mirror of
https://github.com/rosenpass/rosenpass.git
synced 2025-12-05 20:40:02 -08:00
feat(rp-rust): implement rp tool in Rust (#235)
This commit is contained in:
Gergő Móricz
56
.github/workflows/nix.yaml
vendored
56
.github/workflows/nix.yaml
vendored
@@ -95,6 +95,7 @@ jobs:
|
||||
- macos-13
|
||||
needs:
|
||||
- x86_64-darwin---rosenpass
|
||||
- x86_64-darwin---rp
|
||||
- x86_64-darwin---rosenpass-oci-image
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
@@ -123,6 +124,22 @@ jobs:
|
||||
authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
|
||||
- name: Build
|
||||
run: nix build .#packages.x86_64-darwin.rosenpass --print-build-logs
|
||||
x86_64-darwin---rp:
|
||||
name: Build x86_64-darwin.rp
|
||||
runs-on:
|
||||
- macos-13
|
||||
needs: []
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- uses: cachix/install-nix-action@v22
|
||||
with:
|
||||
nix_path: nixpkgs=channel:nixos-unstable
|
||||
- uses: cachix/cachix-action@v12
|
||||
with:
|
||||
name: rosenpass
|
||||
authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
|
||||
- name: Build
|
||||
run: nix build .#packages.x86_64-darwin.rp --print-build-logs
|
||||
x86_64-darwin---rosenpass-oci-image:
|
||||
name: Build x86_64-darwin.rosenpass-oci-image
|
||||
runs-on:
|
||||
@@ -212,6 +229,7 @@ jobs:
|
||||
needs:
|
||||
- x86_64-linux---rosenpass-static
|
||||
- x86_64-linux---rosenpass-static-oci-image
|
||||
- x86_64-linux---rp-static
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- uses: cachix/install-nix-action@v22
|
||||
@@ -230,6 +248,7 @@ jobs:
|
||||
needs:
|
||||
- aarch64-linux---rosenpass-oci-image
|
||||
- aarch64-linux---rosenpass
|
||||
- aarch64-linux---rp
|
||||
steps:
|
||||
- run: |
|
||||
DEBIAN_FRONTEND=noninteractive
|
||||
@@ -283,6 +302,27 @@ jobs:
|
||||
authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
|
||||
- name: Build
|
||||
run: nix build .#packages.aarch64-linux.rosenpass --print-build-logs
|
||||
aarch64-linux---rp:
|
||||
name: Build aarch64-linux.rp
|
||||
runs-on:
|
||||
- ubuntu-latest
|
||||
needs: []
|
||||
steps:
|
||||
- run: |
|
||||
DEBIAN_FRONTEND=noninteractive
|
||||
sudo apt-get update -q -y && sudo apt-get install -q -y qemu-system-aarch64 qemu-efi binfmt-support qemu-user-static
|
||||
- uses: actions/checkout@v3
|
||||
- uses: cachix/install-nix-action@v22
|
||||
with:
|
||||
nix_path: nixpkgs=channel:nixos-unstable
|
||||
extra_nix_config: |
|
||||
system = aarch64-linux
|
||||
- uses: cachix/cachix-action@v12
|
||||
with:
|
||||
name: rosenpass
|
||||
authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
|
||||
- name: Build
|
||||
run: nix build .#packages.aarch64-linux.rp --print-build-logs
|
||||
x86_64-linux---rosenpass-oci-image:
|
||||
name: Build x86_64-linux.rosenpass-oci-image
|
||||
runs-on:
|
||||
@@ -338,6 +378,22 @@ jobs:
|
||||
authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
|
||||
- name: Build
|
||||
run: nix build .#packages.x86_64-linux.rosenpass-static --print-build-logs
|
||||
x86_64-linux---rp-static:
|
||||
name: Build x86_64-linux.rp-static
|
||||
runs-on:
|
||||
- ubuntu-latest
|
||||
needs: []
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- uses: cachix/install-nix-action@v22
|
||||
with:
|
||||
nix_path: nixpkgs=channel:nixos-unstable
|
||||
- uses: cachix/cachix-action@v12
|
||||
with:
|
||||
name: rosenpass
|
||||
authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
|
||||
- name: Build
|
||||
run: nix build .#packages.x86_64-linux.rp-static --print-build-logs
|
||||
x86_64-linux---rosenpass-static-oci-image:
|
||||
name: Build x86_64-linux.rosenpass-static-oci-image
|
||||
runs-on:
|
||||
|
||||
373
Cargo.lock
generated
373
Cargo.lock
generated
@@ -245,6 +245,12 @@ version = "1.5.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
|
||||
|
||||
[[package]]
|
||||
name = "bytes"
|
||||
version = "1.6.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "514de17de45fdb8dc022b1a7975556c53c86f9f0aa5f534b98977b171857c2c9"
|
||||
|
||||
[[package]]
|
||||
name = "cast"
|
||||
version = "0.3.0"
|
||||
@@ -496,7 +502,7 @@ dependencies = [
|
||||
"autocfg",
|
||||
"cfg-if",
|
||||
"crossbeam-utils",
|
||||
"memoffset",
|
||||
"memoffset 0.9.1",
|
||||
"scopeguard",
|
||||
]
|
||||
|
||||
@@ -516,6 +522,44 @@ dependencies = [
|
||||
"typenum",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "ctrlc-async"
|
||||
version = "3.2.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "598e9d68e769aa1283460a3b0ec0d049ccfb6170277aea37089fa3f58fd721a1"
|
||||
dependencies = [
|
||||
"nix 0.23.2",
|
||||
"tokio",
|
||||
"winapi",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "curve25519-dalek"
|
||||
version = "4.1.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0a677b8922c94e01bdbb12126b0bc852f00447528dee1782229af9c720c3f348"
|
||||
dependencies = [
|
||||
"cfg-if",
|
||||
"cpufeatures",
|
||||
"curve25519-dalek-derive",
|
||||
"fiat-crypto",
|
||||
"platforms",
|
||||
"rustc_version",
|
||||
"subtle",
|
||||
"zeroize",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "curve25519-dalek-derive"
|
||||
version = "0.1.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "darling"
|
||||
version = "0.20.8"
|
||||
@@ -658,6 +702,18 @@ dependencies = [
|
||||
"windows-sys 0.52.0",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "fastrand"
|
||||
version = "2.0.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "658bd65b1cf4c852a3cc96f18a8ce7b5640f6b703f905c7d74532294c2a63984"
|
||||
|
||||
[[package]]
|
||||
name = "fiat-crypto"
|
||||
version = "0.2.7"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "c007b1ae3abe1cb6f85a16305acd418b7ca6343b953633fee2b76d8f108b830f"
|
||||
|
||||
[[package]]
|
||||
name = "fnv"
|
||||
version = "1.0.7"
|
||||
@@ -712,6 +768,17 @@ version = "0.3.30"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "a44623e20b9681a318efdd71c299b6b222ed6f231972bfe2f224ebad6311f0c1"
|
||||
|
||||
[[package]]
|
||||
name = "futures-macro"
|
||||
version = "0.3.30"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "87750cf4b7a4c0625b1529e4c543c2182106e4dedc60a2a6455e00d212c489ac"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "futures-sink"
|
||||
version = "0.3.30"
|
||||
@@ -733,6 +800,7 @@ dependencies = [
|
||||
"futures-channel",
|
||||
"futures-core",
|
||||
"futures-io",
|
||||
"futures-macro",
|
||||
"futures-sink",
|
||||
"futures-task",
|
||||
"memchr",
|
||||
@@ -751,6 +819,22 @@ dependencies = [
|
||||
"version_check",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "genetlink"
|
||||
version = "0.2.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1f890076c1faa1298bf747ce3694a8d9e0d2cc4b06fe293f12dd95742bfd079f"
|
||||
dependencies = [
|
||||
"futures",
|
||||
"log",
|
||||
"netlink-packet-core",
|
||||
"netlink-packet-generic",
|
||||
"netlink-packet-utils",
|
||||
"netlink-proto",
|
||||
"thiserror",
|
||||
"tokio",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "getrandom"
|
||||
version = "0.2.11"
|
||||
@@ -996,6 +1080,15 @@ version = "2.6.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "f665ee40bc4a3c5590afb1e9677db74a508659dfd71e126420da8274909a0167"
|
||||
|
||||
[[package]]
|
||||
name = "memoffset"
|
||||
version = "0.6.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "5aa361d4faea93603064a027415f07bd8e1d5c88c9fbf68bf56a285428fd79ce"
|
||||
dependencies = [
|
||||
"autocfg",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "memoffset"
|
||||
version = "0.9.1"
|
||||
@@ -1043,6 +1136,121 @@ dependencies = [
|
||||
"windows-sys 0.48.0",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "netlink-packet-core"
|
||||
version = "0.7.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "72724faf704479d67b388da142b186f916188505e7e0b26719019c525882eda4"
|
||||
dependencies = [
|
||||
"anyhow",
|
||||
"byteorder",
|
||||
"netlink-packet-utils",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "netlink-packet-generic"
|
||||
version = "0.3.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1cd7eb8ad331c84c6b8cb7f685b448133e5ad82e1ffd5acafac374af4a5a308b"
|
||||
dependencies = [
|
||||
"anyhow",
|
||||
"byteorder",
|
||||
"netlink-packet-core",
|
||||
"netlink-packet-utils",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "netlink-packet-route"
|
||||
version = "0.19.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "74c171cd77b4ee8c7708da746ce392440cb7bcf618d122ec9ecc607b12938bf4"
|
||||
dependencies = [
|
||||
"anyhow",
|
||||
"byteorder",
|
||||
"libc",
|
||||
"log",
|
||||
"netlink-packet-core",
|
||||
"netlink-packet-utils",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "netlink-packet-utils"
|
||||
version = "0.5.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0ede8a08c71ad5a95cdd0e4e52facd37190977039a4704eb82a283f713747d34"
|
||||
dependencies = [
|
||||
"anyhow",
|
||||
"byteorder",
|
||||
"paste",
|
||||
"thiserror",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "netlink-packet-wireguard"
|
||||
version = "0.2.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "60b25b050ff1f6a1e23c6777b72db22790fe5b6b5ccfd3858672587a79876c8f"
|
||||
dependencies = [
|
||||
"anyhow",
|
||||
"byteorder",
|
||||
"libc",
|
||||
"log",
|
||||
"netlink-packet-generic",
|
||||
"netlink-packet-utils",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "netlink-proto"
|
||||
version = "0.11.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "86b33524dc0968bfad349684447bfce6db937a9ac3332a1fe60c0c5a5ce63f21"
|
||||
dependencies = [
|
||||
"bytes",
|
||||
