diff options
Diffstat (limited to 'src')
30 files changed, 200 insertions, 207 deletions
diff --git a/src/configuration/config.rs b/src/configuration/config.rs index 536d612..636becc 100644 --- a/src/configuration/config.rs +++ b/src/configuration/config.rs @@ -358,11 +358,11 @@ impl<T: tun::Tun, B: udp::PlatformUDP> Configuration for WireGuardConfig<T, B> { for (pk, p) in peers.iter() { // convert the system time to (secs, nano) since epoch - let last_handshake_time = (*p.walltime_last_handshake.lock()).and_then(|t| { + let last_handshake_time = (*p.walltime_last_handshake.lock()).map(|t| { let duration = t .duration_since(SystemTime::UNIX_EPOCH) - .unwrap_or(Duration::from_secs(0)); - Some((duration.as_secs(), duration.subsec_nanos() as u64)) + .unwrap_or_else(|_| Duration::from_secs(0)); + (duration.as_secs(), duration.subsec_nanos() as u64) }); if let Some(psk) = cfg.wireguard.get_psk(&pk) { diff --git a/src/configuration/uapi/get.rs b/src/configuration/uapi/get.rs index 00048cd..8ca9d64 100644 --- a/src/configuration/uapi/get.rs +++ b/src/configuration/uapi/get.rs @@ -1,4 +1,3 @@ -use log; use std::io; use super::Configuration; @@ -8,10 +7,10 @@ pub fn serialize<C: Configuration, W: io::Write>(writer: &mut W, config: &C) -> debug_assert!(value.is_ascii()); debug_assert!(key.is_ascii()); log::trace!("UAPI: return : {}={}", key, value); - writer.write(key.as_ref())?; - writer.write(b"=")?; - writer.write(value.as_ref())?; - writer.write(b"\n") + writer.write_all(key.as_ref())?; + writer.write_all(b"=")?; + writer.write_all(value.as_ref())?; + writer.write_all(b"\n") }; // serialize interface diff --git a/src/configuration/uapi/mod.rs b/src/configuration/uapi/mod.rs index 9f54775..63a8d5f 100644 --- a/src/configuration/uapi/mod.rs +++ b/src/configuration/uapi/mod.rs @@ -1,7 +1,6 @@ mod get; mod set; -use log; use std::io::{Read, Write}; use super::{ConfigError, Configuration}; @@ -20,7 +19,7 @@ pub fn handle<S: Read + Write, C: Configuration>(stream: &mut S, config: &C) { fn readline<R: Read>(reader: &mut R) -> Result<String, ConfigError> { let mut m: [u8; 1] = [0u8]; let mut l: String = String::with_capacity(MAX_LINE_LENGTH); - while let Ok(_) = reader.read_exact(&mut m) { + while reader.read_exact(&mut m).is_ok() { let c = m[0] as char; if c == '\n' { log::trace!("UAPI, line: {}", l); @@ -31,12 +30,12 @@ pub fn handle<S: Read + Write, C: Configuration>(stream: &mut S, config: &C) { return Err(ConfigError::LineTooLong); } } - return Err(ConfigError::IOError); + Err(ConfigError::IOError) } // split into (key, value) pair - fn keypair<'a>(ln: &'a str) -> Result<(&'a str, &'a str), ConfigError> { - let mut split = ln.splitn(2, "="); + fn keypair(ln: &str) -> Result<(&str, &str), ConfigError> { + let mut split = ln.splitn(2, '='); match (split.next(), split.next()) { (Some(key), Some(value)) => Ok((key, value)), _ => Err(ConfigError::LineTooLong), diff --git a/src/configuration/uapi/set.rs b/src/configuration/uapi/set.rs index ca0b59a..665f090 100644 --- a/src/configuration/uapi/set.rs +++ b/src/configuration/uapi/set.rs @@ -220,7 +220,7 @@ impl<'a, C: Configuration> LineParser<'a, C> { // opt add allowed ips "allowed_ip" => { - let mut split = value.splitn(2, "/"); + let mut split = value.splitn(2, '/'); let addr = split.next().and_then(|x| x.parse().ok()); let cidr = split.next().and_then(|x| x.parse().ok()); match (addr, cidr) { diff --git a/src/main.rs b/src/main.rs index 45fe636..7e752bd 100644 --- a/src/main.rs +++ b/src/main.rs @@ -14,8 +14,6 @@ mod wireguard; mod util; -use log; - use std::env; use std::process::exit; use std::thread; diff --git a/src/platform/linux/tun.rs b/src/platform/linux/tun.rs index 15ca1ec..82fada1 100644 --- a/src/platform/linux/tun.rs +++ b/src/platform/linux/tun.rs @@ -1,7 +1,5 @@ use super::super::tun::*; -use libc; - use std::error::Error; use std::fmt; use std::mem; @@ -9,7 +7,7 @@ use std::os::raw::c_short; use std::os::unix::io::RawFd; const TUNSETIFF: u64 = 0x4004_54ca; -const CLONE_DEVICE_PATH: &'static [u8] = b"/dev/net/tun\0"; +const CLONE_DEVICE_PATH: &[u8] = b"/dev/net/tun\0"; #[repr(C)] struct Ifreq { @@ -75,11 +73,11 @@ impl fmt::Display for LinuxTunError { } impl Error for LinuxTunError { - fn description(&self) -> &str { + fn source(&self) -> Option<&(dyn Error + 'static)> { unimplemented!() } - fn source(&self) -> Option<&(dyn Error + 'static)> { + fn description(&self) -> &str { unimplemented!