aboutsummaryrefslogtreecommitdiffstats
path: root/src/wireguard/router/outbound.rs
blob: a0a1c72e729ba8c496a750ffa903839d3d6828f2 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
use super::constants::MAX_INORDER_CONSUME;
use super::device::Device;
use super::messages::{TransportHeader, TYPE_TRANSPORT};
use super::peer::Peer;
use super::pool::*;
use super::types::Callbacks;
use super::KeyPair;
use super::REJECT_AFTER_MESSAGES;
use super::{tun, udp, Endpoint};

use std::sync::Arc;

use crossbeam_channel::Receiver;
use ring::aead::{Aad, LessSafeKey, Nonce, UnboundKey, CHACHA20_POLY1305};
use zerocopy::{AsBytes, LayoutVerified};

pub const SIZE_TAG: usize = 16;

pub struct Outbound {
    msg: Vec<u8>,
    keypair: Arc<KeyPair>,
    counter: u64,
}

impl Outbound {
    pub fn new(msg: Vec<u8>, keypair: Arc<KeyPair>, counter: u64) -> Outbound {
        Outbound {
            msg,
            keypair,
            counter,
        }
    }
}

#[inline(always)]
pub fn parallel<E: Endpoint, C: Callbacks, T: tun::Writer, B: udp::Writer<E>>(
    device: Device<E, C, T, B>,
    receiver: Receiver<Job<Peer<E, C, T, B>, Outbound>>,
) {
    fn work<E: Endpoint, C: Callbacks, T: tun::Writer, B: udp::Writer<E>>(
        _peer: &Peer<E, C, T, B>,
        body: &mut Outbound,
    ) {
        log::trace!("worker, parallel section, obtained job");

        // make space for the tag
        body.msg.extend([0u8; SIZE_TAG].iter());

        // cast to header (should never fail)
        let (mut header, packet): (LayoutVerified<&mut [u8], TransportHeader>, &mut [u8]) =
            LayoutVerified::new_from_prefix(&mut body.msg[..])
                .expect("earlier code should ensure that there is ample space");

        // set header fields
        debug_assert!(
            body.counter < REJECT_AFTER_MESSAGES,
            "should be checked when assigning counters"
        );
        header.f_type.set(TYPE_TRANSPORT);
        header.f_receiver.set(body.keypair.send.id);
        header.f_counter.set(body.counter);

        // create a nonce object
        let mut nonce = [0u8; 12];
        debug_assert_eq!(nonce.len(), CHACHA20_POLY1305.nonce_len());
        nonce[4..].copy_from_slice(header.f_counter.as_bytes());
        let nonce = Nonce::assume_unique_for_key(nonce);

        // do the weird ring AEAD dance
        let key = LessSafeKey::new(
            UnboundKey::new(&CHACHA20_POLY1305, &body.keypair.send.key[..]).unwrap(),
        );

        // encrypt content of transport message in-place
        let end = packet.len() - SIZE_TAG;
        let tag = key
            .seal_in_place_separate_tag(nonce, Aad::empty(), &mut packet[..end])
            .unwrap();

        // append tag
        packet[end..].copy_from_slice(tag.as_ref());
    }

    worker_parallel(device, |dev| &dev.run_outbound, receiver, work);
}

#[inline(always)]
pub fn sequential<E: Endpoint, C: Callbacks, T: tun::Writer, B: udp::Writer<E>>(
    device: Device<E, C, T, B>,
) {
    device.run_outbound.run(|peer| {
        peer.outbound.handle(
            |body| {
                log::trace!("worker, sequential section, obtained job");

                // send to peer
                let xmit = peer.send(&body.msg[..]).is_ok();

                // trigger callback
                C::send(
                    &peer.opaque,
                    body.msg.len(),
                    xmit,
                    &body.keypair,
                    body.counter,
                );
            },
            MAX_INORDER_CONSUME,
        )
    });
}