"futures",
|
||||
"log",
|
||||
"netlink-packet-core",
|
||||
"netlink-sys",
|
||||
"thiserror",
|
||||
"tokio",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "netlink-sys"
|
||||
version = "0.8.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "416060d346fbaf1f23f9512963e3e878f1a78e707cb699ba9215761754244307"
|
||||
dependencies = [
|
||||
"bytes",
|
||||
"futures",
|
||||
"libc",
|
||||
"log",
|
||||
"tokio",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "nix"
|
||||
version = "0.23.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8f3790c00a0150112de0f4cd161e3d7fc4b2d8a5542ffc35f099a2562aecb35c"
|
||||
dependencies = [
|
||||
"bitflags 1.3.2",
|
||||
"cc",
|
||||
"cfg-if",
|
||||
"libc",
|
||||
"memoffset 0.6.5",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "nix"
|
||||
version = "0.27.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
|
||||
dependencies = [
|
||||
"bitflags 2.4.1",
|
||||
"cfg-if",
|
||||
"libc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "nom"
|
||||
version = "7.1.3"
|
||||
@@ -1062,6 +1270,16 @@ dependencies = [
|
||||
"autocfg",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "num_cpus"
|
||||
version = "1.16.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
|
||||
dependencies = [
|
||||
"hermit-abi 0.3.3",
|
||||
"libc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "object"
|
||||
version = "0.32.1"
|
||||
@@ -1154,6 +1372,12 @@ version = "0.1.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
|
||||
|
||||
[[package]]
|
||||
name = "platforms"
|
||||
version = "3.4.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "db23d408679286588f4d4644f965003d056e3dd5abcaaa938116871d7ce2fee7"
|
||||
|
||||
[[package]]
|
||||
name = "plotters"
|
||||
version = "0.3.5"
|
||||
@@ -1211,9 +1435,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "proc-macro2"
|
||||
version = "1.0.79"
|
||||
version = "1.0.81"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e835ff2298f5721608eb1a980ecaee1aef2c132bf95ecc026a11b7bf3c01c02e"
|
||||
checksum = "3d1597b0c024618f09a9c3b8655b7e430397a36d23fdafec26d6965e9eec3eba"
|
||||
dependencies = [
|
||||
"unicode-ident",
|
||||
]
|
||||
@@ -1229,9 +1453,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "quote"
|
||||
version = "1.0.35"
|
||||
version = "1.0.36"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "291ec9ab5efd934aaf503a6466c5d5251535d108ee747472c3977cc5acc868ef"
|
||||
checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
]
|
||||
@@ -1335,7 +1559,7 @@ dependencies = [
|
||||
"env_logger",
|
||||
"home",
|
||||
"log",
|
||||
"memoffset",
|
||||
"memoffset 0.9.1",
|
||||
"mio",
|
||||
"paste",
|
||||
"rand",
|
||||
@@ -1440,6 +1664,50 @@ dependencies = [
|
||||
"typenum",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "rp"
|
||||
version = "0.2.1"
|
||||
dependencies = [
|
||||
"anyhow",
|
||||
"base64",
|
||||
"ctrlc-async",
|
||||
"futures",
|
||||
"futures-util",
|
||||
"genetlink",
|
||||
"netlink-packet-core",
|
||||
"netlink-packet-generic",
|
||||
"netlink-packet-wireguard",
|
||||
"rosenpass",
|
||||
"rosenpass-cipher-traits",
|
||||
"rosenpass-ciphers",
|
||||
"rosenpass-secret-memory",
|
||||
"rosenpass-util",
|
||||
"rtnetlink",
|
||||
"stacker",
|
||||
"tempfile",
|
||||
"tokio",
|
||||
"x25519-dalek",
|
||||
"zeroize",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "rtnetlink"
|
||||
version = "0.14.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "b684475344d8df1859ddb2d395dd3dac4f8f3422a1aa0725993cb375fc5caba5"
|
||||
dependencies = [
|
||||
"futures",
|
||||
"log",
|
||||
"netlink-packet-core",
|
||||
"netlink-packet-route",
|
||||
"netlink-packet-utils",
|
||||
"netlink-proto",
|
||||
"netlink-sys",
|
||||
"nix 0.27.1",
|
||||
"thiserror",
|
||||
"tokio",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "rustc-demangle"
|
||||
version = "0.1.23"
|
||||
@@ -1503,18 +1771,18 @@ checksum = "b97ed7a9823b74f99c7742f5336af7be5ecd3eeafcb1507d1fa93347b1d589b0"
|
||||
|
||||
[[package]]
|
||||
name = "serde"
|
||||
version = "1.0.197"
|
||||
version = "1.0.198"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3fb1c873e1b9b056a4dc4c0c198b24c3ffa059243875552b2bd0933b1aee4ce2"
|
||||
checksum = "9846a40c979031340571da2545a4e5b7c4163bdae79b301d5f86d03979451fcc"
|
||||
dependencies = [
|
||||
"serde_derive",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "serde_derive"
|
||||
version = "1.0.197"
|
||||
version = "1.0.198"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7eb0b34b42edc17f6b7cac84a52a1c5f0e1bb2227e997ca9011ea3dd34e8610b"
|
||||
checksum = "e88edab869b01783ba905e7d0153f9fc1a6505a96e4ad3018011eedb838566d9"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
@@ -1568,9 +1836,9 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "shlex"
|
||||
version = "1.3.0"
|
||||
version = "1.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
|
||||
checksum = "a7cee0529a6d40f580e7a5e6c495c8fbfe21b7b52795ed4bb5e62cdf92bc6380"
|
||||
|
||||
[[package]]
|
||||
name = "slab"
|
||||
@@ -1587,6 +1855,16 @@ version = "1.13.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
|
||||
|
||||
[[package]]
|
||||
name = "socket2"
|
||||
version = "0.5.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "05ffd9c0a93b7543e062e759284fcf5f5e3b098501104bfbdde4d404db792871"
|
||||
dependencies = [
|
||||
"libc",
|
||||
"windows-sys 0.52.0",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "spin"
|
||||
version = "0.9.8"
|
||||
@@ -1641,15 +1919,28 @@ checksum = "81cdd64d312baedb58e21336b31bc043b77e01cc99033ce76ef539f78e965ebc"
|
||||
|
||||
[[package]]
|
||||
name = "syn"
|
||||
version = "2.0.53"
|
||||
version = "2.0.60"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7383cd0e49fff4b6b90ca5670bfd3e9d6a733b3f90c686605aa7eec8c4996032"
|
||||
checksum = "909518bc7b1c9b779f1bbf07f2929d35af9f0f37e47c6e9ef7f9dddc1e1821f3"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"unicode-ident",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "tempfile"
|
||||
version = "3.9.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "01ce4141aa927a6d1bd34a041795abd0db1cccba5d5f24b009f694bdf3a1f3fa"
|
||||
dependencies = [
|
||||
"cfg-if",
|
||||
"fastrand",
|
||||
"redox_syscall",
|
||||
"rustix",
|
||||
"windows-sys 0.52.0",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "termcolor"
|
||||
version = "1.4.0"
|
||||
@@ -1701,6 +1992,34 @@ dependencies = [
|
||||
"serde_json",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "tokio"
|
||||
version = "1.37.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1adbebffeca75fcfd058afa480fb6c0b81e165a0323f9c9d39c9697e37c46787"
|
||||
dependencies = [
|
||||
"backtrace",
|
||||
"bytes",
|
||||
"libc",
|
||||
"mio",
|
||||
"num_cpus",
|
||||
"pin-project-lite",
|
||||
"socket2",
|
||||
"tokio-macros",
|
||||
"windows-sys 0.48.0",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "tokio-macros"
|
||||
version = "2.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "5b8a1e28f2deaa14e508979454cb3a223b10b938b45af148bc0986de36f1923b"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "toml"
|
||||
version = "0.7.8"
|
||||
@@ -2099,6 +2418,18 @@ dependencies = [
|
||||
"memchr",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "x25519-dalek"
|
||||
version = "2.0.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
|
||||
dependencies = [
|
||||
"curve25519-dalek",
|
||||
"rand_core",
|
||||
"serde",
|
||||
"zeroize",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zerocopy"
|
||||
version = "0.7.32"
|
||||
@@ -2125,3 +2456,17 @@ name = "zeroize"
|
||||
version = "1.7.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
|
||||
dependencies = [
|
||||
"zeroize_derive",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "zeroize_derive"
|
||||
version = "1.4.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "ce36e65b0d2999d2aafac989fb249189a141aee1f53c612c1f37d72631959f69"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn",
|
||||
]
|
||||
|
||||
@@ -11,10 +11,12 @@ members = [
|
||||
"to",
|
||||
"fuzz",
|
||||
"secret-memory",
|
||||
"rp",
|
||||
]
|
||||
|
||||
default-members = [
|
||||
"rosenpass"
|
||||
"rosenpass",
|
||||
"rp",
|
||||
]
|
||||
|
||||
[workspace.metadata.release]
|
||||
|
||||
136
flake.nix
136
flake.nix
@@ -72,17 +72,9 @@
|
||||
result = pkgs.lib.sources.cleanSourceWith { inherit src filter; };
|
||||
};
|
||||
|
||||
# builds a bin path for all dependencies for the `rp` shellscript
|
||||
rpBinPath = p: with p; lib.makeBinPath [
|
||||
coreutils
|
||||
findutils
|
||||
gawk
|
||||
wireguard-tools
|
||||
];
|
||||
|
||||
# a function to generate a nix derivation for rosenpass against any
|
||||
# given set of nixpkgs
|
||||
rpDerivation = p:
|
||||
rosenpassDerivation = p:
|
||||
let
|
||||
# whether we want to build a statically linked binary
|
||||
isStatic = p.targetPlatform.isStatic;
|
||||
@@ -128,7 +120,6 @@
|
||||
p.stdenv.cc
|
||||
cmake # for oqs build in the oqs-sys crate
|
||||
mandoc # for the built-in manual
|
||||
makeWrapper # for the rp shellscript
|
||||
pkg-config # let libsodium-sys-stable find libsodium
|
||||
removeReferencesTo
|
||||
rustPlatform.bindgenHook # for C-bindings in the crypto libs
|
||||
@@ -160,11 +151,112 @@
|
||||
preBuild = (lib.optionalString isStatic ''
|
||||
NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -lc"
|
||||
'');
|
||||
};
|
||||
|
||||
preInstall = ''
|
||||
install -D ${./rp} $out/bin/rp
|
||||
wrapProgram $out/bin/rp --prefix PATH : "${ rpBinPath p }"
|
||||
'';