() } } @@ -156,7 +154,7 @@ fn get_mtu(name: &[u8; libc::IFNAMSIZ]) -> Result<usize, LinuxTunError> { mtu: 0, }; let err = unsafe { - let ptr: &libc::c_void = mem::transmute(&buf); + let ptr: &libc::c_void = &*(&buf as *const _ as *const libc::c_void); libc::ioctl(fd, libc::SIOCGIFMTU, ptr) }; @@ -312,14 +310,15 @@ impl LinuxTunStatus { } impl Tun for LinuxTun { - type Error = LinuxTunError; - type Reader = LinuxTunReader; type Writer = LinuxTunWriter; + type Reader = LinuxTunReader; + type Error = LinuxTunError; } impl PlatformTun for LinuxTun { type Status = LinuxTunStatus; + #[allow(clippy::type_complexity)] fn create(name: &str) -> Result<(Vec<Self::Reader>, Self::Writer, Self::Status), Self::Error> { // construct request struct let mut req = Ifreq { diff --git a/src/platform/linux/udp.rs b/src/platform/linux/udp.rs index e76c2a8..b62d5bf 100644 --- a/src/platform/linux/udp.rs +++ b/src/platform/linux/udp.rs @@ -1,8 +1,6 @@ use super::super::udp::*; use super::super::Endpoint; -use log; - use std::convert::TryInto; use std::io; use std::mem; @@ -132,19 +130,6 @@ fn safe_cast<T, D>(v: &mut T) -> *mut D { } impl Endpoint for LinuxEndpoint { - fn clear_src(&mut self) { - match self { - LinuxEndpoint::V4(EndpointV4 { ref mut info, .. }) => { - info.ipi_ifindex = 0; - info.ipi_spec_dst = libc::in_addr { s_addr: 0 }; - } - LinuxEndpoint::V6(EndpointV6 { ref mut info, .. }) => { - info.ipi6_addr = libc::in6_addr { s6_addr: [0; 16] }; - info.ipi6_ifindex = 0; - } - }; - } - fn from_address(addr: SocketAddr) -> Self { match addr { SocketAddr::V4(addr) => LinuxEndpoint::V4(EndpointV4 { @@ -196,6 +181,19 @@ impl Endpoint for LinuxEndpoint { )), } } + + fn clear_src(&mut self) { + match self { + LinuxEndpoint::V4(EndpointV4 { ref mut info, .. }) => { + info.ipi_ifindex = 0; + info.ipi_spec_dst = libc::in_addr { s_addr: 0 }; + } + LinuxEndpoint::V6(EndpointV6 { ref mut info, .. }) => { + info.ipi6_addr = libc::in6_addr { s6_addr: [0; 16] }; + info.ipi6_ifindex = 0; + } + }; + } } impl LinuxUDPReader { @@ -206,7 +204,7 @@ impl LinuxUDPReader { buf.len() ); - debug_assert!(buf.len() > 0, "reading into empty buffer (will fail)"); + debug_assert!(!buf.is_empty(), "reading into empty buffer (will fail)"); let mut iovs: [libc::iovec; 1] = [libc::iovec { iov_base: buf.as_mut_ptr() as *mut core::ffi::c_void, @@ -260,7 +258,7 @@ impl LinuxUDPReader { buf.len() ); - debug_assert!(buf.len() > 0, "reading into empty buffer (will fail)"); + debug_assert!(!buf.is_empty(), "reading into empty buffer (will fail)"); let mut iovs: [libc::iovec; 1] = [libc::iovec { iov_base: buf.as_mut_ptr() as *mut core::ffi::c_void, @@ -366,14 +364,14 @@ impl LinuxUDPWriter { hdr.msg_control = ptr::null_mut(); hdr.msg_controllen = 0; dst.info = unsafe { mem::zeroed() }; - if unsafe { libc::sendmsg(fd, &hdr, 0) } < 0 { - return Err(io::Error::new( + return if unsafe { libc::sendmsg(fd, &hdr, 0) } < 0 { + Err(io::Error::new( io::ErrorKind::NotConnected, "failed to send IPv6 packet", - )); + )) } else { - return Ok(()); - } + Ok(()) + }; } return Err(io::Error::new( io::ErrorKind::NotConnected, @@ -431,14 +429,14 @@ impl LinuxUDPWriter { hdr.msg_control = ptr::null_mut(); hdr.msg_controllen = 0; dst.info = unsafe { mem::zeroed() }; - if unsafe { libc::sendmsg(fd, &hdr, 0) } < 0 { - return Err(io::Error::new( + return if unsafe { libc::sendmsg(fd, &hdr, 0) } < 0 { + Err(io::Error::new( io::ErrorKind::NotConnected, "failed to send IPv4 packet", - )); + )) } else { - return Ok(()); - } + Ok(()) + }; } return Err(io::Error::new( io::ErrorKind::NotConnected, @@ -485,22 +483,26 @@ impl Owner for LinuxOwner { impl Drop for LinuxOwner { fn drop(&mut self) { log::debug!("closing the bind (port = {})", self.port); - self.sock4.as_ref().map(|fd| unsafe { + if let Some(fd) = &self.sock4 { log::debug!("shutdown IPv4 (fd = {})", fd.0); - libc::shutdown(fd.0, libc::SHUT_RDWR); - }); - self.sock6.as_ref().map(|fd| unsafe { + unsafe { + libc::shutdown(fd.0, libc::SHUT_RDWR); + } + }; + if let Some(fd) = &self.sock6 { log::debug!("shutdown IPv6 (fd = {})", fd.0); - libc::shutdown(fd.0, libc::SHUT_RDWR); - }); + unsafe { + libc::shutdown(fd.0, libc::SHUT_RDWR); + } + }; } } impl UDP for LinuxUDP { type Error = io::Error; type Endpoint = LinuxEndpoint; - type Reader = LinuxUDPReader; type Writer = LinuxUDPWriter; + type Reader = LinuxUDPReader; } impl LinuxUDP { @@ -580,7 +582,7 @@ impl LinuxUDP { debug_assert_eq!(sockaddr.sin6_family, libc::AF_INET6 as libc::sa_family_t); debug_assert_eq!(new_port, if port != 0 { port } else { new_port }); log::trace!("bound IPv6 socket (port {}, fd {})", new_port, fd); - return Ok((new_port, fd)); + Ok((new_port, fd)) } /* Bind on all IPv4 interfaces. @@ -657,13 +659,15 @@ impl LinuxUDP { debug_assert_eq!(sockaddr.sin_family, libc::AF_INET as libc::sa_family_t); debug_assert_eq!(new_port, if port != 0 { port } else { new_port }); log::trace!("bound IPv4 socket (port {}, fd {})", new_port, fd); - return Ok((new_port, fd)); + Ok((new_port, fd)) } } impl PlatformUDP for LinuxUDP { type Owner = LinuxOwner; + #[allow(clippy::type_complexity)] + #[allow(clippy::unnecessary_unwrap)] fn bind(mut port: u16) -> Result<(Vec<Self::Reader>, Self::Writer, Self::Owner), Self::Error> { log::debug!