1 // SPDX-License-Identifier: MIT
2 /*
3 * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
4 */
5
6 #include <errno.h>
7 #include <stddef.h>
8 #include <stdlib.h>
9 #include <string.h>
10 #include <time.h>
11 #include <sys/ioctl.h>
12 #include <sys/socket.h>
13 #include <sys/sockio.h>
14 #include <sys/types.h>
15 #include <net/if.h>
16 #include <net/if_wg.h>
17 #include <netinet/in.h>
18 #include "containers.h"
19
20 #define IPC_SUPPORTS_KERNEL_INTERFACE
21
get_dgram_socket(void)22 static int get_dgram_socket(void)
23 {
24 static int sock = -1;
25 if (sock < 0)
26 sock = socket(AF_INET, SOCK_DGRAM, 0);
27 return sock;
28 }
29
kernel_get_wireguard_interfaces(struct string_list * list)30 static int kernel_get_wireguard_interfaces(struct string_list *list)
31 {
32 struct ifgroupreq ifgr = { .ifgr_name = "wg" };
33 struct ifg_req *ifg;
34 int s = get_dgram_socket(), ret = 0;
35
36 if (s < 0)
37 return -errno;
38
39 if (ioctl(s, SIOCGIFGMEMB, (caddr_t)&ifgr) < 0)
40 return errno == ENOENT ? 0 : -errno;
41
42 ifgr.ifgr_groups = calloc(1, ifgr.ifgr_len);
43 if (!ifgr.ifgr_groups)
44 return -errno;
45 if (ioctl(s, SIOCGIFGMEMB, (caddr_t)&ifgr) < 0) {
46 ret = -errno;
47 goto out;
48 }
49
50 for (ifg = ifgr.ifgr_groups; ifg && ifgr.ifgr_len > 0; ++ifg) {
51 if ((ret = string_list_add(list, ifg->ifgrq_member)) < 0)
52 goto out;
53 ifgr.ifgr_len -= sizeof(struct ifg_req);
54 }
55
56 out:
57 free(ifgr.ifgr_groups);
58 return ret;
59 }
60
kernel_get_device(struct wgdevice ** device,const char * iface)61 static int kernel_get_device(struct wgdevice **device, const char *iface)
62 {
63 struct wg_data_io wgdata = { .wgd_size = 0 };
64 struct wg_interface_io *wg_iface;
65 struct wg_peer_io *wg_peer;
66 struct wg_aip_io *wg_aip;
67 struct wgdevice *dev;
68 struct wgpeer *peer;
69 struct wgallowedip *aip;
70 int s = get_dgram_socket(), ret;
71
72 if (s < 0)
73 return -errno;
74
75 *device = NULL;
76 strlcpy(wgdata.wgd_name, iface, sizeof(wgdata.wgd_name));
77 for (size_t last_size = wgdata.wgd_size;; last_size = wgdata.wgd_size) {
78 if (ioctl(s, SIOCGWG, (caddr_t)&wgdata) < 0)
79 goto out;
80 if (last_size >= wgdata.wgd_size)
81 break;
82 wgdata.wgd_interface = realloc(wgdata.wgd_interface, wgdata.wgd_size);
83 if (!wgdata.wgd_interface)
84 goto out;
85 }
86
87 wg_iface = wgdata.wgd_interface;
88 dev = calloc(1, sizeof(*dev));
89 if (!dev)
90 goto out;
91 strlcpy(dev->name, iface, sizeof(dev->name));
92
93 if (wg_iface->i_flags & WG_INTERFACE_HAS_RTABLE) {
94 dev->fwmark = wg_iface->i_rtable;
95 dev->flags |= WGDEVICE_HAS_FWMARK;
96 }
97
98 if (wg_iface->i_flags & WG_INTERFACE_HAS_PORT) {
99 dev->listen_port = wg_iface->i_port;
100 dev->flags |= WGDEVICE_HAS_LISTEN_PORT;
101 }
102
103 if (wg_iface->i_flags & WG_INTERFACE_HAS_PUBLIC) {