|
||||
# We want to build for a specific target...
|
||||
CARGO_BUILD_TARGET = target;
|
||||
|
||||
# ... which might require a non-default linker:
|
||||
"CARGO_TARGET_${shout target}_LINKER" =
|
||||
let
|
||||
inherit (p.stdenv) cc;
|
||||
in
|
||||
"${cc}/bin/${cc.targetPrefix}cc";
|
||||
|
||||
meta = with pkgs.lib;
|
||||
{
|
||||
inherit (cargoToml.package) description homepage;
|
||||
license = with licenses; [ mit asl20 ];
|
||||
maintainers = [ maintainers.wucke13 ];
|
||||
platforms = platforms.all;
|
||||
};
|
||||
} // (lib.mkIf isStatic {
|
||||
# otherwise pkg-config tries to link non-existent dynamic libs
|
||||
# documented here: https://docs.rs/pkg-config/latest/pkg_config/
|
||||
PKG_CONFIG_ALL_STATIC = true;
|
||||
|
||||
# tell rust to build everything statically linked
|
||||
CARGO_BUILD_RUSTFLAGS = "-C target-feature=+crt-static";
|
||||
});
|
||||
# a function to generate a nix derivation for the rp helper against any
|
||||
# given set of nixpkgs
|
||||
rpDerivation = p:
|
||||
let
|
||||
# whether we want to build a statically linked binary
|
||||
isStatic = p.targetPlatform.isStatic;
|
||||
|
||||
# the rust target of `p`
|
||||
target = p.rust.toRustTargetSpec p.targetPlatform;
|
||||
|
||||
# convert a string to shout case
|
||||
shout = string: builtins.replaceStrings [ "-" ] [ "_" ] (pkgs.lib.toUpper string);
|
||||
|
||||
# suitable Rust toolchain
|
||||
toolchain = with inputs.fenix.packages.${system}; combine [
|
||||
stable.cargo
|
||||
stable.rustc
|
||||
targets.${target}.stable.rust-std
|
||||
];
|
||||
|
||||
# naersk with a custom toolchain
|
||||
naersk = pkgs.callPackage inputs.naersk {
|
||||
cargo = toolchain;
|
||||
rustc = toolchain;
|
||||
};
|
||||
|
||||
# used to trick the build.rs into believing that CMake was ran **again**
|
||||
fakecmake = pkgs.writeScriptBin "cmake" ''
|
||||
#! ${pkgs.stdenv.shell} -e
|
||||
true
|
||||
'';
|
||||
in
|
||||
naersk.buildPackage
|
||||
{
|
||||
# metadata and source
|
||||
name = cargoToml.package.name;
|
||||
version = cargoToml.package.version;
|
||||
inherit src;
|
||||
|
||||
cargoBuildOptions = x: x ++ [ "-p" "rp" ];
|
||||
cargoTestOptions = x: x ++ [ "-p" "rp" ];
|
||||
|
||||
doCheck = true;
|
||||
|
||||
nativeBuildInputs = with pkgs; [
|
||||
p.stdenv.cc
|
||||
cmake # for oqs build in the oqs-sys crate
|
||||
mandoc # for the built-in manual
|
||||
pkg-config # let libsodium-sys-stable find libsodium
|
||||
removeReferencesTo
|
||||
rustPlatform.bindgenHook # for C-bindings in the crypto libs
|
||||
];
|
||||
buildInputs = with p; [ bash libsodium ];
|
||||
|
||||
override = x: {
|
||||
preBuild =
|
||||
# nix defaults to building for aarch64 _without_ the armv8-a crypto
|
||||
# extensions, but liboqs depens on these
|
||||
(lib.optionalString (system == "aarch64-linux") ''
|
||||
NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -march=armv8-a+crypto"
|
||||
''
|
||||
);
|
||||
|
||||
# fortify is only compatible with dynamic linking
|
||||
hardeningDisable = lib.optional isStatic "fortify";
|
||||
};
|
||||
|
||||
overrideMain = x: {
|
||||
# CMake detects that it was served a _foreign_ target dir, and CMake
|
||||
# would be executed again upon the second build step of naersk.
|
||||
# By adding our specially optimized CMake version, we reduce the cost
|
||||
# of recompilation by 99 % while, while avoiding any CMake errors.
|
||||
nativeBuildInputs = [ (lib.hiPrio fakecmake) ] ++ x.nativeBuildInputs;
|
||||
|
||||
# make sure that libc is linked, under musl this is not the case per
|
||||
# default
|
||||
preBuild = (lib.optionalString isStatic ''
|
||||
NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -lc"
|
||||
'');
|
||||
};
|
||||
|
||||
# We want to build for a specific target...
|
||||
@@ -206,7 +298,8 @@
|
||||
rec {
|
||||
packages = rec {
|
||||
default = rosenpass;
|
||||
rosenpass = rpDerivation pkgs;
|
||||
rosenpass = rosenpassDerivation pkgs;
|
||||
rp = rpDerivation pkgs;
|
||||
rosenpass-oci-image = rosenpassOCI "rosenpass";
|
||||
|
||||
# derivation for the release
|
||||
@@ -217,6 +310,10 @@
|
||||
if pkgs.hostPlatform.isLinux then
|
||||
packages.rosenpass-static
|
||||
else packages.rosenpass;
|
||||
rp =
|
||||
if pkgs.hostPlatform.isLinux then
|
||||
packages.rp-static
|
||||
else packages.rp;
|
||||
oci-image =
|
||||
if pkgs.hostPlatform.isLinux then
|
||||
packages.rosenpass-static-oci-image
|
||||
@@ -225,14 +322,15 @@
|
||||
pkgs.runCommandNoCC "lace-result" { }
|
||||
''
|
||||
mkdir {bin,$out}
|
||||
cp ${./.}/rp bin/
|
||||
tar -cvf $out/rosenpass-${system}-${version}.tar bin/rp \
|
||||
-C ${package} bin/rosenpass
|
||||
tar -cvf $out/rosenpass-${system}-${version}.tar \
|
||||
-C ${package} bin/rosenpass \
|
||||
-C ${rp} bin/rp
|
||||
cp ${oci-image} \
|
||||
$out/rosenpass-oci-image-${system}-${version}.tar.gz
|
||||
'';
|
||||
} // (if pkgs.stdenv.isLinux then rec {
|
||||
rosenpass-static = rpDerivation pkgs.pkgsStatic;
|
||||
rosenpass-static = rosenpassDerivation pkgs.pkgsStatic;
|
||||
rp-static = rpDerivation pkgs.pkgsStatic;
|
||||
rosenpass-static-oci-image = rosenpassOCI "rosenpass-static";
|
||||
} else { });
|
||||
}
|
||||
|
||||
@@ -29,7 +29,7 @@ The [rosenpass tool](./src/) is written in Rust and uses liboqs[^liboqs] and lib
|
||||
|
||||
As with any application a small risk of critical security issues (such as buffer overflows, remote code execution) exists; the Rosenpass application is written in the Rust programming language which is much less prone to such issues. Rosenpass can also write keys to files instead of supplying them to WireGuard With a bit of scripting the stand alone mode of the implementation can be used to run the application in a Container, VM or on another host. This mode can also be used to integrate tools other than WireGuard with Rosenpass.
|
||||
|
||||
The [`rp`](./rp) tool written in bash makes it easy to create a VPN using WireGuard and Rosenpass.
|
||||
The [`rp`](./rp) tool written in Rust makes it easy to create a VPN using WireGuard and Rosenpass.
|
||||
|
||||
`rp` is easy to get started with but has a few drawbacks; it runs as root, demanding access to both WireGuard
|
||||
and Rosenpass private keys, takes control of the interface and works with exactly one interface. If you do not feel confident about running Rosenpass as root, you should use the stand-alone mode to create a more secure setup using containers, jails, or virtual machines.