("bind to port {}", port); @@ -697,18 +701,18 @@ impl PlatformUDP for LinuxUDP { // create readers let mut readers: Vec<Self::Reader> = Vec::with_capacity(2); - sock6 - .clone() - .map(|sock| readers.push(LinuxUDPReader::V6(sock))); - sock4 - .clone() - .map(|sock| readers.push(LinuxUDPReader::V4(sock))); - debug_assert!(readers.len() > 0); + if let Some(sock) = sock6.clone() { + readers.push(LinuxUDPReader::V6(sock)) + } + if let Some(sock) = sock4.clone() { + readers.push(LinuxUDPReader::V4(sock)) + } + debug_assert!(!readers.is_empty()); // create writer let writer = LinuxUDPWriter { - sock4: sock4.unwrap_or(Arc::new(FD(-1))), - sock6: sock6.unwrap_or(Arc::new(FD(-1))), + sock4: sock4.unwrap_or_else(|| Arc::new(FD(-1))), + sock6: sock6.unwrap_or_else(|| Arc::new(FD(-1))), }; Ok((readers, writer, owner)) diff --git a/src/platform/tun.rs b/src/platform/tun.rs index 801754e..38c95bf 100644 --- a/src/platform/tun.rs +++ b/src/platform/tun.rs @@ -58,5 +58,6 @@ pub trait Tun: Send + Sync + 'static { pub trait PlatformTun: Tun { type Status: Status; + #[allow(clippy::type_complexity)] fn create(name: &str) -> Result<(Vec<Self::Reader>, Self::Writer, Self::Status), Self::Error>; } diff --git a/src/platform/udp.rs b/src/platform/udp.rs index 4098b10..0b9c823 100644 --- a/src/platform/udp.rs +++ b/src/platform/udp.rs @@ -41,5 +41,6 @@ pub trait PlatformUDP: UDP { /// Bind to a new port, returning the reader/writer and /// an associated instance of the owner type, which closes the UDP socket upon "drop" /// and enables configuration of the fwmark value. + #[allow(clippy::type_complexity)] fn bind(port: u16) -> Result<(Vec<Self::Reader>, Self::Writer, Self::Owner), Self::Error>; } diff --git a/src/util.rs b/src/util.rs index dd7a669..e48d781 100644 --- a/src/util.rs +++ b/src/util.rs @@ -1,3 +1,4 @@ +use std::cmp::Ordering; use std::fmt; use std::process::exit; @@ -29,12 +30,10 @@ impl fmt::Display for DaemonizeError { fn fork_and_exit() -> Result<(), DaemonizeError> { let pid = unsafe { fork() }; - if pid < 0 { - Err(DaemonizeError::Fork) - } else if pid == 0 { - Ok(()) - } else { - exit(0); + match pid.cmp(&0) { + Ordering::Less => Err(DaemonizeError::Fork), + Ordering::Equal => Ok(()), + Ordering::Greater => exit(0), } } diff --git a/src/wireguard/handshake/device.rs b/src/wireguard/handshake/device.rs index 5e69921..47ca401 100644 --- a/src/wireguard/handshake/device.rs +++ b/src/wireguard/handshake/device.rs @@ -8,8 +8,8 @@ use dashmap::mapref::entry::Entry; use dashmap::DashMap; use zerocopy::AsBytes; -use rand::prelude::{CryptoRng, RngCore}; use rand::Rng; +use rand_core::{CryptoRng, RngCore}; use clear_on_drop::clear::Clear; @@ -118,7 +118,9 @@ impl<O> Device<O> { } else { peer.ss.clear(); } - peer.reset_state().map(|id| ids.push(id)); + if let Some(id) = peer.reset_state() { + ids.push(id) + } } (ids, same) @@ -212,7 +214,7 @@ impl<O> Device<O> { // remove the peer self.pk_map .remove(pk.as_bytes()) - .ok_or(ConfigError::new("Public key not in device"))?; + .ok_or_else(|| ConfigError::new("Public key not in device"))?; // remove every id entry for the peer in the public key map // O(n) operations, however it is rare: only when removing peers. @@ -389,9 +391,6 @@ impl<O> Device<O> { // address validation & DoS mitigation if let Some(src) = src { - // obtain ref to socket addr - let src = src.into(); - // check mac2 field if !keyst.macs.check_mac2(msg.noise.as_bytes(), &src, &msg.macs) { let mut reply = Default::default(); @@ -471,12 +470,9 @@ impl<O> Device<O> { } // write lock the shard and insert - match self.id_map.entry(id) { - Entry::Vacant(entry) => { - entry.insert(*pk.as_bytes()); - return id; - } - _ => (), + if let Entry::Vacant(entry) = self.id_map.entry(id) { + entry.insert(*pk.as_bytes()); + return id; }; } } diff --git a/src/wireguard/handshake/macs.rs b/src/wireguard/handshake/macs.rs index cb5d7d4..f4f5586 100644 --- a/src/wireguard/handshake/macs.rs +++ b/src/wireguard/handshake/macs.rs @@ -1,5 +1,5 @@ use generic_array::GenericArray; -use rand::{CryptoRng, RngCore}; +use rand_core::{CryptoRng, RngCore}; use spin::RwLock; use std::time::{Duration, Instant}; @@ -8,6 +8,7 @@ use std::net::SocketAddr; use x25519_dalek::PublicKey; // AEAD + use aead::{Aead, NewAead, Payload}; use chacha20poly1305::XChaCha20Poly1305; @@ -33,30 +34,29 @@ macro_rules! HASH { use blake2::Digest; let mut hsh = Blake2s::new(); $( - hsh.input($input); + hsh.update($input); )* - hsh.result() + hsh.finalize() }}; } macro_rules! MAC { ( $key:expr, $($input:expr),* ) => {{ use blake2::VarBlake2s; - use digest::Input; - use digest::VariableOutput; + use blake2::digest::{Update, VariableOutput}; let mut tag = [0u8; SIZE_MAC]; let mut mac = VarBlake2s::new_keyed($key, SIZE_MAC); $( - mac.input($input); + mac.update($input); )* - mac.variable_result(|buf| tag.copy_from_slice(buf)); + mac.finalize_variable(|buf| tag.copy_from_slice(buf)); tag }}; } macro_rules! XSEAL { ($key:expr, $nonce:expr, $ad:expr, $pt:expr, $ct:expr) => {{ - let ct = XChaCha20Poly1305::new(*GenericArray::from_slice($key)) + let ct = XChaCha20Poly1305::new(GenericArray::from_slice($key)) .encrypt( GenericArray::from_slice($nonce), Payload { msg: $pt, aad: $ad }, @@ -70,7 +70,7 @@ macro_rules! XSEAL { macro_rules! XOPEN { ($key:expr, $nonce:expr, $ad:expr, $pt:expr, $ct:expr) => {{ debug_assert_eq!