr 20 + d6a <- peek32be ptr 24 + d6b <- peek32be ptr 28 + d6c <- peek32be ptr 32 + d6d <- peek32be ptr 36 + let s6 = (s6a, s6b, s6c, s6d) + d6 = (d6a, d6b, d6c, d6d) + return (IPv6Packet (fromHostAddress6 s6) (fromHostAddress6 d6)) + case version of + 4 -> parse4 + 6 -> parse6 + _ -> return InvalidIPPacket + +peek32be :: Ptr a -> Int -> IO Word32 +peek32be ptr offset = do + a <- peekByteOff ptr offset :: IO Word8 + b <- peekByteOff ptr (offset + 1) :: IO Word8 + c <- peekByteOff ptr (offset + 2) :: IO Word8 + d <- peekByteOff ptr (offset + 3) :: IO Word8 + return $! (fromIntegral a `unsafeShiftL` 24) .|. + (fromIntegral b `unsafeShiftL` 16) .|. + (fromIntegral c `unsafeShiftL` 8) .|. + fromIntegral d diff --git a/src/Network/WireGuard/Internal/Noise.hs b/src/Network/WireGuard/Internal/Noise.hs new file mode 100644 index 0000000..b529d25 --- /dev/null +++ b/src/Network/WireGuard/Internal/Noise.hs @@ -0,0 +1,98 @@ +{-# LANGUAGE OverloadedStrings #-} +module Network.WireGuard.Internal.Noise + ( NoiseStateWG + , newNoiseState + , sendFirstMessage + , recvFirstMessageAndReply + , recvSecondMessage + , encryptMessage + , decryptMessage + ) where + +import Control.Exception (SomeException) +import Control.Lens ((&), (.~), (^.)) +import Control.Monad (unless) +import Control.Monad.Catch (throwM) +import qualified Crypto.Cipher.ChaChaPoly1305 as CCP +import Crypto.Error (throwCryptoError) +import Crypto.Noise.Cipher (cipherSymToBytes) +import Crypto.Noise.Cipher.ChaChaPoly1305 (ChaChaPoly1305) +import Crypto.Noise.DH.Curve25519 (Curve25519) +import Crypto.Noise.HandshakePatterns (noiseIK) +import Crypto.Noise.Hash.BLAKE2s (BLAKE2s) +import Crypto.Noise.Internal.CipherState (csk) +import Crypto.Noise.Internal.NoiseState (nsReceivingCipherState, + nsSendingCipherState) +import Data.ByteArray (ScrubbedBytes, convert) +import Data.ByteString (ByteString) +import qualified Data.ByteString as BS +import Data.Maybe (fromJust) +import Data.Serialize (putWord64le, runPut) + +import Crypto.Noise + +import Network.WireGuard.Internal.Types + +type NoiseStateWG = NoiseState ChaChaPoly1305 Curve25519 BLAKE2s + +newNoiseState :: KeyPair -> Maybe PresharedKey -> KeyPair -> Maybe PublicKey -> HandshakeRole -> NoiseStateWG +newNoiseState staticKey presharedKey ephemeralKey remotePub role = + noiseState $ defaultHandshakeOpts noiseIK role + & hoPrologue .~ "WireGuard v0 zx2c4 Jason@zx2c4.com" + & hoLocalStatic .~ Just staticKey + & hoPreSharedKey .~ presharedKey + & hoRemoteStatic .~ remotePub + & hoLocalEphemeral .~ Just ephemeralKey + +sendFirstMessage :: NoiseStateWG -> ScrubbedBytes + -> Either SomeException (ByteString, NoiseStateWG) +sendFirstMessage state0 plaintext1 = writeMessage state0 plaintext1 + +recvFirstMessageAndReply :: NoiseStateWG -> ByteString -> ScrubbedBytes + -> Either SomeException (ByteString, ScrubbedBytes, PublicKey, SessionKey) +recvFirstMessageAndReply state0 ciphertext1 plaintext2 = do + (plaintext1, state1) <- readMessage state0 ciphertext1 + (ciphertext2, state2) <- writeMessage state1 plaintext2 + unless (handshakeComplete state2) internalError + case remoteStaticKey state2 of + Nothing -> internalError + Just rpub -> return (ciphertext2, plaintext1, rpub, extractSessionKey state2) + +recvSecondMessage :: NoiseStateWG -> ByteString + -> Either SomeException (ScrubbedBytes, PublicKey, SessionKey) +recvSecondMessage state1 ciphertext2 = do + (plaintext2, state2) <- readMessage state1 ciphertext2 + unless (handshakeComplete state2) internalError + case remoteStaticKey state2 of + Nothing -> internalError + Just rpub -> return (plaintext2, rpub, extractSessionKey state2) + +encryptMessage :: SessionKey -> Counter -> ScrubbedBytes -> (EncryptedPayload, AuthTag) +encryptMessage key counter plaintext = (ciphertext, convert authtag) + where + st0 = throwCryptoError (CCP.initialize (sendKey key) (getNonce counter)) + (ciphertext, st) = CCP.encrypt (convert plaintext) st0 + authtag = CCP.finalize st + +decryptMessage :: SessionKey -> Counter -> (EncryptedPayload, AuthTag) -> Maybe ScrubbedBytes +decryptMessage key counter (ciphertext, authtag) + | authtag == authtagExpected = Just (convert plaintext) + | otherwise = Nothing + where + st0 = throwCryptoError (CCP.initialize (recvKey key) (getNonce counter)) + (plaintext, st) = CCP.decrypt ciphertext st0 + authtagExpected = convert $ CCP.finalize st + +getNonce :: Counter -> CCP.Nonce +getNonce counter = throwCryptoError (CCP.nonce8 constant iv) + where + constant = BS.replicate 4 0 + iv = runPut (putWord64le counter) + +extractSessionKey :: NoiseStateWG -> SessionKey +extractSessionKey ns = + SessionKey (cipherSymToBytes $ fromJust (ns ^. nsSendingCipherState) ^. csk) + (cipherSymToBytes $ fromJust (ns ^. nsReceivingCipherState) ^. csk) + +internalError :: Either SomeException a +internalError = throwM (InvalidHandshakeOptions "internal error") diff --git a/src/Network/WireGuard/Internal/Packet.hs b/src/Network/WireGuard/Internal/Packet.hs new file mode 100644 index 0000000..ebc24fc --- /dev/null +++ b/src/Network/WireGuard/Internal/Packet.hs @@ -0,0 +1,112 @@ +{-# LANGUAGE RecordWildCards #-} + +module Network.WireGuard.Internal.Packet + ( Packet(..) + , parsePacket + , buildPacket + ) where + +import Control.Monad (replicateM_, unless, when) +import qualified Data.ByteString as BS +import Foreign.Storable (sizeOf) + +import Data.Serialize + +import Network.WireGuard.Internal.Constant +import Network.WireGuard.Internal.Types + +data Packet = HandshakeInitiation + { senderIndex :: !Index + , encryptedPayload :: !EncryptedPayload + } + | HandshakeResponse + { senderIndex :: !Index + , receiverIndex :: !Index + , encryptedPayload :: !EncryptedPayload + } + | PacketData + { receiverIndex :: !Index + , counter :: !Counter + , encryptedPayload :: !EncryptedPayload + , authTag :: !AuthTag + } + deriving (Show) + +parsePacket :: (BS.ByteString -> BS.ByteString) -> Get Packet +parsePacket getMac1 = do + packetType <- lookAhead getWord8 + case packetType of + 1 -> verifyLength (==handshakeInitiationPacketLength) $ verifyMac getMac1 parseHandshakeInitiation + 2 -> verifyLength (==handshakeResponsePacketLength) $ verifyMac getMac1 parseHandshakeResponse + 4 -> verifyLength (>=packetDataMinimumPacketLength) parsePacketData + _ -> fail "unknown packet" + where + handshakeInitiationPacketLength = 4 + indexSize + keyLength + aeadLength keyLength + aeadLength timestampLength + mac1Length + mac2Length + handshakeResponsePacketLength = 4 + indexSize + indexSize + keyLength + aeadLength 0 + mac1Length + mac2Length + packetDataMinimumPacketLength = 4 + indexSize + counterSize + aeadLength 0 + + indexSize = sizeOf (undefined :: Index) + counterSize = sizeOf (undefined :: Counter) + +parseHandshakeInitiation :: Get Packet +parseHandshakeInitiation = do + skip 4 + HandshakeInitiation <$> getWord32le <*> (remaining >>= getBytes) + +parseHandshakeResponse :: Get Packet +parseHandshakeResponse = do + skip 4 + HandshakeResponse <$> getWord32le <*> getWord32le <*> (remaining >>= getBytes) + +parsePacketData :: Get Packet +parsePacketData = do + skip 4 + PacketData <$> getWord32le <*> getWord64le <*> + (remaining >>= getBytes . subtract authLength) <*> getBytes authLength + +buildPacket :: (BS.ByteString -> BS.ByteString) -> Putter Packet +buildPacket getMac1 HandshakeInitiation{..} = appendMac getMac1 $ do + putWord8 1 + replicateM_ 3 (putWord8 0) + putWord32le senderIndex + putByteString encryptedPayload + +buildPacket getMac1 HandshakeResponse{..} = appendMac getMac1 $ do + putWord8 2 + replicateM_ 3 (putWord8 0) + putWord32le senderIndex + putWord32le receiverIndex + putByteString encryptedPayload + +buildPacket _getMac1 PacketData{..} = do + putWord8 4 + replicateM_ 3 (putWord8 0) + putWord32le receiverIndex + putWord64le counter + putByteString encryptedPayload + putByteString authTag + +verifyLength :: (Int -> Bool) -> Get a -> Get a +verifyLength check ga = do + outcome <- check <$> remaining + unless outcome $ fail "wrong packet length" + ga + +verifyMac :: (BS.ByteString -> BS.ByteString) -> Get Packet -> Get Packet +verifyMac getMac1 ga = do + bodyLength <- subtract (mac1Length + mac2Length) <$> remaining + when (bodyLength < 0) $ fail "packet too small" + expectedMac1 <- getMac1 <$> lookAhead (getBytes bodyLength) + parsed <- isolate bodyLength ga + receivedMac1 <- getBytes mac1Length + when (expectedMac1 /= receivedMac1) $ fail "wrong mac1" + skip mac2Length + return parsed + +appendMac :: (BS.ByteString -> BS.ByteString) -> Put -> Put +appendMac getMac1 p = do + -- TODO: find a smart approach to avoid extra ByteString allocation + let bs = runPut p + putByteString bs + putByteString (getMac1 bs) + replicateM_ mac2Length (putWord8 0) diff --git a/src/Network/WireGuard/Internal/PacketQueue.hs b/src/Network/WireGuard/Internal/PacketQueue.hs new file mode 100644 index 0000000..bc390f8 --- /dev/null +++ b/src/Network/WireGuard/Internal/PacketQueue.hs @@ -0,0 +1,49 @@ +{-# LANGUAGE RecordWildCards #-} + +module Network.WireGuard.Internal.PacketQueue + ( PacketQueue + , newPacketQueue + , popPacketQueue + , pushPacketQueue + , tryPushPacketQueue + ) where + +import Control.Concurrent.STM + +data PacketQueue packet = PacketQueue + { tqueue :: TQueue packet + , allowance :: TVar Int + } + +-- | Create a new PacketQueue with size limit of |maxQueuedPackets|. +newPacketQueue :: Int -> STM (PacketQueue packet) +newPacketQueue maxQueuedPackets = PacketQueue <$> newTQueue <*> newTVar maxQueuedPackets + +-- | Pop a packet out from the queue, blocks if no packet is available. +popPacketQueue :: PacketQueue packet -> STM packet +popPacketQueue PacketQueue{..} = do + packet <- readTQueue tqueue + modifyTVar' allowance (+1) + return packet + +-- | Push a packet into the queue. Blocks if it's full. +pushPacketQueue :: PacketQueue packet -> packet -> STM () +pushPacketQueue PacketQueue{..} packet = do + allowance' <- readTVar allowance + if allowance' <= 0 + then retry + else do + writeTQueue tqueue packet + writeTVar allowance (allowance' - 1) + +-- | Try to push a packet into the queue. Returns True if it's pushed. +tryPushPacketQueue :: PacketQueue packet -> packet -> STM Bool +tryPushPacketQueue PacketQueue{..} packet = do + allowance' <- readTVar allowance + if allowance' <= 0 + then return False + else do + writeTQueue tqueue packet + writeTVar allowance (allowance' - 1) + return True + diff --git a/src/Network/WireGuard/Internal/State.hs b/src/Network/WireGuard/Internal/State.hs new file mode 100644 index 0000000..38866e8 --- /dev/null +++ b/src/Network/WireGuard/Internal/State.hs @@ -0,0 +1,242 @@ +{-# LANGUAGE RecordWildCards #-} +{-# LANGUAGE TupleSections #-} + +module Network.WireGuard.Internal.State + ( PeerId + , Device(..) + , Peer(..) + , InitiatorWait(..) + , ResponderWait(..) + , Session(..) + , createDevice + , createPeer + , invalidateSessions + , buildRouteTables + , acquireEmptyIndex + , removeIndex + , nextNonce + , eraseInitiatorWait + , eraseResponderWait + , getSession + , waitForSession + , findSession + , addSession + , filterSessions + , updateTai64n + , updateEndPoint + ) where + +import Control.Monad (forM, when) +import Crypto.Noise (NoiseState) +import Crypto.Noise.Cipher.ChaChaPoly1305 (ChaChaPoly1305) +import Crypto.Noise.DH.Curve25519 (Curve25519) +import Crypto.Noise.Hash.BLAKE2s (BLAKE2s) +import qualified Data.HashMap.Strict as HM +import Data.IP (IPRange (..), IPv4, IPv6) +import qualified Data.IP.RouteTable as RT +import Data.Maybe (catMaybes, fromJust, + isNothing, mapMaybe) +import Data.Word +import Network.Socket.Internal (SockAddr) + +import Control.Concurrent.STM + +import Network.WireGuard.Internal.Constant +import Network.WireGuard.Internal.Types + +data Device = Device + { intfName :: String + , localKey :: TVar (Maybe KeyPair) + , presharedKey :: TVar (Maybe PresharedKey) + , fwmark :: TVar Word + , port :: TVar Int + , peers :: TVar (HM.HashMap PeerId Peer) + , routeTable4 :: TVar (RT.IPRTable IPv4 Peer) + , routeTable6 :: TVar (RT.IPRTable IPv6 Peer) + , indexMap :: TVar (HM.HashMap Index Peer) + } + +data Peer = Peer + { remotePub :: !PublicKey + , ipmasks :: TVar [IPRange] + , endPoint :: TVar (Maybe SockAddr) + , lastHandshakeTime :: TVar (Maybe Time) + , receivedBytes :: TVar Word64 + , transferredBytes :: TVar Word64 + , keepaliveInterval :: TVar Int + , initiatorWait :: TVar (Maybe InitiatorWait) + , responderWait :: TVar (Maybe ResponderWait) + , sessions :: TVar [Session] -- last two active sessions + , lastTai64n :: TVar TAI64n + , lastReceiveTime :: TVar Time + , lastTransferTime :: TVar Time + , lastKeepaliveTime :: TVar Time + } + +data InitiatorWait = InitiatorWait + { initOurIndex :: !Index + , initRetryTime :: !Time + , initStopTime :: !Time + , initNoise :: !