|
||||
|
||||
@@ -772,7 +772,7 @@ impl AppServer {
|
||||
}
|
||||
|
||||
if let Some(owg) = ap.outwg.as_ref() {
|
||||
let mut child = Command::new("wg")
|
||||
let mut child = match Command::new("wg")
|
||||
.arg("set")
|
||||
.arg(&owg.dev)
|
||||
.arg("peer")
|
||||
@@ -781,7 +781,17 @@ impl AppServer {
|
||||
.arg("/dev/stdin")
|
||||
.stdin(Stdio::piped())
|
||||
.args(&owg.extra_params)
|
||||
.spawn()?;
|
||||
.spawn()
|
||||
{
|
||||
Ok(x) => x,
|
||||
Err(e) => {
|
||||
if e.kind() == std::io::ErrorKind::NotFound {
|
||||
anyhow::bail!("Could not find wg command");
|
||||
} else {
|
||||
return Err(anyhow::Error::new(e));
|
||||
}
|
||||
}
|
||||
};
|
||||
b64_writer(child.stdin.take().unwrap()).write_all(key.secret())?;
|
||||
|
||||
thread::spawn(move || {
|
||||
|
||||
391
rp
391
rp
@@ -1,391 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -e
|
||||
|
||||
# String formatting subsystem
|
||||
|
||||
formatting_init() {
|
||||
endl=$'\n'
|
||||
}
|
||||
|
||||
enquote() {
|
||||
while (( $# > 1 )); do
|
||||
printf "%q " "${1}"; shift
|
||||
done
|
||||
if (( $# == 1 )); then
|
||||
printf "%q" "${1}"; shift
|
||||
fi
|
||||
}
|
||||
|
||||
multiline() {
|
||||
# shellcheck disable=SC1004
|
||||
echo "${1} " | awk '
|
||||
function pm(a, b, l) {
|
||||
return length(a) > l \
|
||||
&& length(b) > l \
|
||||
&& substr(a, 1, l+1) == substr(b, 1, l+1) \
|
||||
? pm(a, b, l+1) : l;
|
||||
}
|
||||
|
||||
!started && $0 !~ /^[ \t]*$/ {
|
||||
started=1
|
||||
match($0, /^[ \t]*/)
|
||||
prefix=substr($0, 1, RLENGTH)
|
||||
}
|
||||
|
||||
started {
|
||||
print(substr($0, 1 + pm($0, prefix)));
|
||||
}
|
||||
'
|
||||
}
|
||||
|
||||
dbg() {
|
||||
echo >&2 "$@"
|
||||
}
|
||||
|
||||
|
||||
detect_git_dir() {
|
||||
# https://stackoverflow.com/questions/3618078/pipe-only-stderr-through-a-filter
|
||||
(
|
||||
git -C "${scriptdir}" rev-parse --show-toplevel 3>&1 1>&2 2>&3 3>&- \
|
||||
| sed '
|
||||
/not a git repository/d;
|
||||
s/^/WARNING: /'
|
||||
) 3>&1 1>&2 2>&3 3>&-
|
||||
}
|
||||
|
||||
# Cleanup subsystem (sigterm)
|
||||
|
||||
cleanup_init() {
|
||||
cleanup_actions=()
|
||||
trap cleanup_apply exit
|
||||
}
|
||||
|
||||
cleanup_apply() {
|
||||
local f
|
||||
for f in "${cleanup_actions[@]}"; do
|
||||
eval "${f}"
|
||||
done
|
||||
}
|
||||
|
||||
cleanup() {
|
||||
cleanup_actions+=("$(multiline "${1}")")
|
||||
}
|
||||
|
||||
# Transactional execution subsystem
|
||||
|
||||
frag_init() {
|
||||
explain=0
|
||||
frag_transaction=()
|
||||
frag "
|
||||
#! /bin/bash
|
||||
set -e"
|
||||
}
|
||||
|
||||
frag_apply() {
|
||||
local f
|
||||
for f in "${frag_transaction[@]}"; do
|
||||
if (( explain == 1 )); then
|
||||
dbg "${f}"
|
||||
fi
|
||||
eval "${f}"
|
||||
done
|
||||
}
|
||||
|
||||
frag() {
|
||||
frag_transaction+=("$(multiline "${1}")")
|
||||
}
|
||||
|
||||
frag_append() {
|
||||
local len; len="${#frag_transaction[@]}"
|
||||
frag_transaction=("${frag_transaction[@]:0:len-1}" "${frag_transaction[len-1]}${1}")
|
||||
}
|
||||
|
||||
frag_append_esc() {
|
||||
frag_append " \\${endl}${1}"
|
||||
}
|
||||
|
||||
# Usage documentation subsystem
|
||||
usage_init() {
|
||||
usagestack=("${script}")
|
||||
}
|
||||
|
||||
usage_snap() {
|
||||
echo "${#usagestack}"
|
||||
}
|
||||
|
||||
usage_restore() {
|
||||
local n; n="${1}"
|
||||
dbg REST "${1}"
|
||||
usagestack=("${usagestack[@]:0:n-2}")
|
||||
}
|
||||
|
||||
|
||||
usage() {
|
||||
dbg "Usage: ${usagestack[*]}"
|
||||
}
|
||||
|
||||
fatal() {
|
||||
dbg "FATAL: $*"
|
||||
usage
|
||||
exit 1
|
||||
}
|
||||
|
||||
genkey() {
|
||||
usagestack+=("PRIVATE_KEYS_DIR")
|
||||
local skdir
|
||||
skdir="${1%/}"; shift || fatal "Required positional argument: PRIVATE_KEYS_DIR"
|
||||
|
||||
while (( $# > 0 )); do
|
||||
local arg; arg="$1"; shift
|
||||
case "${arg}" in
|
||||
-h | -help | --help | help) usage; return 0 ;;
|
||||
*) fatal "Unknown option ${arg}";;
|
||||
esac
|
||||
done
|
||||
|
||||
if test -e "${skdir}"; then
|
||||
fatal "PRIVATE_KEYS_DIR \"${skdir}\" already exists"
|
||||
fi
|
||||
|
||||
frag "
|
||||
umask 077
|
||||
mkdir -p $(enquote "${skdir}")
|
||||
wg genkey > $(enquote "${skdir}"/wgsk)
|
||||
$(enquote "${binary}") gen-keys \\
|
||||
-s $(enquote "${skdir}"/pqsk) \\
|
||||
-p $(enquote "${skdir}"/pqpk)"
|
||||
}
|
||||
|
||||
pubkey() {
|
||||
usagestack+=("PRIVATE_KEYS_DIR" "PUBLIC_KEYS_DIR")
|
||||
local skdir pkdir
|
||||
skdir="${1%/}"; shift || fatal "Required positional argument: PRIVATE_KEYS_DIR"
|
||||
pkdir="${1%/}"; shift || fatal "Required positional argument: PUBLIC_KEYS_DIR"
|
||||
|
||||
while (( $# > 0 )); do
|
||||
local arg; arg="$1"; shift
|
||||
case "${arg}" in
|
||||
-h | -help | --help | help) usage; exit 0;;
|
||||
*) fatal "Unknown option ${arg}";;
|
||||
esac
|
||||
done
|
||||
|
||||
if test -e "${pkdir}"; then
|
||||
fatal "PUBLIC_KEYS_DIR \"${pkdir}\" already exists"
|
||||
fi
|
||||
|
||||
frag "
|
||||
mkdir -p $(enquote "${pkdir}")
|
||||
wg pubkey < $(enquote "${skdir}"/wgsk) > $(enquote "${pkdir}/wgpk")
|
||||
cp $(enquote "${skdir}"/pqpk) $(enquote "${pkdir}/pqpk")"
|
||||
}
|
||||
|
||||
exchange() {
|
||||
usagestack+=("PRIVATE_KEYS_DIR" "[dev <device>]" "[listen <ip>:<port>]" "[peer PUBLIC_KEYS_DIR [endpoint <ip>:<port>] [persistent-keepalive <interval>] [allowed-ips <ip1>/<cidr1>[,<ip2>/<cidr2>]...]]...")