104 memcpy(dev->public_key, wg_iface->i_public, sizeof(dev->public_key));
105 dev->flags |= WGDEVICE_HAS_PUBLIC_KEY;
106 }
107
108 if (wg_iface->i_flags & WG_INTERFACE_HAS_PRIVATE) {
109 memcpy(dev->private_key, wg_iface->i_private, sizeof(dev->private_key));
110 dev->flags |= WGDEVICE_HAS_PRIVATE_KEY;
111 }
112
113 wg_peer = &wg_iface->i_peers[0];
114 for (size_t i = 0; i < wg_iface->i_peers_count; ++i) {
115 peer = calloc(1, sizeof(*peer));
116 if (!peer)
117 goto out;
118
119 if (dev->first_peer == NULL)
120 dev->first_peer = peer;
121 else
122 dev->last_peer->next_peer = peer;
123 dev->last_peer = peer;
124
125 if (wg_peer->p_flags & WG_PEER_HAS_PUBLIC) {
126 memcpy(peer->public_key, wg_peer->p_public, sizeof(peer->public_key));
127 peer->flags |= WGPEER_HAS_PUBLIC_KEY;
128 }
129
130 if (wg_peer->p_flags & WG_PEER_HAS_PSK) {
131 memcpy(peer->preshared_key, wg_peer->p_psk, sizeof(peer->preshared_key));
132 if (!key_is_zero(peer->preshared_key))
133 peer->flags |= WGPEER_HAS_PRESHARED_KEY;
134 }
135
136 if (wg_peer->p_flags & WG_PEER_HAS_PKA) {
137 peer->persistent_keepalive_interval = wg_peer->p_pka;
138 peer->flags |= WGPEER_HAS_PERSISTENT_KEEPALIVE_INTERVAL;
139 }
140
141 if (wg_peer->p_flags & WG_PEER_HAS_ENDPOINT && wg_peer->p_sa.sa_len <= sizeof(peer->endpoint.addr))
142 memcpy(&peer->endpoint.addr, &wg_peer->p_sa, wg_peer->p_sa.sa_len);
143
144 peer->rx_bytes = wg_peer->p_rxbytes;
145 peer->tx_bytes = wg_peer->p_txbytes;
146
147 peer->last_handshake_time.tv_sec = wg_peer->p_last_handshake.tv_sec;
148 peer->last_handshake_time.tv_nsec = wg_peer->p_last_handshake.tv_nsec;
149
150 wg_aip = &wg_peer->p_aips[0];
151 for (size_t j = 0; j < wg_peer->p_aips_count; ++j) {
152 aip = calloc(1, sizeof(*aip));
153 if (!aip)
154 goto out;
155
156 if (peer->first_allowedip == NULL)
157 peer->first_allowedip = aip;
158 else
159 peer->last_allowedip->next_allowedip = aip;
160 peer->last_allowedip = aip;
161
162 aip->family = wg_aip->a_af;
163 if (wg_aip->a_af == AF_INET) {
164 memcpy(&aip->ip4, &wg_aip->a_ipv4, sizeof(aip->ip4));
165 aip->cidr = wg_aip->a_cidr;
166 } else if (wg_aip->a_af == AF_INET6) {
167 memcpy(&aip->ip6, &wg_aip->a_ipv6, sizeof(aip->ip6));
168 aip->cidr = wg_aip->a_cidr;
169 }
170 ++wg_aip;
171 }
172 wg_peer = (struct wg_peer_io *)wg_aip;
173 }
174 *device = dev;
175 errno = 0;
176 out:
177 ret = -errno;
178 free(wgdata.wgd_interface);
179 return ret;
180 }
181
kernel_set_device(struct wgdevice * dev)182 static int kernel_set_device(struct wgdevice *dev)
183 {
184 struct wg_data_io wgdata = { .wgd_size = sizeof(struct wg_interface_io) };
185 struct wg_interface_io *wg_iface;
186 struct wg_peer_io *wg_peer;
187 struct wg_aip_io *wg_aip;
188 struct wgpeer *peer;
189 struct wgallowedip *aip;
190 int s = get_dgram_socket(), ret;