(NoiseState ChaChaPoly1305 Curve25519 BLAKE2s) + } + +data ResponderWait = ResponderWait + { respOurIndex :: !Index + , respTheirIndex :: !Index + , respStopTime :: !Time + , respSessionKey :: !SessionKey + } + +data Session = Session + { ourIndex :: !Index + , theirIndex :: !Index + , sessionKey :: !SessionKey + , renewTime :: !Time + , expireTime :: !Time + , sessionCounter :: TVar Counter + -- TODO: avoid nonce reuse from remote peer + } + +createDevice :: String -> STM Device +createDevice intf = Device intf <$> newTVar Nothing + <*> newTVar Nothing + <*> newTVar 0 + <*> newTVar 0 + <*> newTVar HM.empty + <*> newTVar RT.empty + <*> newTVar RT.empty + <*> newTVar HM.empty + +createPeer :: PublicKey -> STM Peer +createPeer rpub = Peer rpub <$> newTVar [] + <*> newTVar Nothing + <*> newTVar Nothing + <*> newTVar 0 + <*> newTVar 0 + <*> newTVar 0 + <*> newTVar Nothing + <*> newTVar Nothing + <*> newTVar [] + <*> newTVar mempty + <*> newTVar farFuture + <*> newTVar farFuture + <*> newTVar 0 + +invalidateSessions :: Device -> STM () +invalidateSessions Device{..} = do + writeTVar indexMap HM.empty + readTVar peers >>= mapM_ invalidatePeerSessions + where + invalidatePeerSessions Peer{..} = do + writeTVar lastHandshakeTime Nothing + writeTVar initiatorWait Nothing + writeTVar responderWait Nothing + writeTVar sessions [] + +buildRouteTables :: Device -> STM () +buildRouteTables Device{..} = do + gather pickIPv4 >>= writeTVar routeTable4 . RT.fromList . concat + gather pickIPv6 >>= writeTVar routeTable6 . RT.fromList . concat + where + gather pick = do + peers' <- readTVar peers + forM peers' $ \peer -> + map (,peer) . mapMaybe pick <$> readTVar (ipmasks peer) + pickIPv4 (IPv4Range ipv4) = Just ipv4 + pickIPv4 _ = Nothing + pickIPv6 (IPv6Range ipv6) = Just ipv6 + pickIPv6 _ = Nothing + +acquireEmptyIndex :: Device -> Peer -> Index -> STM Index +acquireEmptyIndex device peer seed = do + imap <- readTVar (indexMap device) + let findEmpty idx + | HM.member idx imap = findEmpty (idx * 3 + 1) + | otherwise = idx + emptyIndex = findEmpty seed + writeTVar (indexMap device) $ HM.insert emptyIndex peer imap + return emptyIndex + +removeIndex :: Device -> Index -> STM () +removeIndex device index = modifyTVar' (indexMap device) (HM.delete index) + +nextNonce :: Session -> STM Counter +nextNonce Session{..} = do + nonce <- readTVar sessionCounter + writeTVar sessionCounter (nonce + 1) + return nonce + +eraseInitiatorWait :: Device -> Peer -> Maybe Index -> STM Bool +eraseInitiatorWait device Peer{..} index = do + miwait <- readTVar initiatorWait + case miwait of + Just iwait | isNothing index || initOurIndex iwait == fromJust index -> do + writeTVar initiatorWait Nothing + when (isNothing index) $ removeIndex device (initOurIndex iwait) + return True + _ -> return False + +eraseResponderWait :: Device -> Peer -> Maybe Index -> STM Bool +eraseResponderWait device Peer{..} index = do + mrwait <- readTVar responderWait + case mrwait of + Just rwait | isNothing index || respOurIndex rwait == fromJust index -> do + writeTVar responderWait Nothing + when (isNothing index) $ removeIndex device (respOurIndex rwait) + return True + _ -> return False + +getSession :: Peer -> IO (Maybe Session) +getSession peer = do + sessions' <- readTVarIO (sessions peer) + case sessions' of + [] -> return Nothing + (s:_) -> return (Just s) + +waitForSession :: Peer -> STM Session +waitForSession peer = do + sessions' <- readTVar (sessions peer) + case sessions' of + [] -> retry + (s:_) -> return s + +findSession :: Peer -> Index -> STM (Maybe (Either ResponderWait Session)) +findSession peer index = do + sessions' <- filter ((==index).ourIndex) <$> readTVar (sessions peer) + case sessions' of + (s:_) -> return (Just (Right s)) + [] -> do + mrwait <- readTVar (responderWait peer) + case mrwait of + Just rwait | respOurIndex rwait == index -> return (Just (Left rwait)) + _ -> return Nothing + + +addSession :: Device -> Peer -> Session -> STM () +addSession device peer session = do + (toKeep, toDrop) <- splitAt maxActiveSessions . (session:) <$> readTVar (sessions peer) + mapM_ (removeIndex device . ourIndex) toDrop + writeTVar (sessions peer) toKeep + +filterSessions :: Device -> Peer -> (Session -> Bool) -> STM () +filterSessions device peer cond = do + sessions' <- readTVar (sessions peer) + filtered <- fmap catMaybes $ forM sessions' $ \session -> + if cond session + then return (Just session) + else do + removeIndex device (ourIndex session) + return Nothing + writeTVar (sessions peer) filtered + +updateTai64n :: Peer -> TAI64n -> STM Bool +updateTai64n peer tai64n = do + lastTai64n' <- readTVar (lastTai64n peer) + if tai64n <= lastTai64n' + then return False + else do + writeTVar (lastTai64n peer) tai64n + return True + +updateEndPoint :: Peer -> SockAddr -> STM () +updateEndPoint peer sock = writeTVar (endPoint peer) (Just sock) diff --git a/src/Network/WireGuard/Internal/Types.hs b/src/Network/WireGuard/Internal/Types.hs new file mode 100644 index 0000000..3409e2a --- /dev/null +++ b/src/Network/WireGuard/Internal/Types.hs @@ -0,0 +1,78 @@ +module Network.WireGuard.Internal.Types + ( Index + , Counter + , PeerId + , PublicKey + , PrivateKey + , KeyPair + , PresharedKey + , Time + , UdpPacket + , TunPacket + , EncryptedPayload + , AuthTag + , TAI64n + , SessionKey(..) + , WireGuardError(..) + , getPeerId + , farFuture + ) where + +import Control.Exception (Exception, SomeException) +import qualified Crypto.Noise.DH as DH +import Crypto.Noise.DH.Curve25519 (Curve25519) +import Data.ByteArray (ScrubbedBytes) +import qualified Data.ByteArray as BA +import qualified Data.ByteString as BS +import Foreign.C.Types (CTime (..)) +import Network.Socket (SockAddr) +import System.Posix.Types (EpochTime) + +import Data.Word + +type Index = Word32 +type Counter = Word64 +type PeerId = BS.ByteString + +type PublicKey = DH.PublicKey Curve25519 +type PrivateKey = DH.SecretKey Curve25519 +type KeyPair = DH.KeyPair Curve25519 +type PresharedKey = ScrubbedBytes + +type Time = EpochTime + +type UdpPacket = (BS.ByteString, SockAddr) +type TunPacket = ScrubbedBytes + +type EncryptedPayload = BS.ByteString +type AuthTag = BS.ByteString +type TAI64n = BS.ByteString + +data SessionKey = SessionKey + { sendKey :: !ScrubbedBytes + , recvKey :: !ScrubbedBytes + } + +data WireGuardError + = DecryptFailureError + | DestinationNotReachableError + | DeviceNotReadyError + | EndPointUnknownError + | HandshakeInitiationReplayError + | InvalidIPPacketError + | InvalidWGPacketError String + | NoiseError SomeException + | NonceReuseError + | OutdatedPacketError + | RemotePeerNotFoundError + | SourceAddrBlockedError + | UnknownIndexError + deriving (Show) + +instance Exception WireGuardError + +getPeerId :: PublicKey -> PeerId +getPeerId = BA.convert . DH.dhPubToBytes + +farFuture :: Time +farFuture = CTime maxBound diff --git a/src/Network/WireGuard/Internal/Util.hs b/src/Network/WireGuard/Internal/Util.hs new file mode 100644 index 0000000..f7ecde5 --- /dev/null +++ b/src/Network/WireGuard/Internal/Util.hs @@ -0,0 +1,62 @@ +{-# LANGUAGE ScopedTypeVariables #-} + +module Network.WireGuard.Internal.Util + ( retryWithBackoff + , ignoreSyncExceptions + , foreverWithBackoff + , catchIOExceptionAnd + , catchSomeExceptionAnd + , withJust + , zeroMemory + , copyMemory + ) where + +import Control.Concurrent (threadDelay) +import Control.Exception (Exception (..), + IOException, + SomeAsyncException, + SomeException, throwIO) +import Control.Monad.Catch (MonadCatch (..)) +import System.IO (hPutStrLn, stderr) + +import Foreign +import Foreign.C + +import Network.WireGuard.Internal.Constant + +retryWithBackoff :: IO () -> IO () +retryWithBackoff = foreverWithBackoff . ignoreSyncExceptions + +ignoreSyncExceptions :: IO () -> IO () +ignoreSyncExceptions m = catch m handleExcept + where + handleExcept e = case fromException e of + Just asyncExcept -> throwIO (asyncExcept :: SomeAsyncException) + Nothing -> hPutStrLn stderr (displayException e) -- TODO: proper logging + +foreverWithBackoff :: IO () -> IO () +foreverWithBackoff m = loop 1 + where + loop t = m >> threadDelay t >> loop (min (t * 2) retryMaxWaitTime) + +catchIOExceptionAnd :: MonadCatch