|
||||
local skdir dev lport
|
||||
dev="${project_name}0"
|
||||
skdir="${1%/}"; shift || fatal "Required positional argument: PRIVATE_KEYS_DIR"
|
||||
|
||||
while (( $# > 0 )); do
|
||||
local arg; arg="$1"; shift
|
||||
case "${arg}" in
|
||||
dev) dev="${1}"; shift || fatal "dev option requires parameter";;
|
||||
peer) set -- "peer" "$@"; break;; # Parsed down below
|
||||
listen)
|
||||
local listen; listen="${1}";
|
||||
lip="${listen%:*}";
|
||||
lport="${listen/*:/}";
|
||||
if [[ "$lip" = "$lport" ]]; then
|
||||
lip="[::]"
|
||||
fi
|
||||
shift;;
|
||||
-h | -help | --help | help) usage; return 0;;
|
||||
*) fatal "Unknown option ${arg}";;
|
||||
esac
|
||||
done
|
||||
|
||||
if (( $# == 0 )); then
|
||||
fatal "Needs at least one peer specified"
|
||||
fi
|
||||
|
||||
# os dependent setup
|
||||
case "$OSTYPE" in
|
||||
linux-*) # could be linux-gnu or linux-musl
|
||||
frag "
|
||||
# Create the WireGuard interface
|
||||
ip link add dev $(enquote "${dev}") type wireguard || true"
|
||||
|
||||
cleanup "
|
||||
ip link del dev $(enquote "${dev}") || true"
|
||||
|
||||
frag "
|
||||
ip link set dev $(enquote "${dev}") up"
|
||||
;;
|
||||
|
||||
freebsd*)
|
||||
frag "
|
||||
# load the WireGuard kernel module
|
||||
kldload -n if_wg || fatal 'Cannot load if_wg kernel module'"
|
||||
|
||||
frag "
|
||||
# Create the WireGuard interface
|
||||
ifconfig wg create name $(enquote "${dev}") || true"
|
||||
|
||||
cleanup "
|
||||
ifconfig $(enquote "${dev}") destroy || true"
|
||||
|
||||
frag "
|
||||
ifconfig $(enquote "${dev}") up"
|
||||
;;
|
||||
|
||||
*)
|
||||
fatal "Your system $OSTYPE is not yet supported. We are happy to receive patches to address this :)"
|
||||
;;
|
||||
|
||||
esac
|
||||
|
||||
frag "
|
||||
# Deploy the classic wireguard private key
|
||||
wg set $(enquote "${dev}") private-key $(enquote "${skdir}/wgsk")"
|
||||
|
||||
|
||||
if test -n "${lport}"; then
|
||||
frag_append "listen-port $(enquote "$(( lport + 1 ))")"
|
||||
fi
|
||||
|
||||
frag "
|
||||
# Launch the post quantum wireguard exchange daemon
|
||||
$(enquote "${binary}") exchange"
|
||||
|
||||
if (( verbose == 1 )); then
|
||||
frag_append "verbose"
|
||||
fi
|
||||
|
||||
frag_append_esc " secret-key $(enquote "${skdir}/pqsk")"
|
||||
frag_append_esc " public-key $(enquote "${skdir}/pqpk")"
|
||||
|
||||
if test -n "${lport}"; then
|
||||
frag_append_esc " listen $(enquote "${lip}:${lport}")"
|
||||
fi
|
||||
|
||||
usagestack+=("peer" "PUBLIC_KEYS_DIR endpoint IP:PORT")
|
||||
|
||||
while (( $# > 0 )); do
|
||||
shift; # Skip "peer" argument
|
||||
|
||||
local peerdir ip port keepalive allowedips
|
||||
peerdir="${1%/}"; shift || fatal "Required peer argument: PUBLIC_KEYS_DIR"
|
||||
|
||||
while (( $# > 0 )); do
|
||||
local arg; arg="$1"; shift
|
||||
case "${arg}" in
|
||||
peer) set -- "peer" "$@"; break;; # Next peer
|
||||
endpoint) ip="${1%:*}"; port="${1##*:}"; shift;;
|
||||
persistent-keepalive) keepalive="${1}"; shift;;
|
||||
allowed-ips) allowedips="${1}"; shift;;
|
||||
-h | -help | --help | help) usage; return 0;;
|
||||
*) fatal "Unknown option ${arg}";;
|
||||
esac
|
||||
done
|
||||
|
||||
# Public key
|
||||
frag_append_esc " peer public-key $(enquote "${peerdir}/pqpk")"
|
||||
|
||||
# PSK
|
||||
local pskfile; pskfile="${peerdir}/psk"
|
||||
if test -f "${pskfile}"; then
|
||||
frag_append_esc " preshared-key $(enquote "${pskfile}")"
|
||||
fi
|
||||
|
||||
|
||||
if test -n "${ip}"; then
|
||||
frag_append_esc " endpoint $(enquote "${ip}:${port}")"
|
||||
fi
|
||||
|
||||
frag_append_esc " wireguard $(enquote "${dev}") $(enquote "$(cat "${peerdir}/wgpk")")"
|
||||
|
||||
if test -n "${ip}"; then
|
||||
frag_append_esc " endpoint $(enquote "${ip}:$(( port + 1 ))")"
|
||||
fi
|
||||
|
||||
if test -n "${keepalive}"; then
|
||||
frag_append_esc " persistent-keepalive $(enquote "${keepalive}")"
|
||||
fi
|
||||
|
||||
if test -n "${allowedips}"; then
|
||||
frag_append_esc " allowed-ips $(enquote "${allowedips}")"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
find_rosenpass_binary() {
|
||||
local binary; binary=""
|
||||
if [[ -n "${gitdir}" ]]; then
|
||||
# If rp is run from the git repo, use the newest build artifact
|
||||
binary=$(
|
||||
find "${gitdir}/result/bin/${project_name}" \
|
||||
"${gitdir}"/target/{release,debug}/"${project_name}" \
|
||||
-printf "%T@ %p\n" 2>/dev/null \
|
||||
| sort -nr \
|
||||
| awk 'NR==1 { print($2) }'
|
||||
)
|
||||
elif [[ -n "${nixdir}" ]]; then
|
||||
# If rp is run from nix, use the nix-installed rosenpass version
|
||||
binary="${nixdir}/bin/${project_name}"
|
||||
fi
|
||||
|
||||
if [[ -z "${binary}" ]]; then
|
||||
binary="${project_name}"
|
||||
fi
|
||||
|
||||
echo "${binary}"
|
||||
}
|
||||
|
||||
main() {
|
||||
formatting_init
|
||||
cleanup_init
|
||||
usage_init
|
||||
frag_init
|
||||
|
||||
project_name="rosenpass"
|
||||
verbose=0
|
||||
scriptdir="$(dirname "${script}")"
|
||||
gitdir="$(detect_git_dir)" || true
|
||||
if [[ -d /nix ]]; then
|
||||
nixdir="$(readlink -f result/bin/rp | grep -Pio '^/nix/store/[^/]+(?=/bin/[^/]+)')" || true
|
||||
fi
|
||||
binary="$(find_rosenpass_binary)"
|
||||
|
||||
# Parse command
|
||||
|
||||
usagestack+=("[explain]" "[verbose]" "genkey|pubkey|exchange" "[ARGS]...")
|
||||
|
||||
local cmd
|
||||
while (( $# > 0 )); do
|
||||
local arg; arg="$1"; shift
|
||||
case "${arg}" in
|
||||
genkey|pubkey|exchange) cmd="${arg}"; break;;
|
||||
explain) explain=1;;
|
||||
verbose) verbose=1;;
|
||||
-h | -help | --help | help) usage; return 0 ;;
|
||||
*) fatal "Unknown command ${arg}";;
|
||||
esac
|
||||
done
|
||||
|
||||
test -n "${cmd}" || fatal "No command supplied"
|
||||
usagestack=("${script}")
|
||||
|
||||
# Execute command
|
||||
|
||||
usagestack+=("${cmd}")
|
||||
"${cmd}" "$@"
|
||||
usagestack=("${script}")
|
||||
|
||||
# Apply transaction
|
||||
|
||||
frag_apply
|
||||
}
|
||||
|
||||
script="$0"
|
||||
main "$@"
|
||||
38
rp/Cargo.toml
Normal file
38
rp/Cargo.toml
Normal file
@@ -0,0 +1,38 @@
|
||||
[package]
|
||||
name = "rp"
|
||||
version = "0.2.1"
|
||||
edition = "2021"
|
||||
license = "MIT OR Apache-2.0"
|
||||
description = "Build post-quantum-secure VPNs with WireGuard!"
|
||||
homepage = "https://rosenpass.eu/"
|
||||
repository = "https://github.com/rosenpass/rosenpass"
|
||||
|
||||
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
|
||||
|
||||
[dependencies]
|
||||
anyhow = { workspace = true }
|
||||
base64 = { workspace = true }
|
||||
x25519-dalek = { version = "2", features = ["static_secrets"] }
|
||||
zeroize = { workspace = true }
|
||||
|
||||
rosenpass = { workspace = true }
|
||||
rosenpass-ciphers = { workspace = true }
|
||||
rosenpass-cipher-traits = { workspace = true }
|
||||
rosenpass-secret-memory = { workspace = true }
|
||||
rosenpass-util = { workspace = true }
|
||||
|
||||
tokio = { version = "1.0", features = ["macros", "rt-multi-thread"] }
|
||||
|
||||
[target.'cfg(any(target_os = "linux", target_os = "freebsd"))'.dependencies]
|
||||
ctrlc-async = "3.2"
|
||||
futures = "0.3"
|
||||
futures-util = "0.3"
|
||||
genetlink = "0.2"
|
||||
rtnetlink = "0.14"
|
||||
netlink-packet-core = "0.7"
|
||||
netlink-packet-generic = "0.3"
|
||||
netlink-packet-wireguard = "0.2"
|
||||
|
||||
[dev-dependencies]
|
||||
tempfile = "3"
|
||||
stacker = "0.1.15"
|
||||
462
rp/src/cli.rs
Normal file
462
rp/src/cli.rs
Normal file
@@ -0,0 +1,462 @@
|
||||
use std::path::PathBuf;
|
||||
use std::{iter::Peekable, net::SocketAddr};
|
||||
|
||||
use crate::exchange::{ExchangeOptions, ExchangePeer};
|
||||
|
||||
pub enum Command {
|
||||
GenKey {
|
||||
private_keys_dir: PathBuf,
|
||||
},
|
||||
PubKey {
|
||||
