cookie.c 7.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  4. */
  5. #include "cookie.h"
  6. #include "peer.h"
  7. #include "device.h"
  8. #include "messages.h"
  9. #include "ratelimiter.h"
  10. #include "timers.h"
  11. #include <crypto/blake2s.h>
  12. #include <crypto/chacha20poly1305.h>
  13. #include <net/ipv6.h>
  14. #include <crypto/algapi.h>
  15. void wg_cookie_checker_init(struct cookie_checker *checker,
  16. struct wg_device *wg)
  17. {
  18. init_rwsem(&checker->secret_lock);
  19. checker->secret_birthdate = ktime_get_coarse_boottime_ns();
  20. get_random_bytes(checker->secret, NOISE_HASH_LEN);
  21. checker->device = wg;
  22. }
  23. enum { COOKIE_KEY_LABEL_LEN = 8 };
  24. static const u8 mac1_key_label[COOKIE_KEY_LABEL_LEN] = "mac1----";
  25. static const u8 cookie_key_label[COOKIE_KEY_LABEL_LEN] = "cookie--";
  26. static void precompute_key(u8 key[NOISE_SYMMETRIC_KEY_LEN],
  27. const u8 pubkey[NOISE_PUBLIC_KEY_LEN],
  28. const u8 label[COOKIE_KEY_LABEL_LEN])
  29. {
  30. struct blake2s_state blake;
  31. blake2s_init(&blake, NOISE_SYMMETRIC_KEY_LEN);
  32. blake2s_update(&blake, label, COOKIE_KEY_LABEL_LEN);
  33. blake2s_update(&blake, pubkey, NOISE_PUBLIC_KEY_LEN);
  34. blake2s_final(&blake, key);
  35. }
  36. /* Must hold peer->handshake.static_identity->lock */
  37. void wg_cookie_checker_precompute_device_keys(struct cookie_checker *checker)
  38. {
  39. if (likely(checker->device->static_identity.has_identity)) {
  40. precompute_key(checker->cookie_encryption_key,
  41. checker->device->static_identity.static_public,
  42. cookie_key_label);
  43. precompute_key(checker->message_mac1_key,
  44. checker->device->static_identity.static_public,
  45. mac1_key_label);
  46. } else {
  47. memset(checker->cookie_encryption_key, 0,
  48. NOISE_SYMMETRIC_KEY_LEN);
  49. memset(checker->message_mac1_key, 0, NOISE_SYMMETRIC_KEY_LEN);
  50. }
  51. }
  52. void wg_cookie_checker_precompute_peer_keys(struct wg_peer *peer)
  53. {
  54. precompute_key(peer->latest_cookie.cookie_decryption_key,
  55. peer->handshake.remote_static, cookie_key_label);
  56. precompute_key(peer->latest_cookie.message_mac1_key,
  57. peer->handshake.remote_static, mac1_key_label);
  58. }
  59. void wg_cookie_init(struct cookie *cookie)
  60. {
  61. memset(cookie, 0, sizeof(*cookie));
  62. init_rwsem(&cookie->lock);
  63. }
  64. static void compute_mac1(u8 mac1[COOKIE_LEN], const void *message, size_t len,
  65. const u8 key[NOISE_SYMMETRIC_KEY_LEN])
  66. {
  67. len = len - sizeof(struct message_macs) +
  68. offsetof(struct message_macs, mac1);
  69. blake2s(mac1, message, key, COOKIE_LEN, len, NOISE_SYMMETRIC_KEY_LEN);
  70. }
  71. static void compute_mac2(u8 mac2[COOKIE_LEN], const void *message, size_t len,
  72. const u8 cookie[COOKIE_LEN])
  73. {
  74. len = len - sizeof(struct message_macs) +
  75. offsetof(struct message_macs, mac2);
  76. blake2s(mac2, message, cookie, COOKIE_LEN, len, COOKIE_LEN);
  77. }
  78. static void make_cookie(u8 cookie[COOKIE_LEN], struct sk_buff *skb,
  79. struct cookie_checker *checker)
  80. {
  81. struct blake2s_state state;
  82. if (wg_birthdate_has_expired(checker->secret_birthdate,
  83. COOKIE_SECRET_MAX_AGE)) {
  84. down_write(&checker->secret_lock);
  85. checker->secret_birthdate = ktime_get_coarse_boottime_ns();
  86. get_random_bytes(checker->secret, NOISE_HASH_LEN);
  87. up_write(&checker->secret_lock);
  88. }
  89. down_read(&checker->secret_lock);
  90. blake2s_init_key(&state, COOKIE_LEN, checker->secret, NOISE_HASH_LEN);
  91. if (skb->protocol == htons(ETH_P_IP))
  92. blake2s_update(&state, (u8 *)&ip_hdr(skb)->saddr,
  93. sizeof(struct in_addr));
  94. else if (skb->protocol == htons(ETH_P_IPV6))
  95. blake2s_update(&state, (u8 *)&ipv6_hdr(skb)->saddr,
  96. sizeof(struct in6_addr));
  97. blake2s_update(&state, (u8 *)&udp_hdr(skb)->source, sizeof(__be16));
  98. blake2s_final(&state, cookie);
  99. up_read(&checker->secret_lock);