($ct.len(), $pt.len() + SIZE_TAG); - XChaCha20Poly1305::new(*GenericArray::from_slice($key)) + XChaCha20Poly1305::new(GenericArray::from_slice($key)) .decrypt( GenericArray::from_slice($nonce), Payload { msg: $ct, aad: $ad }, @@ -141,6 +141,7 @@ impl Generator { pub fn process(&mut self, reply: &CookieReply) -> Result<(), HandshakeError> { let mac1 = self.last_mac1.ok_or(HandshakeError::InvalidState)?; let mut tau = [0u8; SIZE_COOKIE]; + #[allow(clippy::unnecessary_mut_passed)] XOPEN!( &self.cookie_key, // key &reply.f_nonce, // nonce diff --git a/src/wireguard/handshake/noise.rs b/src/wireguard/handshake/noise.rs index 4141cb9..92c8c5f 100644 --- a/src/wireguard/handshake/noise.rs +++ b/src/wireguard/handshake/noise.rs @@ -11,15 +11,13 @@ use hmac::Hmac; use aead::{Aead, NewAead, Payload}; use chacha20poly1305::ChaCha20Poly1305; -use log; - -use rand::prelude::{CryptoRng, RngCore}; +use rand_core::{CryptoRng, RngCore}; use generic_array::typenum::*; use generic_array::*; use clear_on_drop::clear::Clear; -use clear_on_drop::clear_stack_on_return; +use clear_on_drop::clear_stack_on_return_fnonce; use subtle::ConstantTimeEq; @@ -65,20 +63,20 @@ macro_rules! HASH { use blake2::Digest; let mut hsh = Blake2s::new(); $( - hsh.input($input); + hsh.update($input); )* - hsh.result() + hsh.finalize() }}; } macro_rules! HMAC { ($key:expr, $($input:expr),*) => {{ - use hmac::Mac; + use hmac::{Mac, NewMac}; let mut mac = HMACBlake2s::new_varkey($key).unwrap(); $( - mac.input($input); + mac.update($input); )* - mac.result().code() + mac.finalize().into_bytes() }}; } @@ -114,7 +112,7 @@ macro_rules! KDF3 { macro_rules! SEAL { ($key:expr, $ad:expr, $pt:expr, $ct:expr) => { - ChaCha20Poly1305::new(*GenericArray::from_slice($key)) + ChaCha20Poly1305::new(GenericArray::from_slice($key)) .encrypt(&ZERO_NONCE.into(), Payload { msg: $pt, aad: $ad }) .map(|ct| $ct.copy_from_slice(&ct)) .unwrap() @@ -123,7 +121,7 @@ macro_rules! SEAL { macro_rules! OPEN { ($key:expr, $ad:expr, $pt:expr, $ct:expr) => { - ChaCha20Poly1305::new(*GenericArray::from_slice($key)) + ChaCha20Poly1305::new(GenericArray::from_slice($key)) .decrypt(&ZERO_NONCE.into(), Payload { msg: $ct, aad: $ad }) .map_err(|_| HandshakeError::DecryptionFailure) .map(|pt| $pt.copy_from_slice(&pt)) @@ -244,7 +242,7 @@ pub(super) fn create_initiation<R: RngCore + CryptoRng, O>( return Err(HandshakeError::InvalidSharedSecret); } - clear_stack_on_return(CLEAR_PAGES, || { + clear_stack_on_return_fnonce(CLEAR_PAGES, || { // initialize state let ck = INITIAL_CK; @@ -325,7 +323,7 @@ pub(super) fn consume_initiation<'a, O>( ) -> Result<(&'a Peer<O>, PublicKey, TemporaryState), HandshakeError> { log::debug!("consume initiation"); - clear_stack_on_return(CLEAR_PAGES, || { + clear_stack_on_return_fnonce(CLEAR_PAGES, || { // initialize new state let ck = INITIAL_CK; @@ -414,7 +412,7 @@ pub(super) fn create_response<R: RngCore + CryptoRng, O>( msg: &mut NoiseResponse, // resulting response ) -> Result<KeyPair, HandshakeError> { log::debug!("create response"); - clear_stack_on_return(CLEAR_PAGES, || { + clear_stack_on_return_fnonce(CLEAR_PAGES, || { // unpack state let (receiver, eph_r_pk, hs, ck) = state; @@ -499,7 +497,7 @@ pub(super) fn consume_response<'a, O>( msg: &NoiseResponse, ) -> Result<Output<'a, O>, HandshakeError> { log::debug!("consume response"); - clear_stack_on_return(CLEAR_PAGES, || { + clear_stack_on_return_fnonce(CLEAR_PAGES, || { // retrieve peer and copy initiation state let (peer, _) = device.lookup_id(msg.f_receiver.get())?; diff --git a/src/wireguard/handshake/peer.rs b/src/wireguard/handshake/peer.rs index 1636e62..f847725 100644 --- a/src/wireguard/handshake/peer.rs +++ b/src/wireguard/handshake/peer.rs @@ -50,13 +50,10 @@ pub enum State { impl Drop for State { fn drop(&mut self) { - match self { - State::InitiationSent { hs, ck, .. } => { - // eph_sk already cleared by dalek-x25519 - hs.clear(); - ck.clear(); - } - _ => (), + if let State::InitiationSent { hs, ck, .. } = self { + // eph_sk already cleared by dalek-x25519 + hs.clear(); + ck.clear(); } } } @@ -97,29 +94,22 @@ impl<O> Peer<O> { let mut