private_keys_dir: PathBuf,
|
||||
public_keys_dir: PathBuf,
|
||||
},
|
||||
Exchange(ExchangeOptions),
|
||||
Help,
|
||||
}
|
||||
|
||||
enum CommandType {
|
||||
GenKey,
|
||||
PubKey,
|
||||
Exchange,
|
||||
}
|
||||
|
||||
#[derive(Default)]
|
||||
pub struct Cli {
|
||||
pub verbose: bool,
|
||||
pub command: Option<Command>,
|
||||
}
|
||||
|
||||
fn fatal<T>(note: &str, command: Option<CommandType>) -> Result<T, String> {
|
||||
match command {
|
||||
Some(command) => match command {
|
||||
CommandType::GenKey => Err(format!("{}\nUsage: rp genkey PRIVATE_KEYS_DIR", note)),
|
||||
CommandType::PubKey => Err(format!("{}\nUsage: rp pubkey PRIVATE_KEYS_DIR PUBLIC_KEYS_DIR", note)),
|
||||
CommandType::Exchange => Err(format!("{}\nUsage: rp exchange PRIVATE_KEYS_DIR [dev <device>] [listen <ip>:<port>] [peer PUBLIC_KEYS_DIR [endpoint <ip>:<port>] [persistent-keepalive <interval>] [allowed-ips <ip1>/<cidr1>[,<ip2>/<cidr2>]...]]...", note)),
|
||||
},
|
||||
None => Err(format!("{}\nUsage: rp [verbose] genkey|pubkey|exchange [ARGS]...", note)),
|
||||
}
|
||||
}
|
||||
|
||||
impl ExchangePeer {
|
||||
pub fn parse(args: &mut &mut Peekable<impl Iterator<Item = String>>) -> Result<Self, String> {
|
||||
let mut peer = ExchangePeer::default();
|
||||
|
||||
if let Some(public_keys_dir) = args.next() {
|
||||
peer.public_keys_dir = PathBuf::from(public_keys_dir);
|
||||
} else {
|
||||
return fatal(
|
||||
"Required positional argument: PUBLIC_KEYS_DIR",
|
||||
Some(CommandType::Exchange),
|
||||
);
|
||||
}
|
||||
|
||||
while let Some(x) = args.peek() {
|
||||
let x = x.as_str();
|
||||
|
||||
// break if next peer is being defined
|
||||
if x == "peer" {
|
||||
break;
|
||||
}
|
||||
|
||||
let x = args.next().unwrap();
|
||||
let x = x.as_str();
|
||||
|
||||
match x {
|
||||
"endpoint" => {
|
||||
if let Some(addr) = args.next() {
|
||||
if let Ok(addr) = addr.parse::<SocketAddr>() {
|
||||
peer.endpoint = Some(addr);
|
||||
} else {
|
||||
return fatal(
|
||||
"invalid parameter for endpoint option",
|
||||
Some(CommandType::Exchange),
|
||||
);
|
||||
}
|
||||
} else {
|
||||
return fatal(
|
||||
"endpoint option requires parameter",
|
||||
Some(CommandType::Exchange),
|
||||
);
|
||||
}
|
||||
}
|
||||
"persistent-keepalive" => {
|
||||
if let Some(ka) = args.next() {
|
||||
if let Ok(ka) = ka.parse::<u32>() {
|
||||
peer.persistent_keepalive = Some(ka);
|
||||
} else {
|
||||
return fatal(
|
||||
"invalid parameter for persistent-keepalive option",
|
||||
Some(CommandType::Exchange),
|
||||
);
|
||||
}
|
||||
} else {
|
||||
return fatal(
|
||||
"persistent-keepalive option requires parameter",
|
||||
Some(CommandType::Exchange),
|
||||
);
|
||||
}
|
||||
}
|
||||
"allowed-ips" => {
|
||||
if let Some(ips) = args.next() {
|
||||
peer.allowed_ips = Some(ips);
|
||||
} else {
|
||||
return fatal(
|
||||
"allowed-ips option requires parameter",
|
||||
Some(CommandType::Exchange),
|
||||
);
|
||||
}
|
||||
}
|
||||
_ => {
|
||||
return fatal(
|
||||
&format!("Unknown option {}", x),
|
||||
Some(CommandType::Exchange),
|
||||
)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Ok(peer)
|
||||
}
|
||||
}
|
||||
|
||||
impl ExchangeOptions {
|
||||
pub fn parse(mut args: &mut Peekable<impl Iterator<Item = String>>) -> Result<Self, String> {
|
||||
let mut options = ExchangeOptions::default();
|
||||
|
||||
if let Some(private_keys_dir) = args.next() {
|
||||
options.private_keys_dir = PathBuf::from(private_keys_dir);
|
||||
} else {
|
||||
return fatal(
|
||||
"Required positional argument: PRIVATE_KEYS_DIR",
|
||||
Some(CommandType::Exchange),
|
||||
);
|
||||
}
|
||||
|
||||
while let Some(x) = args.next() {
|
||||
let x = x.as_str();
|
||||
|
||||
match x {
|
||||
"dev" => {
|
||||
if let Some(device) = args.next() {
|
||||
options.dev = Some(device);
|
||||
} else {
|
||||
return fatal("dev option requires parameter", Some(CommandType::Exchange));
|
||||
}
|
||||
}
|
||||
"listen" => {
|
||||
if let Some(addr) = args.next() {
|
||||
if let Ok(addr) = addr.parse::<SocketAddr>() {
|
||||
options.listen = Some(addr);
|
||||
} else {
|
||||
return fatal(
|
||||
"invalid parameter for listen option",
|
||||
Some(CommandType::Exchange),
|
||||
);
|
||||
}
|
||||
} else {
|
||||
return fatal(
|
||||
"listen option requires parameter",
|
||||
Some(CommandType::Exchange),
|
||||
);
|
||||
}
|
||||
}
|
||||
"peer" => {
|
||||
let peer = ExchangePeer::parse(&mut args)?;
|
||||
options.peers.push(peer);
|
||||
}
|
||||
_ => {
|
||||
return fatal(
|
||||
&format!("Unknown option {}", x),
|
||||
Some(CommandType::Exchange),
|
||||
)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Ok(options)
|
||||
}
|
||||
}
|
||||
|
||||
impl Cli {
|
||||
pub fn parse(mut args: Peekable<impl Iterator<Item = String>>) -> Result<Self, String> {
|
||||
let mut cli = Cli::default();
|
||||
|
||||
let _ = args.next(); // skip executable name
|
||||
|
||||
while let Some(x) = args.next() {
|
||||
let x = x.as_str();
|
||||
|
||||
match x {
|
||||
"verbose" => {
|
||||
cli.verbose = true;
|
||||
}
|
||||
"explain" => {
|
||||
eprintln!("WARN: the explain argument is no longer supported");
|
||||
}
|
||||
"genkey" => {
|
||||
if cli.command.is_some() {
|
||||
return fatal("Too many commands supplied", None);
|
||||
}
|
||||
|
||||
if let Some(private_keys_dir) = args.next() {
|
||||
let private_keys_dir = PathBuf::from(private_keys_dir);
|
||||
|
||||
cli.command = Some(Command::GenKey { private_keys_dir });
|
||||
} else {
|
||||
return fatal(
|
||||
"Required positional argument: PRIVATE_KEYS_DIR",
|
||||
Some(CommandType::GenKey),
|
||||
);
|
||||
}
|
||||
}
|
||||
"pubkey" => {
|
||||
if cli.command.is_some() {
|
||||
return fatal("Too many commands supplied", None);
|
||||
}
|
||||
|
||||
if let Some(private_keys_dir) = args.next() {
|
||||
let private_keys_dir = PathBuf::from(private_keys_dir);
|
||||
|
||||
if let Some(public_keys_dir) = args.next() {
|
||||
let public_keys_dir = PathBuf::from(public_keys_dir);
|
||||
|
||||
cli.command = Some(Command::PubKey {
|
||||
private_keys_dir,
|
||||
public_keys_dir,
|
||||
});
|
||||
} else {
|
||||
return fatal(
|
||||
"Required positional argument: PUBLIC_KEYS_DIR",
|
||||
Some(CommandType::PubKey),
|
||||
);
|
||||
}
|
||||
} else {
|
||||
return fatal(
|
||||
"Required positional argument: PRIVATE_KEYS_DIR",
|
||||
Some(CommandType::PubKey),
|
||||
);
|
||||
}
|
||||
}
|
||||
"exchange" => {
|
||||
if cli.command.is_some() {
|
||||
return fatal("Too many commands supplied", None);
|
||||
}
|
||||
|
||||
let options = ExchangeOptions::parse(&mut args)?;
|
||||
cli.command = Some(Command::Exchange(options));
|
||||
}
|
||||
"help" => {
|
||||
cli.command = Some(Command::Help);
|
||||
}
|
||||
_ => return fatal(&format!("Unknown command {}", x), None),
|
||||
};
|
||||
}
|
||||
|
||||
if cli.command.is_none() {
|
||||
return fatal("No command supplied", None);
|
||||
}
|
||||
|
||||
Ok(cli)
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use crate::cli::{Cli, Command};
|
||||
|
||||
#[inline]
|
||||
fn parse(arr: &[&str]) -> Result<Cli, String> {
|
||||
Cli::parse(arr.into_iter().map(|x| x.to_string()).peekable())
|
||||
}
|
||||
|
||||
#[inline]
|
||||
fn parse_err(arr: &[&str]) -> bool {
|
||||
parse(arr).is_err()
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn bare_errors() {
|
||||
assert!(parse_err(&["rp"]));
|
||||
assert!(parse_err(&["rp", "verbose"]));
|
||||
assert!(parse_err(&["rp", "thiscommanddoesntexist"]));
|
||||
assert!(parse_err(&[
|
||||
"rp",
|
||||
"thiscommanddoesntexist",
|
||||
"genkey",
|
||||
"./fakedir/"
|
||||
]));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn genkey_errors() {
|
||||