m => m () -> m () -> m () +catchIOExceptionAnd what m = catch m $ \(_ :: IOException) -> what + +catchSomeExceptionAnd :: MonadCatch m => m () -> m () -> m () +catchSomeExceptionAnd what m = catch m $ \(_ :: SomeException) -> what + +withJust :: Monad m => m (Maybe a) -> (a -> m ()) -> m () +withJust mma func = do + ma <- mma + case ma of + Nothing -> return () + Just a -> func a + +zeroMemory :: Ptr a -> CSize -> IO () +zeroMemory dest nbytes = memset dest 0 (fromIntegral nbytes) + +copyMemory :: Ptr a -> Ptr b -> CSize -> IO () +copyMemory dest src nbytes = memcpy dest src nbytes + +foreign import ccall unsafe "string.h" memset :: Ptr a -> CInt -> CSize -> IO () +foreign import ccall unsafe "string.h" memcpy :: Ptr a -> Ptr b -> CSize -> IO () diff --git a/src/Network/WireGuard/RPC.hs b/src/Network/WireGuard/RPC.hs new file mode 100644 index 0000000..7ecb8de --- /dev/null +++ b/src/Network/WireGuard/RPC.hs @@ -0,0 +1,187 @@ +{-# LANGUAGE RecordWildCards #-} + +module Network.WireGuard.RPC + ( runRPC + ) where + +import Control.Concurrent.STM (STM, atomically, + modifyTVar', readTVar, + writeTVar) +import Control.Monad (replicateM, sequence, + when) +import Control.Monad.IO.Class (liftIO) +import qualified Crypto.Noise.DH as DH +import qualified Data.ByteArray as BA +import qualified Data.ByteString as BS +import qualified Data.Conduit.Binary as CB +import Data.Conduit.Network.Unix (appSink, appSource, + runUnixServer, + serverSettings) +import qualified Data.HashMap.Strict as HM +import Data.Int (Int32) +import Data.List (genericLength) +import Foreign.C.Types (CTime (..)) + +import Data.Bits +import Data.Conduit +import Data.IP +import Data.Maybe + +import Network.WireGuard.Foreign.UAPI +import Network.WireGuard.Internal.Constant +import Network.WireGuard.Internal.State +import Network.WireGuard.Internal.Types +import Network.WireGuard.Internal.Util + +-- | Run RPC service over a unix socket +runRPC :: FilePath -> Device -> IO () +runRPC sockPath device = runUnixServer (serverSettings sockPath) $ \app -> + catchIOExceptionAnd (return ()) $ runConduit (appSource app =$= serveConduit =$= appSink app) + where + -- TODO: ensure that all bytestring over sockets will be erased + serveConduit = do + h <- CB.head + case h of + Just 0 -> showDevice device + Just byte -> do + leftover (BS.singleton byte) + mWgdev <- CB.sinkStorable + case mWgdev of + Just wgdev -> catchSomeExceptionAnd returnError (updateDevice wgdev) + Nothing -> mempty + Nothing -> mempty + + returnError = yield $ writeConfig (-invalidValueError) + + showDevice Device{..} = do + (wgdevice, peers') <- liftIO buildWgDevice + yield (writeConfig wgdevice) + mapM_ showPeer peers' + where + buildWgDevice = atomically $ do + localKey' <- readTVar localKey + let (pub, priv) = case localKey' of + Nothing -> (emptyKey, emptyKey) + Just (sec, pub') -> (pubToBytes pub', privToBytes sec) + psk' <- fmap pskToBytes <$> readTVar presharedKey + fwmark' <- fromIntegral <$> readTVar fwmark + port' <- fromIntegral <$> readTVar port + peers' <- readTVar peers + return (WgDevice intfName 0 pub priv (fromMaybe emptyKey psk') + fwmark' port' (fromIntegral $ HM.size peers'), peers') + + showPeer Peer{..} = do + (wgpeer, ipmasks') <- liftIO buildWgPeer + yield (writeConfig wgpeer) + yield $ BS.concat (map (writeConfig . ipRangeToWgIpmask) ipmasks') + where + extractTime Nothing = 0 + extractTime (Just (CTime t)) = fromIntegral t + + buildWgPeer = atomically $ do + ipmasks' <- readTVar ipmasks + wgpeer <- WgPeer (pubToBytes remotePub) + <$> return 0 + <*> readTVar endPoint + <*> (extractTime <$> readTVar lastHandshakeTime) + <*> (fromIntegral <$> readTVar receivedBytes) + <*> (fromIntegral <$> readTVar transferredBytes) + <*> (fromIntegral <$> readTVar keepaliveInterval) + <*> return (genericLength ipmasks') + return (wgpeer, ipmasks') + + updateDevice wgdevice = do + setPeerMs <- replicateM (fromIntegral $ deviceNumPeers wgdevice) $ do + Just wgpeer <- CB.sinkStorable + -- TODO: replace fromJust + ipranges <- replicateM (fromIntegral $ peerNumIpmasks wgpeer) + (wgIpmaskToIpRange . fromJust <$> CB.sinkStorable) + return $ setPeer device wgpeer ipranges + liftIO $ atomically $ do + setDevice device wgdevice + anyIpMaskChanged <- or <$> sequence setPeerMs + -- TODO: modify routetable incrementally + when anyIpMaskChanged $ buildRouteTables device + yield $ writeConfig (0 :: Int32) + +-- | implementation of config.c::set_peer() +setPeer :: Device -> WgPeer -> [IPRange] -> STM Bool +setPeer Device{..