last_initiation_consumption = self.last_initiation_consumption.lock(); // check replay attack - match *timestamp { - Some(timestamp_old) => { - if !timestamp::compare(×tamp_old, ×tamp_new) { - return Err(HandshakeError::OldTimestamp); - } + if let Some(timestamp_old) = *timestamp { + if !timestamp::compare(×tamp_old, ×tamp_new) { + return Err(HandshakeError::OldTimestamp); } - _ => (), }; // check flood attack - match *last_initiation_consumption { - Some(last) => { - if last.elapsed() < TIME_BETWEEN_INITIATIONS { - return Err(HandshakeError::InitiationFlood); - } + if let Some(last) = *last_initiation_consumption { + if last.elapsed() < TIME_BETWEEN_INITIATIONS { + return Err(HandshakeError::InitiationFlood); } - _ => (), } // reset state - match *state { - State::InitiationSent { local, .. } => device.release(local), - _ => (), + if let State::InitiationSent { local, .. } = *state { + device.release(local) } // update replay & flood protection diff --git a/src/wireguard/handshake/ratelimiter.rs b/src/wireguard/handshake/ratelimiter.rs index 89109e9..9e796a0 100644 --- a/src/wireguard/handshake/ratelimiter.rs +++ b/src/wireguard/handshake/ratelimiter.rs @@ -5,8 +5,6 @@ use std::sync::{Arc, Condvar, Mutex}; use std::thread; use std::time::{Duration, Instant}; -use spin; - const PACKETS_PER_SECOND: u64 = 20; const PACKETS_BURSTABLE: u64 = 5; const PACKET_COST: u64 = 1_000_000_000 / PACKETS_PER_SECOND; @@ -39,6 +37,7 @@ impl Drop for RateLimiter { impl RateLimiter { pub fn new() -> Self { + #[allow(clippy::mutex_atomic)] RateLimiter(Arc::new(RateLimiterInner { gc_dropped: (Mutex::new(false), Condvar::new()), gc_running: AtomicBool::from(false), @@ -145,7 +144,7 @@ mod tests { expected.push(Result { allowed: true, wait: Duration::new(0, 0), - text: "inital burst", + text: "initial burst", }); } diff --git a/src/wireguard/handshake/tests.rs b/src/wireguard/handshake/tests.rs index 5174d2e..35ff152 100644 --- a/src/wireguard/handshake/tests.rs +++ b/src/wireguard/handshake/tests.rs @@ -6,8 +6,8 @@ use std::time::Duration; use hex; -use rand::prelude::{CryptoRng, RngCore}; use rand::rngs::OsRng; +use rand_core::{CryptoRng, RngCore}; use x25519_dalek::PublicKey; use x25519_dalek::StaticSecret; @@ -15,20 +15,22 @@ use x25519_dalek::StaticSecret; use super::messages::{Initiation, Response}; fn setup_devices<R: RngCore + CryptoRng, O: Default>( - rng: &mut R, + rng1: &mut R, + rng2: &mut R, + rng3: &mut R, ) -> (PublicKey, Device<O>, PublicKey, Device<O>) { // generate new key pairs - let sk1 = StaticSecret::new(rng); + let sk1 = StaticSecret::new(rng1); let pk1 = PublicKey::from(&sk1); - let sk2 = StaticSecret::new(rng); + let sk2 = StaticSecret::new(rng2); let pk2 = PublicKey::from(&sk2); // pick random psk let mut psk = [0u8; 32]; - rng.fill_bytes(&mut psk[..]); + rng3.fill_bytes(&mut psk[..]); // initialize devices on both ends @@ -63,7 +65,8 @@ fn wait() { */ #[test] fn handshake_under_load() { - let (_pk1, dev1, pk2, dev2): (_, Device<usize>, _, _) = setup_devices(&mut OsRng); + let (_pk1, dev1, pk2, dev2): (_, Device<usize>, _, _) = + setup_devices(&mut OsRng, &mut OsRng, &mut OsRng); let src1: SocketAddr = "172.16.0.1:8080".parse().unwrap(); let src2: SocketAddr = "172.16.0.2:7070".parse().unwrap(); @@ -140,7 +143,8 @@ fn handshake_under_load() { #[test] fn handshake_no_load() { - let (pk1, mut dev1, pk2, mut dev2): (_, Device<usize>, _, _) = setup_devices(&mut OsRng); + let (pk1, mut dev1, pk2, mut dev2): (_, Device<usize>, _, _) = + setup_devices(&mut OsRng, &mut OsRng, &mut OsRng); // do a few handshakes (every handshake should succeed) diff --git a/src/wireguard/handshake/timestamp.rs b/src/wireguard/handshake/timestamp.rs index b5bd9f0..485bb8d 100644 --- a/src/wireguard/handshake/timestamp.rs +++ b/src/wireguard/handshake/timestamp.rs @@ -28,5 +28,5 @@ pub fn compare(old: &TAI64N, new: &TAI64N) -> bool { return true; } } - return false; + false } diff --git a/src/wireguard/mod.rs b/src/wireguard/mod.rs index ca17737..e79a250 100644 --- a/src/wireguard/mod.rs +++ b/src/wireguard/mod.rs @@ -1,12 +1,11 @@ -/* The wireguard sub-module represents a full, pure, WireGuard implementation: - * - * The WireGuard device described here does not depend on particular IO implementations - * or UAPI, and can be instantiated in unit-tests with the dummy IO implementation. - * - * The code at this level serves to "glue" the handshake state-machine - * and the crypto-key router code together, - * e.g. every WireGuard peer consists of a handshake and router peer. - */ +/// The wireguard sub-module represents a full, pure, WireGuard implementation: +/// +/// The WireGuard device described here does not depend on particular IO implementations +/// or UAPI, and can be instantiated in unit-tests with the dummy IO implementation. +/// +/// The