191 size_t peer_count, aip_count;
192
193 if (s < 0)
194 return -errno;
195
196 for_each_wgpeer(dev, peer) {
197 wgdata.wgd_size += sizeof(struct wg_peer_io);
198 for_each_wgallowedip(peer, aip)
199 wgdata.wgd_size += sizeof(struct wg_aip_io);
200 }
201 wg_iface = wgdata.wgd_interface = calloc(1, wgdata.wgd_size);
202 if (!wgdata.wgd_interface)
203 return -errno;
204 strlcpy(wgdata.wgd_name, dev->name, sizeof(wgdata.wgd_name));
205
206 if (dev->flags & WGDEVICE_HAS_PRIVATE_KEY) {
207 memcpy(wg_iface->i_private, dev->private_key, sizeof(wg_iface->i_private));
208 wg_iface->i_flags |= WG_INTERFACE_HAS_PRIVATE;
209 }
210
211 if (dev->flags & WGDEVICE_HAS_LISTEN_PORT) {
212 wg_iface->i_port = dev->listen_port;
213 wg_iface->i_flags |= WG_INTERFACE_HAS_PORT;
214 }
215
216 if (dev->flags & WGDEVICE_HAS_FWMARK) {
217 wg_iface->i_rtable = dev->fwmark;
218 wg_iface->i_flags |= WG_INTERFACE_HAS_RTABLE;
219 }
220
221 if (dev->flags & WGDEVICE_REPLACE_PEERS)
222 wg_iface->i_flags |= WG_INTERFACE_REPLACE_PEERS;
223
224 peer_count = 0;
225 wg_peer = &wg_iface->i_peers[0];
226 for_each_wgpeer(dev, peer) {
227 wg_peer->p_flags = WG_PEER_HAS_PUBLIC;
228 memcpy(wg_peer->p_public, peer->public_key, sizeof(wg_peer->p_public));
229
230 if (peer->flags & WGPEER_HAS_PRESHARED_KEY) {
231 memcpy(wg_peer->p_psk, peer->preshared_key, sizeof(wg_peer->p_psk));
232 wg_peer->p_flags |= WG_PEER_HAS_PSK;
233 }
234
235 if (peer->flags & WGPEER_HAS_PERSISTENT_KEEPALIVE_INTERVAL) {
236 wg_peer->p_pka = peer->persistent_keepalive_interval;
237 wg_peer->p_flags |= WG_PEER_HAS_PKA;
238 }
239
240 if ((peer->endpoint.addr.sa_family == AF_INET || peer->endpoint.addr.sa_family == AF_INET6) &&
241 peer->endpoint.addr.sa_len <= sizeof(wg_peer->p_endpoint)) {
242 memcpy(&wg_peer->p_endpoint, &peer->endpoint.addr, peer->endpoint.addr.sa_len);
243 wg_peer->p_flags |= WG_PEER_HAS_ENDPOINT;
244 }
245
246 if (peer->flags & WGPEER_REPLACE_ALLOWEDIPS)
247 wg_peer->p_flags |= WG_PEER_REPLACE_AIPS;
248
249 if (peer->flags & WGPEER_REMOVE_ME)
250 wg_peer->p_flags |= WG_PEER_REMOVE;
251
252 aip_count = 0;
253 wg_aip = &wg_peer->p_aips[0];
254 for_each_wgallowedip(peer, aip) {
255 wg_aip->a_af = aip->family;
256 wg_aip->a_cidr = aip->cidr;
257
258 if (aip->family == AF_INET)
259 memcpy(&wg_aip->a_ipv4, &aip->ip4, sizeof(wg_aip->a_ipv4));
260 else if (aip->family == AF_INET6)
261 memcpy(&wg_aip->a_ipv6, &aip->ip6, sizeof(wg_aip->a_ipv6));
262 else
263 continue;
264 ++aip_count;
265 ++wg_aip;
266 }
267 wg_peer->p_aips_count = aip_count;
268 ++peer_count;
269 wg_peer = (struct wg_peer_io *)wg_aip;
270 }
271 wg_iface->i_peers_count = peer_count;
272
273 if (ioctl(s, SIOCSWG, (caddr_t)&wgdata) < 0)
274 goto out;
275 errno = 0;
276
277 out:
278 ret = -errno;
279 free(wgdata.wgd_interface);
280 return ret;
281 }
282