} WgPeer{..} ipranges + | peerPubKey == emptyKey = return False + | testFlag peerFlags peerFlagRemoveMe = modifyTVar' peers (HM.delete peerPubKey) >> return False + | otherwise = do + peers' <- readTVar peers + Peer{..} <- case HM.lookup peerPubKey peers' of + Nothing -> do + newPeer <- createPeer (fromJust $ bytesToPub peerPubKey) -- TODO: replace fromJust + modifyTVar' peers (HM.insert peerPubKey newPeer) + return newPeer + Just p -> return p + when (isJust peerAddr) $ writeTVar endPoint peerAddr + let replaceIpmasks = testFlag peerFlags peerFlagReplaceIpmasks + changeIpmasks = replaceIpmasks || not (null ipranges) + when changeIpmasks $ + if replaceIpmasks + then writeTVar ipmasks ipranges + else modifyTVar' ipmasks (++ipranges) + when (peerKeepaliveInterval /= complement 0) $ + writeTVar keepaliveInterval (fromIntegral peerKeepaliveInterval) + return changeIpmasks + +-- | implementation of config.c::config_set_device() +setDevice :: Device -> WgDevice -> STM () +setDevice device@Device{..} WgDevice{..} = do + when (deviceFwmark /= 0 || deviceFwmark == 0 && testFlag deviceFlags deviceFlagRemoveFwmark) $ + writeTVar fwmark (fromIntegral deviceFwmark) + when (devicePort /= 0) $ writeTVar port (fromIntegral devicePort) + when (testFlag deviceFlags deviceFlagReplacePeers) $ writeTVar peers HM.empty + + let removeLocalKey = testFlag deviceFlags deviceFlagRemovePrivateKey + changeLocalKey = removeLocalKey || devicePrivkey /= emptyKey + changeLocalKeyTo = if removeLocalKey then Nothing else bytesToPair devicePrivkey + when changeLocalKey $ writeTVar localKey changeLocalKeyTo + + let removePSK = testFlag deviceFlags deviceFlagRemovePresharedKey + changePSK = removePSK || devicePSK /= emptyKey + changePSKTo = if removePSK then Nothing else Just (bytesToPSK devicePSK) + when changePSK $ writeTVar presharedKey changePSKTo + + when (changeLocalKey || changePSK) $ invalidateSessions device + +ipRangeToWgIpmask :: IPRange -> WgIpmask +ipRangeToWgIpmask (IPv4Range ipv4range) = case addrRangePair ipv4range of + (ipv4, prefix) -> WgIpmask (Left (toHostAddress ipv4)) (fromIntegral prefix) +ipRangeToWgIpmask (IPv6Range ipv6range) = case addrRangePair ipv6range of + (ipv6, prefix) -> WgIpmask (Right (toHostAddress6 ipv6)) (fromIntegral prefix) + +wgIpmaskToIpRange :: WgIpmask -> IPRange +wgIpmaskToIpRange (WgIpmask ip cidr) = case ip of + Left ipv4 -> IPv4Range $ makeAddrRange (fromHostAddress ipv4) (fromIntegral cidr) + Right ipv6 -> IPv6Range $ makeAddrRange (fromHostAddress6 ipv6) (fromIntegral cidr) + +invalidValueError :: Int32 +invalidValueError = 22 -- TODO: report back actual error + +emptyKey :: BS.ByteString +emptyKey = BS.replicate keyLength 0 + +testFlag :: Bits a => a -> a -> Bool +testFlag a flag = (a .&. flag) /= zeroBits + +pubToBytes :: PublicKey -> BS.ByteString +pubToBytes = BA.convert . DH.dhPubToBytes + +privToBytes :: PrivateKey -> BS.ByteString +privToBytes = BA.convert . DH.dhSecToBytes + +pskToBytes :: PresharedKey -> BS.ByteString +pskToBytes = BA.convert + +bytesToPair :: BS.ByteString -> Maybe KeyPair +bytesToPair = DH.dhBytesToPair . BA.convert + +bytesToPub :: BS.ByteString -> Maybe PublicKey +bytesToPub = DH.dhBytesToPub . BA.convert + +bytesToPSK :: BS.ByteString -> PresharedKey +bytesToPSK = BA.convert diff --git a/src/Network/WireGuard/TunListener.hs b/src/Network/WireGuard/TunListener.hs new file mode 100644 index 0000000..d57cf98 --- /dev/null +++ b/src/Network/WireGuard/TunListener.hs @@ -0,0 +1,60 @@ +{-# LANGUAGE CPP #-} +{-# LANGUAGE RecordWildCards #-} + +module Network.WireGuard.TunListener + ( runTunListener + ) where + +import Control.Concurrent.Async (wait, withAsync) +import Control.Monad (forever, void) +import Control.Monad.STM (atomically) +import qualified Data.ByteArray as BA +import Data.Word (Word8) +import Foreign.Marshal.Alloc (allocaBytes) +import Foreign.Ptr (Ptr) +import