code at this level serves to "glue" the handshake state-machine +/// and the crypto-key router code together, +/// e.g. every WireGuard peer consists of one handshake peer and one router peer. mod constants; mod handshake; mod peer; @@ -14,12 +13,14 @@ mod queue; mod router; mod timers; mod types; -mod wireguard; mod workers; #[cfg(test)] mod tests; +#[allow(clippy::module_inception)] +mod wireguard; + // represents a WireGuard interface pub use wireguard::WireGuard; diff --git a/src/wireguard/peer.rs b/src/wireguard/peer.rs index 37b4684..170d2b1 100644 --- a/src/wireguard/peer.rs +++ b/src/wireguard/peer.rs @@ -26,7 +26,7 @@ pub struct PeerInner<T: Tun, B: UDP> { pub pk: PublicKey, // handshake state - pub walltime_last_handshake: Mutex<Option<SystemTime>>, // walltime for last handshake (for UAPI status) + pub walltime_last_handshake: Mutex<Option<SystemTime>>, /* walltime for last handshake (for UAPI status) */ pub last_handshake_sent: Mutex<Instant>, // instant for last handshake pub handshake_queued: AtomicBool, // is a handshake job currently queued? diff --git a/src/wireguard/queue.rs b/src/wireguard/queue.rs index 75b9104..f9e4150 100644 --- a/src/wireguard/queue.rs +++ b/src/wireguard/queue.rs @@ -12,7 +12,6 @@ impl<T> ParallelQueue<T> { /// /// - `queues`: number of readers /// - `capacity`: capacity of each internal queue - /// pub fn new(queues: usize, capacity: usize) -> (Self, Vec<Receiver<T>>) { let mut receivers = Vec::with_capacity(queues); let (tx, rx) = bounded(capacity); @@ -28,9 +27,9 @@ impl<T> ParallelQueue<T> { } pub fn send(&self, v: T) { - self.queue.lock().unwrap().as_ref().map(|s| { + if let Some(s) = self.queue.lock().unwrap().as_ref() { let _ = s.send(v); - }); + } } pub fn close(&self) { diff --git a/src/wireguard/router/device.rs b/src/wireguard/router/device.rs index 62ef932..eeae621 100644 --- a/src/wireguard/router/device.rs +++ b/src/wireguard/router/device.rs @@ -4,7 +4,6 @@ use std::sync::atomic::AtomicBool; use std::sync::Arc; use std::thread; -use log; use spin::{Mutex, RwLock}; use zerocopy::LayoutVerified; @@ -31,7 +30,8 @@ pub struct DeviceInner<E: Endpoint, C: Callbacks, T: tun::Writer, B: udp::Writer pub(super) outbound: RwLock<(bool, Option<B>)>, // routing - pub(super) recv: RwLock<HashMap<u32, Arc<DecryptionState<E, C, T, B>>>>, // receiver id -> decryption state + #[allow(clippy::type_complexity)] + pub(super) recv: RwLock<HashMap<u32, Arc<DecryptionState<E, C, T, B>>>>, /* receiver id -> decryption state */ pub(super) table: RoutingTable<Peer<E, C, T, B>>, // work queue @@ -141,7 +141,7 @@ impl<E: Endpoint, C: Callbacks, T: tun::Writer, B: udp::Writer<E>> DeviceHandle< return bind.write(msg, dst); } } - return Ok(()); + Ok(()) } /// Brings the router down. @@ -178,7 +178,6 @@ impl<E: Endpoint, C: Callbacks, T: tun::Writer, B: udp::Writer<E>> DeviceHandle< /// # Arguments /// /// - msg: IP packet to crypt-key route - /// pub fn send(&self, msg: Vec<u8>) -> Result<(), RouterError> { debug_assert!(msg.len() > SIZE_MESSAGE_PREFIX); log::trace!( @@ -209,8 +208,6 @@ impl<E: Endpoint, C: Callbacks, T: tun::Writer, B: udp::Writer<E>> DeviceHandle< /// - msg: Encrypted transport message /// /// # Returns - /// - /// pub fn recv(&self, src: E, msg: Vec<u8>) -> Result<(), RouterError> { log::trace!("receive, src: {}", src.into_address()); @@ -253,8 +250,6 @@ impl<E: Endpoint, C: Callbacks, T: tun::Writer, B: udp::Writer<E>> DeviceHandle< } /// Set outbound writer - /// - /// pub fn set_outbound_writer(&self, new: B) { self.state.outbound.write().1 = Some(new); } diff --git a/src/wireguard/router/peer.rs b/src/wireguard/router/peer.rs index d960da0..0803b13 100644 --- a/src/wireguard/router/peer.rs +++ b/src/wireguard/router/peer.rs @@ -26,7 +26,6 @@ use std::fmt; use std::net::{IpAddr, SocketAddr}; use arraydeque::{ArrayDeque, Wrapping}; -use log; use spin::Mutex; pub struct KeyWheel { @@ -155,11 +154,17 @@ impl<E: Endpoint, C: Callbacks, T: tun::Writer, B: udp::Writer<E>> Drop for Peer let mut keys = peer.keys.lock(); let mut release = Vec::with_capacity(3); - keys.next.as_ref().map(|k| release.push(k.recv.id)); - keys.current.as_ref().map(|k| release.push(k.recv.id)); - keys.previous.as_ref().map(|k| release.push(k.recv.id)); + if let Some(k) = keys.next.as_ref() { + release.push(k.recv.id) + } + if let Some(k) = keys.current.as_ref() { + release.push(k.recv.id) + } + if let Some(k) = keys.previous.as_ref() { + release.push(k.recv.id) + } - if release.len() > 0 { + if !release.is_empty() { let mut recv = peer.device.recv.write(); for id in &release { recv.remove(id); @@ -185,7 +190,6 @@ pub fn new_peer<E: Endpoint, C: Callbacks, T: tun::Writer, B: udp::Writer<E>>( ) -> PeerHandle<E, C, T, B> { // allocate peer object let peer = { - let device = device.clone(); Peer { inner: Arc::new(PeerInner { opaque, @@ -245,7 +249,6 @@ impl<E: Endpoint, C: Callbacks, T: tun::Writer, B: udp::Writer<E>> Peer<E, C, T, /// /// - `msg` : A padded vector holding the message (allows in-place construction of the transport header) /// - `stage`: Should the message be staged if no key is available - /// pub(super) fn send(&self, msg: Vec<u8>, stage: bool) { // check if key available let (job, need_key) = { @@ -385,9 +388,15 @@ impl<E: Endpoint, C: Callbacks, T: tun::Writer, B: udp::Writer<E>> PeerHandle<E, // update key-wheel - mem::replace(&mut keys.next, None).map(|k| release.push(k.local_id())); - mem::replace(&mut keys.current, None).map(|k| release.push(k.local_id())); - mem::replace(&mut keys.previous, None).map(|k| release.push(k.local_id())); + if let Some(k) = mem::replace(&mut keys.next, None) { + release.push(k.local_id()) + } + if let Some(k) = mem::replace(&mut keys.current, None) { + release.push(k.local_id()) + } + if let Some(k) = mem::replace(&mut keys.previous, None) { + release.push(k.local_id()) + } keys.retired.extend(&release[..]); // update inbound "recv" map @@ -439,11 +448,11 @@ impl<E: Endpoint, C: Callbacks, T: tun::Writer, B: udp::Writer<E>> PeerHandle<E, *self.peer.enc_key.lock() = Some(EncryptionState::new(&new)); // move current into previous - keys.previous = keys.current.as_ref().map(|v| v.clone()); + keys.previous = keys.current.as_ref().cloned(); keys.current = Some(new.clone()); } else { // store the key and await confirmation - keys.previous = keys.next.as_ref().map(|v| v.clone()); + keys.previous = keys.next.as_ref().cloned(); keys.next = Some(new.clone()); }; @@ -453,10 +462,10 @@ impl<E: Endpoint, C: Callbacks, T: tun::Writer, B: udp::Writer<E>> PeerHandle<E, let mut recv = self.peer.device.recv.write(); // purge recv map of previous id - keys.previous.as_ref().map(|k| { + if let Some(k) = &keys.previous { recv.remove(&k.local_id()); release.push(k.local_id()); - }); + } // map new id to decryption state debug_assert!(!recv.contains_key(&new.recv.id)); @@ -531,7 +540,9 @@ impl<E: Endpoint, C: Callbacks, T: tun::Writer, B: udp::Writer<E>> PeerHandle<E, } pub fn clear_src(&self) { - (*self.peer.endpoint.lock()).as_mut().map(|e| e.clear_src()); + if let Some(e) = (*self.peer.endpoint.lock()).as_mut() { + e.clear_src() + } } pub fn purge_staged_packets(&self) { diff --git a/src/wireguard/router/queue.rs b/src/wireguard/router/queue.rs index d5d657a..b266a57 100644 --- a/src/wireguard/router/queue.rs +++ b/src/wireguard/router/queue.rs @@ -67,9 +67,7 @@ impl<J: SequentialJob> Queue<J> { match queue.front() { None => break, Some(job) => { - if job.is_ready() { - () - } else { + if !job.is_ready() { break; } } diff --git a/src/wireguard/router/route.rs b/src/wireguard/router/route.rs index a556010..7e50153 100644 --- a/src/wireguard/router/route.rs +++ b/src/wireguard/router/route.rs @@ -88,7 +88,7 @@ impl<T: Eq + Clone> RoutingTable<T> { self.ipv4 .read() .longest_match(Ipv4Addr::from(header.f_destination)) - .and_then(|(_, _, p)| Some(p.clone())) + .map(|(_, _, p)| p.clone()) } VERSION_IP6 => { // check length and cast to IPv6 header @@ -104,7 +104,7 @@ impl<T: Eq + Clone> RoutingTable<T> { self.ipv6 .read() .longest_match(Ipv6Addr::from(header.f_destination)) - .and_then(|(_, _, p)| Some(p.clone())) + .map(|(_, _, p)| p.clone()) } v => { log::trace!("router, invalid IP version {}", v); diff --git a/src/wireguard/router/tests/bench.rs b/src/wireguard/router/tests/bench.rs index 948a156..c2334b3 100644 --- a/src/wireguard/router/tests/bench.rs +++ b/src/wireguard/router/tests/bench.rs @@ -25,6 +25,7 @@ struct TransmissionCounter { } impl TransmissionCounter { + #[allow(dead_code)] fn new() -> TransmissionCounter { TransmissionCounter { sent: AtomicUsize::new(0), @@ -32,15 +33,18 @@ impl TransmissionCounter { } } + #[allow(dead_code)] fn reset(&self) { self.sent.store(0, Ordering::SeqCst); self.recv.store(0, Ordering::SeqCst); } + #[allow(dead_code)] fn sent(&self) -> usize { self.sent.load(Ordering::Acquire) } + #[allow(dead_code)] fn recv(&self) -> usize { self.recv.load(Ordering::Acquire) } diff --git a/src/wireguard/router/types.rs b/src/wireguard/router/types.rs index e0cd459..e44963f 100644 --- a/src/wireguard/router/types.rs +++ b/src/wireguard/router/types.rs @@ -15,16 +15,16 @@ impl<T> Opaque for T where T: Send + Sync + 'static {} /// * `0`, a reference to the opaque value assigned to the peer /// * `1`, a bool indicating whether the message contained data (not just keepalive) /// * `2`, a bool indicating whether the message was transmitted (i.e. did the peer have an associated endpoint?) -pub trait Callback<T>: Fn(&T, usize, bool) -> () + Sync + Send + 'static {} +pub trait Callback<T>: Fn(&T, usize, bool) + Sync + Send + 