assert!(parse_err(&["rp", "genkey"]));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn genkey_works() {
|
||||
let cli = parse(&["rp", "genkey", "./fakedir"]);
|
||||
|
||||
assert!(cli.is_ok());
|
||||
let cli = cli.unwrap();
|
||||
|
||||
assert_eq!(cli.verbose, false);
|
||||
assert!(matches!(cli.command, Some(Command::GenKey { .. })));
|
||||
|
||||
match cli.command {
|
||||
Some(Command::GenKey { private_keys_dir }) => {
|
||||
assert_eq!(private_keys_dir.to_str().unwrap(), "./fakedir");
|
||||
}
|
||||
_ => unreachable!(),
|
||||
};
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn pubkey_errors() {
|
||||
assert!(parse_err(&["rp", "pubkey"]));
|
||||
assert!(parse_err(&["rp", "pubkey", "./fakedir"]));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn pubkey_works() {
|
||||
let cli = parse(&["rp", "pubkey", "./fakedir", "./fakedir2"]);
|
||||
|
||||
assert!(cli.is_ok());
|
||||
let cli = cli.unwrap();
|
||||
|
||||
assert_eq!(cli.verbose, false);
|
||||
assert!(matches!(cli.command, Some(Command::PubKey { .. })));
|
||||
|
||||
match cli.command {
|
||||
Some(Command::PubKey {
|
||||
private_keys_dir,
|
||||
public_keys_dir,
|
||||
}) => {
|
||||
assert_eq!(private_keys_dir.to_str().unwrap(), "./fakedir");
|
||||
assert_eq!(public_keys_dir.to_str().unwrap(), "./fakedir2");
|
||||
}
|
||||
_ => unreachable!(),
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn exchange_errors() {
|
||||
assert!(parse_err(&["rp", "exchange"]));
|
||||
assert!(parse_err(&[
|
||||
"rp",
|
||||
"exchange",
|
||||
"./fakedir",
|
||||
"notarealoption"
|
||||
]));
|
||||
assert!(parse_err(&["rp", "exchange", "./fakedir", "listen"]));
|
||||
assert!(parse_err(&[
|
||||
"rp",
|
||||
"exchange",
|
||||
"./fakedir",
|
||||
"listen",
|
||||
"notarealip"
|
||||
]));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn exchange_works() {
|
||||
let cli = parse(&["rp", "exchange", "./fakedir"]);
|
||||
|
||||
assert!(cli.is_ok());
|
||||
let cli = cli.unwrap();
|
||||
|
||||
assert_eq!(cli.verbose, false);
|
||||
assert!(matches!(cli.command, Some(Command::Exchange(_))));
|
||||
|
||||
match cli.command {
|
||||
Some(Command::Exchange(options)) => {
|
||||
assert_eq!(options.private_keys_dir.to_str().unwrap(), "./fakedir");
|
||||
assert!(options.dev.is_none());
|
||||
assert!(options.listen.is_none());
|
||||
assert_eq!(options.peers.len(), 0);
|
||||
}
|
||||
_ => unreachable!(),
|
||||
}
|
||||
|
||||
let cli = parse(&[
|
||||
"rp",
|
||||
"exchange",
|
||||
"./fakedir",
|
||||
"dev",
|
||||
"devname",
|
||||
"listen",
|
||||
"127.0.0.1:1234",
|
||||
]);
|
||||
|
||||
assert!(cli.is_ok());
|
||||
let cli = cli.unwrap();
|
||||
|
||||
assert_eq!(cli.verbose, false);
|
||||
assert!(matches!(cli.command, Some(Command::Exchange(_))));
|
||||
|
||||
match cli.command {
|
||||
Some(Command::Exchange(options)) => {
|
||||
assert_eq!(options.private_keys_dir.to_str().unwrap(), "./fakedir");
|
||||
assert_eq!(options.dev, Some("devname".to_string()));
|
||||
assert_eq!(options.listen, Some("127.0.0.1:1234".parse().unwrap()));
|
||||
assert_eq!(options.peers.len(), 0);
|
||||
}
|
||||
_ => unreachable!(),
|
||||
}
|
||||
|
||||
let cli = parse(&[
|
||||
"rp",
|
||||
"exchange",
|
||||
"./fakedir",
|
||||
"dev",
|
||||
"devname",
|
||||
"listen",
|
||||
"127.0.0.1:1234",
|
||||
"peer",
|
||||
"./fakedir2",
|
||||
"endpoint",
|
||||
"127.0.0.1:2345",
|
||||
"persistent-keepalive",
|
||||
"15",
|
||||
"allowed-ips",
|
||||
"123.234.11.0/24,1.1.1.0/24",
|
||||
"peer",
|
||||
"./fakedir3",
|
||||
"endpoint",
|
||||
"127.0.0.1:5432",
|
||||
"persistent-keepalive",
|
||||
"30",
|
||||
]);
|
||||
|
||||
assert!(cli.is_ok());
|
||||
let cli = cli.unwrap();
|
||||
|
||||
assert_eq!(cli.verbose, false);
|
||||
assert!(matches!(cli.command, Some(Command::Exchange(_))));
|
||||
|
||||
match cli.command {
|
||||
Some(Command::Exchange(options)) => {
|
||||
assert_eq!(options.private_keys_dir.to_str().unwrap(), "./fakedir");
|
||||
assert_eq!(options.dev, Some("devname".to_string()));
|
||||
assert_eq!(options.listen, Some("127.0.0.1:1234".parse().unwrap()));
|
||||
assert_eq!(options.peers.len(), 2);
|
||||
|
||||
let peer = &options.peers[0];
|
||||
assert_eq!(peer.public_keys_dir.to_str().unwrap(), "./fakedir2");
|
||||
assert_eq!(peer.endpoint, Some("127.0.0.1:2345".parse().unwrap()));
|
||||
assert_eq!(peer.persistent_keepalive, Some(15));
|
||||
assert_eq!(
|
||||
peer.allowed_ips,
|
||||
Some("123.234.11.0/24,1.1.1.0/24".to_string())
|
||||
);
|
||||
|
||||
let peer = &options.peers[1];
|
||||
assert_eq!(peer.public_keys_dir.to_str().unwrap(), "./fakedir3");
|
||||
assert_eq!(peer.endpoint, Some("127.0.0.1:5432".parse().unwrap()));
|
||||
assert_eq!(peer.persistent_keepalive, Some(30));
|
||||
assert!(peer.allowed_ips.is_none());
|
||||
}
|
||||
_ => unreachable!(),
|
||||
}
|
||||
}
|
||||
}
|
||||
261
rp/src/exchange.rs
Normal file
261
rp/src/exchange.rs
Normal file
@@ -0,0 +1,261 @@
|
||||
use std::{net::SocketAddr, path::PathBuf};
|
||||
|
||||
use anyhow::Result;
|
||||
|
||||
#[derive(Default)]
|
||||
pub struct ExchangePeer {
|
||||
pub public_keys_dir: PathBuf,
|
||||
pub endpoint: Option<SocketAddr>,
|
||||
pub persistent_keepalive: Option<u32>,
|
||||
pub allowed_ips: Option<String>,
|
||||
}
|
||||
|
||||
#[derive(Default)]
|
||||
pub struct ExchangeOptions {
|
||||
pub verbose: bool,
|
||||
pub private_keys_dir: PathBuf,
|
||||
pub dev: Option<String>,
|
||||
pub listen: Option<SocketAddr>,
|
||||
pub peers: Vec<ExchangePeer>,
|
||||
}
|
||||
|
||||
#[cfg(not(any(target_os = "linux", target_os = "freebsd")))]
|
||||
pub async fn exchange(_: ExchangeOptions) -> Result<()> {
|
||||
use anyhow::anyhow;
|
||||
|
||||
Err(anyhow!(
|
||||
"Your system {} is not yet supported. We are happy to receive patches to address this :)",
|
||||
std::env::consts::OS
|
||||
))
|
||||
}
|
||||
|
||||
#[cfg(any(target_os = "linux", target_os = "freebsd"))]
|
||||
mod netlink {
|
||||
use anyhow::Result;
|
||||
use futures_util::{StreamExt as _, TryStreamExt as _};
|
||||
use genetlink::GenetlinkHandle;
|
||||
use netlink_packet_core::{NLM_F_ACK, NLM_F_REQUEST};
|
||||
use netlink_packet_wireguard::nlas::WgDeviceAttrs;
|
||||
use rtnetlink::Handle;
|
||||
|
||||
pub async fn link_create_and_up(rtnetlink: &Handle, link_name: String) -> Result<u32> {
|
||||
// add the link
|
||||
rtnetlink
|
||||
.link()
|
||||
.add()
|
||||
.wireguard(link_name.clone())
|
||||
.execute()
|
||||
.await?;
|
||||
|
||||
// retrieve the link to be able to up it
|
||||
let link = rtnetlink
|
||||
.link()
|
||||
.get()
|
||||
.match_name(link_name.clone())
|
||||
.execute()
|
||||
.into_stream()
|
||||
.into_future()
|
||||
.await
|
||||
.0
|
||||
.unwrap()?;
|
||||
|
||||
// up the link
|
||||
rtnetlink
|
||||
.link()
|
||||
.set(link.header.index)
|
||||
.up()
|
||||
.execute()
|
||||
.await?;
|
||||
|
||||
Ok(link.header.index)
|
||||
}
|
||||
|
||||
pub async fn link_cleanup(rtnetlink: &Handle, index: u32) -> Result<()> {
|
||||
rtnetlink.link().del(index).execute().await?;
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub async fn link_cleanup_standalone(index: u32) -> Result<()> {
|
||||
let (connection, rtnetlink, _) = rtnetlink::new_connection()?;
|
||||
tokio::spawn(connection);
|
||||
|
||||
// We don't care if this fails, as the device may already have been auto-cleaned up.
|
||||
let _ = rtnetlink.link().del(index).execute().await;
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// This replicates the functionality of the `wg set` command line tool.
|
||||
///
|
||||
/// It sets the specified WireGuard attributes of the indexed device by
|
||||
/// communicating with WireGuard's generic netlink interface, like the
|
||||
/// `wg` tool does.