System.Posix.Types (Fd) + +import Network.WireGuard.Foreign.Tun (fdReadBuf, fdWriteBuf) + +import Network.WireGuard.Internal.Constant +import Network.WireGuard.Internal.PacketQueue +import Network.WireGuard.Internal.Types +import Network.WireGuard.Internal.Util + +#ifdef OS_LINUX +import Control.Concurrent (threadWaitRead, + threadWaitWrite) +#endif + +runTunListener :: [Fd] -> PacketQueue TunPacket -> PacketQueue TunPacket -> IO () +runTunListener fds readTunChan writeTunChan = loop fds [] + where + loop [] asyncs = mapM_ wait asyncs + loop (fd:rest) asyncs = + withAsync (retryWithBackoff $ handleRead readTunChan fd) $ \rt -> + withAsync (retryWithBackoff $ handleWrite writeTunChan fd) $ \wt -> + loop rest (rt:wt:asyncs) + +handleRead :: PacketQueue TunPacket -> Fd -> IO () +handleRead readTunChan fd = allocaBytes tunReadBufferLength $ \buf -> + forever (readFd buf fd >>= atomically . pushPacketQueue readTunChan) + +handleWrite :: PacketQueue TunPacket -> Fd -> IO () +handleWrite writeTunChan fd = + forever (atomically (popPacketQueue writeTunChan) >>= writeFd fd) + +readFd :: BA.ByteArray ba => Ptr Word8 -> Fd -> IO ba +readFd buf fd = do +#ifdef OS_LINUX + threadWaitRead fd +#endif + nbytes <- fdReadBuf fd buf (fromIntegral tunReadBufferLength) + snd <$> BA.allocRet (fromIntegral nbytes) + (\ptr -> copyMemory ptr buf nbytes >> zeroMemory buf nbytes) + +writeFd :: BA.ByteArrayAccess ba => Fd -> ba -> IO () +writeFd fd ba = BA.withByteArray ba $ \ptr -> do +#ifdef OS_LINUX + threadWaitWrite fd +#endif + void $ fdWriteBuf fd ptr (fromIntegral (BA.length ba)) diff --git a/src/Network/WireGuard/UdpListener.hs b/src/Network/WireGuard/UdpListener.hs new file mode 100644 index 0000000..77b8ae0 --- /dev/null +++ b/src/Network/WireGuard/UdpListener.hs @@ -0,0 +1,61 @@ +{-# LANGUAGE OverloadedStrings #-} + +module Network.WireGuard.UdpListener + ( runUdpListener + ) where + +import Control.Concurrent.Async (cancel, wait, + withAsync) +import Control.Concurrent.STM.TVar (TVar, readTVar) +import Control.Exception (bracket) +import Control.Monad (forever, void) +import Control.Monad.STM (STM, atomically, retry) +import Data.Streaming.Network (bindPortUDP, + bindRandomPortUDP) +import Network.Socket (Socket, close) +import Network.Socket.ByteString (recvFrom, sendTo) + +import Network.WireGuard.Internal.State (Device (..)) + +import Network.WireGuard.Internal.Constant +import Network.WireGuard.Internal.PacketQueue +import Network.WireGuard.Internal.Types +import Network.WireGuard.Internal.Util + +runUdpListener :: Device -> PacketQueue UdpPacket -> PacketQueue UdpPacket -> IO () +runUdpListener device readUdpChan writeUdpChan = loop 0 + where + loop oport = + withAsync (handlePort oport readUdpChan writeUdpChan) $ \t -> do + nport <- atomically $ waitNewVar oport (port device) + cancel t + loop nport + +handlePort :: Int -> PacketQueue UdpPacket -> PacketQueue UdpPacket -> IO () +handlePort bindPort readUdpChan writeUdpChan = retryWithBackoff $ + bracket (bind bindPort) close $ \sock -> + withAsync (handleRead sock readUdpChan) $ \rt -> + withAsync (handleWrite sock writeUdpChan) $ \wt -> do + wait rt + wait wt + where + -- TODO: prefer ipv6 binding here + bind 0 = snd <$> bindRandomPortUDP "!4" + bind p = bindPortUDP p "!4" + +handleRead :: Socket -> PacketQueue UdpPacket -> IO () +handleRead sock readUdpChan = forever $ do + packet <- recvFrom sock udpReadBufferLength + void $ atomically $ tryPushPacketQueue readUdpChan packet + +handleWrite :: Socket -> PacketQueue UdpPacket -> IO () +handleWrite sock writeUdpChan = forever $ do + (packet, dest) <- atomically $ popPacketQueue writeUdpChan + void $ sendTo sock packet dest + +waitNewVar :: Eq a => a -> TVar a -> STM a +waitNewVar old tvar = do + now <- readTVar tvar + if now == old + then retry + else return now diff --git a/stack.yaml b/stack.yaml new file mode 100644 index 0000000..aa8f4c0 --- /dev/null +++ b/stack.yaml @@ -0,0 +1,10 @@ +resolver: lts-8.4 +packages: +- '.' +- location: + git: git://github.com/centromere/cacophony.git + commit: b7a8cff36d8966b0e274cdb4a338ef581be0d737 + extra-dep: true +extra-deps: [] +flags: {} +extra-package-dbs: [] -- cgit v1.2.3-59-g8ed1b