net/wireguard/cookie.h

0001 /* SPDX-License-Identifier: GPL-2.0 */
0002 /*
0003  * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
0004  */
0005
0006 #ifndef _WG_COOKIE_H
0007 #define _WG_COOKIE_H
0008
0009 #include "messages.h"
0010 #include <linux/rwsem.h>
0011
0012 struct wg_peer;
0013
0014 struct cookie_checker {
0015     u8 secret[NOISE_HASH_LEN];
0016     u8 cookie_encryption_key[NOISE_SYMMETRIC_KEY_LEN];
0017     u8 message_mac1_key[NOISE_SYMMETRIC_KEY_LEN];
0018     u64 secret_birthdate;
0019     struct rw_semaphore secret_lock;
0020     struct wg_device *device;
0021 };
0022
0023 struct cookie {
0024     u64 birthdate;
0025     bool is_valid;
0026     u8 cookie[COOKIE_LEN];
0027     bool have_sent_mac1;
0028     u8 last_mac1_sent[COOKIE_LEN];
0029     u8 cookie_decryption_key[NOISE_SYMMETRIC_KEY_LEN];
0030     u8 message_mac1_key[NOISE_SYMMETRIC_KEY_LEN];
0031     struct rw_semaphore lock;
0032 };
0033
0034 enum cookie_mac_state {
0035     INVALID_MAC,
0036     VALID_MAC_BUT_NO_COOKIE,
0037     VALID_MAC_WITH_COOKIE_BUT_RATELIMITED,
0038     VALID_MAC_WITH_COOKIE
0039 };
0040
0041 void wg_cookie_checker_init(struct cookie_checker *checker,
0042                 struct wg_device *wg);
0043 void wg_cookie_checker_precompute_device_keys(struct cookie_checker *checker);
0044 void wg_cookie_checker_precompute_peer_keys(struct wg_peer *peer);
0045 void wg_cookie_init(struct cookie *cookie);
0046
0047 enum cookie_mac_state wg_cookie_validate_packet(struct cookie_checker *checker,
0048                         struct sk_buff *skb,
0049                         bool check_cookie);
0050 void wg_cookie_add_mac_to_packet(void *message, size_t len,
0051                  struct wg_peer *peer);
0052
0053 void wg_cookie_message_create(struct message_handshake_cookie *src,
0054                   struct sk_buff *skb, __le32 index,
0055                   struct cookie_checker *checker);
0056 void wg_cookie_message_consume(struct message_handshake_cookie *src,
0057                    struct wg_device *wg);
0058
0059 #endif /* _WG_COOKIE_H */