  100. }
  101. enum cookie_mac_state wg_cookie_validate_packet(struct cookie_checker *checker,
  102. struct sk_buff *skb,
  103. bool check_cookie)
  104. {
  105. struct message_macs *macs = (struct message_macs *)
  106. (skb->data + skb->len - sizeof(*macs));
  107. enum cookie_mac_state ret;
  108. u8 computed_mac[COOKIE_LEN];
  109. u8 cookie[COOKIE_LEN];
  110. ret = INVALID_MAC;
  111. compute_mac1(computed_mac, skb->data, skb->len,
  112. checker->message_mac1_key);
  113. if (crypto_memneq(computed_mac, macs->mac1, COOKIE_LEN))
  114. goto out;
  115. ret = VALID_MAC_BUT_NO_COOKIE;
  116. if (!check_cookie)
  117. goto out;
  118. make_cookie(cookie, skb, checker);
  119. compute_mac2(computed_mac, skb->data, skb->len, cookie);
  120. if (crypto_memneq(computed_mac, macs->mac2, COOKIE_LEN))
  121. goto out;
  122. ret = VALID_MAC_WITH_COOKIE_BUT_RATELIMITED;
  123. if (!wg_ratelimiter_allow(skb, dev_net(checker->device->dev)))
  124. goto out;
  125. ret = VALID_MAC_WITH_COOKIE;
  126. out:
  127. return ret;
  128. }
  129. void wg_cookie_add_mac_to_packet(void *message, size_t len,
  130. struct wg_peer *peer)
  131. {
  132. struct message_macs *macs = (struct message_macs *)
  133. ((u8 *)message + len - sizeof(*macs));
  134. down_write(&peer->latest_cookie.lock);
  135. compute_mac1(macs->mac1, message, len,
  136. peer->latest_cookie.message_mac1_key);
  137. memcpy(peer->latest_cookie.last_mac1_sent, macs->mac1, COOKIE_LEN);
  138. peer->latest_cookie.have_sent_mac1 = true;
  139. up_write(&peer->latest_cookie.lock);
  140. down_read(&peer->latest_cookie.lock);
  141. if (peer->latest_cookie.is_valid &&
  142. !wg_birthdate_has_expired(peer->latest_cookie.birthdate,
  143. COOKIE_SECRET_MAX_AGE - COOKIE_SECRET_LATENCY))
  144. compute_mac2(macs->mac2, message, len,
  145. peer->latest_cookie.cookie);
  146. else
  147. memset(macs->mac2, 0, COOKIE_LEN);
  148. up_read(&peer->latest_cookie.lock);
  149. }
  150. void wg_cookie_message_create(struct message_handshake_cookie *dst,
  151. struct sk_buff *skb, __le32 index,
  152. struct cookie_checker *checker)
  153. {
  154. struct message_macs *macs = (struct message_macs *)
  155. ((u8 *)skb->data + skb->len - sizeof(*macs));
  156. u8 cookie[COOKIE_LEN];
  157. dst->header.type = cpu_to_le32(MESSAGE_HANDSHAKE_COOKIE);
  158. dst->receiver_index = index;
  159. get_random_bytes_wait(dst->nonce, COOKIE_NONCE_LEN);
  160. make_cookie(cookie, skb, checker);
  161. xchacha20poly1305_encrypt(dst->encrypted_cookie, cookie, COOKIE_LEN,
  162. macs->mac1, COOKIE_LEN, dst->nonce,
  163. checker->cookie_encryption_key);
  164. }
  165. void wg_cookie_message_consume(struct message_handshake_cookie *src,
  166. struct wg_device *wg)
  167. {
  168. struct wg_peer *peer = NULL;
  169. u8 cookie[COOKIE_LEN];
  170. bool ret;
  171. if (unlikely(!wg_index_hashtable_lookup(wg->index_hashtable,
  172. INDEX_HASHTABLE_HANDSHAKE |
  173. INDEX_HASHTABLE_KEYPAIR,
  174. src->receiver_index, &peer)))
  175. return;
  176. down_read(&peer->latest_cookie.lock);
  177. if (unlikely(!peer->latest_cookie.have_sent_mac1)) {
  178. up_read(&peer->latest_cookie.lock);
  179. goto out;
  180. }
  181. ret = xchacha20poly1305_decrypt(
  182. cookie, src->encrypted_cookie, sizeof(src->encrypted_cookie),
  183. peer->latest_cookie.last_mac1_sent, COOKIE_LEN, src->nonce,
  184. peer->latest_cookie.cookie_decryption_key);
  185. up_read(&peer->latest_cookie.lock);
  186. if (ret) {
  187. down_write(&peer->latest_cookie.lock);
  188. memcpy(peer->latest_cookie.cookie, cookie, COOKIE_LEN);
  189. peer->latest_cookie.birthdate = ktime_get_coarse_boottime_ns();
  190. peer->latest_cookie.is_valid = true;
  191. peer->latest_cookie.have_sent_mac1 = false;
  192. up_write(&peer->latest_cookie.lock);
  193. } else {
  194. net_dbg_ratelimited("%s: Could not decrypt invalid cookie response\n",
  195. wg->dev->name);
  196. }
  197. out:
  198. wg_peer_put(peer);
  199. }