'static {} -impl<T, F> Callback<T> for F where F: Fn(&T, usize, bool) -> () + Sync + Send + 'static {} +impl<T, F> Callback<T> for F where F: Fn(&T, usize, bool) + Sync + Send + 'static {} /// A key callback takes 1 argument /// /// * `0`, a reference to the opaque value assigned to the peer -pub trait KeyCallback<T>: Fn(&T) -> () + Sync + Send + 'static {} +pub trait KeyCallback<T>: Fn(&T) + Sync + Send + 'static {} -impl<T, F> KeyCallback<T> for F where F: Fn(&T) -> () + Sync + Send + 'static {} +impl<T, F> KeyCallback<T> for F where F: Fn(&T) + Sync + Send + 'static {} pub trait Callbacks: Send + Sync + 'static { type Opaque: Opaque; @@ -58,11 +58,11 @@ impl fmt::Display for RouterError { } impl Error for RouterError { - fn description(&self) -> &str { - "Generic Handshake Error" - } - fn source(&self) -> Option<&(dyn Error + 'static)> { None } + + fn description(&self) -> &str { + "Generic Handshake Error" + } } diff --git a/src/wireguard/router/worker.rs b/src/wireguard/router/worker.rs index 4913a21..99c2a1d 100644 --- a/src/wireguard/router/worker.rs +++ b/src/wireguard/router/worker.rs @@ -6,7 +6,6 @@ use super::super::{tun, udp, Endpoint}; use super::types::Callbacks; use crossbeam_channel::Receiver; -use log; pub enum JobUnion<E: Endpoint, C: Callbacks, T: tun::Writer, B: udp::Writer<E>> { Outbound(SendJob<E, C, T, B>), diff --git a/src/wireguard/timers.rs b/src/wireguard/timers.rs index 94a95ab..be0f5f9 100644 --- a/src/wireguard/timers.rs +++ b/src/wireguard/timers.rs @@ -268,7 +268,6 @@ impl Timers { handshake_attempts: AtomicUsize::new(0), retransmit_handshake: { let wg = wg.clone(); - let pk = pk.clone(); runner.timer(move || { // fetch peer by public key fetch_peer!(wg, pk, peer); @@ -300,7 +299,6 @@ impl Timers { }, send_keepalive: { let wg = wg.clone(); - let pk = pk.clone(); runner.timer(move || { // fetch peer by public key fetch_peer!(wg, pk, peer); @@ -315,7 +313,6 @@ impl Timers { }, new_handshake: { let wg = wg.clone(); - let pk = pk.clone(); runner.timer(move || { // fetch peer by public key fetch_peer!(wg, pk, peer); @@ -333,7 +330,6 @@ impl Timers { }, zero_key_material: { let wg = wg.clone(); - let pk = pk.clone(); runner.timer(move || { // fetch peer by public key fetch_peer!(wg, pk, peer); @@ -345,7 +341,6 @@ impl Timers { }, send_persistent_keepalive: { let wg = wg.clone(); - let pk = pk.clone(); runner.timer(move || { // fetch peer by public key fetch_peer!(wg, pk, peer); diff --git a/src/wireguard/wireguard.rs b/src/wireguard/wireguard.rs index 9ec7d44..44d698f 100644 --- a/src/wireguard/wireguard.rs +++ b/src/wireguard/wireguard.rs @@ -13,19 +13,20 @@ use super::udp::UDP; use super::workers::{handshake_worker, tun_worker, udp_worker}; use std::fmt; +use std::thread; + use std::ops::Deref; use std::sync::atomic::{AtomicBool, AtomicU64, AtomicUsize, Ordering}; use std::sync::Arc; use std::sync::Condvar; use std::sync::Mutex as StdMutex; -use std::thread; use std::time::Instant; -use hjul::Runner; use rand::rngs::OsRng; use rand::Rng; -use spin::{Mutex, RwLock}; +use hjul::Runner; +use spin::{Mutex, RwLock}; use x25519_dalek::{PublicKey, StaticSecret}; pub struct WireguardInner<T: Tun, B: UDP> { @@ -45,6 +46,7 @@ pub struct WireguardInner<T: Tun, B: UDP> { pub mtu: AtomicUsize, // peer map + #[allow(clippy::type_complexity)] pub peers: RwLock< handshake::Device<router::PeerHandle<B::Endpoint, PeerInner<T, B>, T::Writer, B::Writer>>, >, @@ -85,6 +87,7 @@ impl<T: Tun, B: UDP> Clone for WireGuard<T, B> { } } +#[allow(clippy::mutex_atomic)] impl WaitCounter { pub fn wait(&self) { let mut nread = self.0.lock().unwrap(); @@ -126,7 +129,7 @@ impl<T: Tun, B: UDP> WireGuard<T, B> { let mut enabled = self.enabled.write(); // check if already down - if *enabled == false { + if !(*enabled) { return; } @@ -209,7 +212,7 @@ impl<T: Tun, B: UDP> WireGuard<T, B> { let enabled = self.enabled.read(); // create timers (lookup by public key) - let timers = Timers::new::<T, B>(self.clone(), pk.clone(), *enabled); + let timers = Timers::new::<T, B>(self.clone(), pk, *enabled); // create new router peer let peer: router::PeerHandle<B::Endpoint, PeerInner<T, B>, T::Writer, B::Writer> = diff --git a/src/wireguard/workers.rs b/src/wireguard/workers.rs index b4673cd..27acf2f 100644 --- a/src/wireguard/workers.rs +++ b/src/wireguard/workers.rs @@ -231,7 +231,7 @@ pub fn handshake_worker<T: Tun, B: UDP>( } // add any new keypair to peer - keypair.map(|kp| { + if let Some(kp) = keypair { debug!("{} : handshake worker, new keypair for {}", wg, peer); // this means that a handshake response was processed or sent @@ -241,7 +241,7 @@ pub fn handshake_worker<T: Tun, B: UDP>( for id in peer.add_keypair(kp) { device.release(id); } - }); + }; } } Err(e) => debug!("{} : handshake worker, error = {:?}", wg, e), |