|
||||
pub async fn wg_set(
|
||||
genetlink: &mut GenetlinkHandle,
|
||||
index: u32,
|
||||
mut attr: Vec<WgDeviceAttrs>,
|
||||
) -> Result<()> {
|
||||
use futures_util::StreamExt as _;
|
||||
use netlink_packet_core::{NetlinkMessage, NetlinkPayload};
|
||||
use netlink_packet_generic::GenlMessage;
|
||||
use netlink_packet_wireguard::{Wireguard, WireguardCmd};
|
||||
|
||||
// Scope our `set` command to only the device of the specified index
|
||||
attr.insert(0, WgDeviceAttrs::IfIndex(index));
|
||||
|
||||
// Construct the WireGuard-specific netlink packet
|
||||
let wgc = Wireguard {
|
||||
cmd: WireguardCmd::SetDevice,
|
||||
nlas: attr,
|
||||
};
|
||||
|
||||
// Construct final message
|
||||
let genl = GenlMessage::from_payload(wgc);
|
||||
let mut nlmsg = NetlinkMessage::from(genl);
|
||||
nlmsg.header.flags = NLM_F_REQUEST | NLM_F_ACK;
|
||||
|
||||
// Send and wait for the ACK or error
|
||||
let (res, _) = genetlink.request(nlmsg).await?.into_future().await;
|
||||
if let Some(res) = res {
|
||||
let res = res?;
|
||||
if let NetlinkPayload::Error(err) = res.payload {
|
||||
return Err(err.to_io().into());
|
||||
}
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(any(target_os = "linux", target_os = "freebsd"))]
|
||||
pub async fn exchange(options: ExchangeOptions) -> Result<()> {
|
||||
use std::fs;
|
||||
|
||||
use anyhow::anyhow;
|
||||
use netlink_packet_wireguard::{constants::WG_KEY_LEN, nlas::WgDeviceAttrs};
|
||||
use rosenpass::{
|
||||
app_server::{AppServer, WireguardOut},
|
||||
config::Verbosity,
|
||||
protocol::{SPk, SSk, SymKey},
|
||||
};
|
||||
use rosenpass_secret_memory::Secret;
|
||||
use rosenpass_util::file::{LoadValue as _, LoadValueB64};
|
||||
|
||||
let (connection, rtnetlink, _) = rtnetlink::new_connection()?;
|
||||
tokio::spawn(connection);
|
||||
|
||||
let link_name = options.dev.unwrap_or("rosenpass0".to_string());
|
||||
let link_index = netlink::link_create_and_up(&rtnetlink, link_name.clone()).await?;
|
||||
|
||||
ctrlc_async::set_async_handler(async move {
|
||||
netlink::link_cleanup_standalone(link_index)
|
||||
.await
|
||||
.expect("Failed to clean up");
|
||||
})?;
|
||||
|
||||
// Deploy the classic wireguard private key
|
||||
let (connection, mut genetlink, _) = genetlink::new_connection()?;
|
||||
tokio::spawn(connection);
|
||||
|
||||
let wgsk_path = options.private_keys_dir.join("wgsk");
|
||||
|
||||
let wgsk = Secret::<WG_KEY_LEN>::load_b64(wgsk_path)?;
|
||||
|
||||
let mut attr: Vec<WgDeviceAttrs> = Vec::with_capacity(2);
|
||||
attr.push(WgDeviceAttrs::PrivateKey(*wgsk.secret()));
|
||||
|
||||
if let Some(listen) = options.listen {
|
||||
if listen.port() == u16::MAX {
|
||||
return Err(anyhow!("You may not use {} as the listen port.", u16::MAX));
|
||||
}
|
||||
|
||||
attr.push(WgDeviceAttrs::ListenPort(listen.port() + 1));
|
||||
}
|
||||
|
||||
netlink::wg_set(&mut genetlink, link_index, attr).await?;
|
||||
|
||||
let pqsk = options.private_keys_dir.join("pqsk");
|
||||
let pqpk = options.private_keys_dir.join("pqpk");
|
||||
|
||||
let sk = SSk::load(&pqsk)?;
|
||||
let pk = SPk::load(&pqpk)?;
|
||||
|
||||
let mut srv = Box::new(AppServer::new(
|
||||
sk,
|
||||
pk,
|
||||
if let Some(listen) = options.listen {
|
||||
vec![listen]
|
||||
} else {
|
||||
Vec::with_capacity(0)
|
||||
},
|
||||
if options.verbose {
|
||||
Verbosity::Verbose
|
||||
} else {
|
||||
Verbosity::Quiet
|
||||
},
|
||||
None,
|
||||
)?);
|
||||
|
||||
for peer in options.peers {
|
||||
let wgpk = peer.public_keys_dir.join("wgpk");
|
||||
let pqpk = peer.public_keys_dir.join("pqpk");
|
||||
let psk = peer.public_keys_dir.join("psk");
|
||||
|
||||
let mut extra_params: Vec<String> = Vec::with_capacity(6);
|
||||
if let Some(endpoint) = peer.endpoint {
|
||||
extra_params.push("endpoint".to_string());
|
||||
|
||||
// Peer endpoints always use (port + 1) in wg set params
|
||||
let endpoint = SocketAddr::new(endpoint.ip(), endpoint.port() + 1);
|
||||
extra_params.push(endpoint.to_string());
|
||||
}
|
||||
if let Some(persistent_keepalive) = peer.persistent_keepalive {
|
||||
extra_params.push("persistent-keepalive".to_string());
|
||||
extra_params.push(persistent_keepalive.to_string());
|
||||
}
|
||||
if let Some(allowed_ips) = &peer.allowed_ips {
|
||||
extra_params.push("allowed-ips".to_string());
|
||||
extra_params.push(allowed_ips.clone());
|
||||
}
|
||||
|
||||
srv.add_peer(
|
||||
if psk.exists() {
|
||||
Some(SymKey::load_b64(psk))
|
||||
} else {
|
||||
None
|
||||
}
|
||||
.transpose()?,
|
||||
SPk::load(&pqpk)?,
|
||||
None,
|
||||
Some(WireguardOut {
|
||||
dev: link_name.clone(),
|
||||
pk: fs::read_to_string(wgpk)?,
|
||||
extra_params,
|
||||
}),
|
||||
peer.endpoint.map(|x| x.to_string()),
|
||||
)?;
|
||||
}
|
||||
|
||||
let out = srv.event_loop();
|
||||
|
||||
netlink::link_cleanup(&rtnetlink, link_index).await?;
|
||||
|
||||
match out {
|
||||
Ok(_) => Ok(()),
|
||||
Err(e) => {
|
||||
// Check if the returned error is actually EINTR, in which case, the run actually succeeded.
|
||||
let is_ok = if let Some(e) = e.root_cause().downcast_ref::<std::io::Error>() {
|
||||
matches!(e.kind(), std::io::ErrorKind::Interrupted)
|
||||
} else {
|
||||
false
|
||||
};
|
||||
|
||||
if is_ok {
|
||||
Ok(())
|
||||
} else {
|
||||
Err(e)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
163
rp/src/key.rs
Normal file
163
rp/src/key.rs
Normal file
@@ -0,0 +1,163 @@
|
||||
use std::{
|
||||
fs::{self, DirBuilder, OpenOptions},
|
||||
io::Write,
|
||||
os::unix::fs::{DirBuilderExt, OpenOptionsExt, PermissionsExt},
|
||||
path::Path,
|
||||
};
|
||||
|
||||
use anyhow::{anyhow, Result};
|
||||
use base64::Engine;
|
||||
use zeroize::Zeroize;
|
||||
|
||||
use rosenpass::protocol::{SPk, SSk};
|
||||
use rosenpass_cipher_traits::Kem;
|
||||
use rosenpass_ciphers::kem::StaticKem;
|
||||
use rosenpass_secret_memory::{file::StoreSecret as _, Secret};
|
||||
|
||||
#[cfg(not(target_family = "unix"))]
|
||||
pub fn genkey(_: &Path) -> Result<()> {
|
||||
Err(anyhow!(
|
||||
"Your system {} is not yet supported. We are happy to receive patches to address this :)",
|
||||
std::env::consts::OS
|
||||
))
|
||||
}
|
||||
|
||||
#[cfg(target_family = "unix")]
|
||||
pub fn genkey(private_keys_dir: &Path) -> Result<()> {
|
||||
if private_keys_dir.exists() {
|
||||
if fs::metadata(private_keys_dir)?.permissions().mode() != 0o700 {
|
||||
return Err(anyhow!(
|
||||
"Directory {:?} has incorrect permissions: please use 0700 for proper security.",
|
||||
private_keys_dir
|
||||
));
|
||||
}
|
||||
} else {
|
||||
DirBuilder::new()
|
||||
.recursive(true)
|
||||
.mode(0o700)
|
||||
.create(private_keys_dir)?;
|
||||
}
|
||||
|
||||
let wgsk_path = private_keys_dir.join("wgsk");
|
||||
let pqsk_path = private_keys_dir.join("pqsk");
|
||||
let pqpk_path = private_keys_dir.join("pqpk");
|
||||
|
||||
if !wgsk_path.exists() {
|
||||
let wgsk: Secret<32> = Secret::random();
|
||||
|
||||
let mut wgsk_file = OpenOptions::new()
|
||||
.write(true)
|
||||
.create(true)
|
||||
.mode(0o600)
|
||||
.open(wgsk_path)?;
|
||||
|
||||
wgsk_file.write_all(
|
||||
base64::engine::general_purpose::STANDARD
|
||||
.encode(wgsk.secret())
|
||||
.as_bytes(),
|
||||
)?;
|
||||
} else {
|
||||
eprintln!(
|
||||
"WireGuard secret key already exists at {:#?}: not regenerating",
|
||||
wgsk_path
|
||||
);
|
||||
}
|
||||
|
||||
if !pqsk_path.exists() && !pqpk_path.exists() {
|
||||
let mut pqsk = SSk::random();
|
||||
let mut pqpk = SPk::random();
|
||||
StaticKem::keygen(pqsk.secret_mut(), pqpk.secret_mut())?;
|
||||
pqpk.store_secret(pqpk_path)?;
|
||||
pqsk.store_secret(pqsk_path)?;
|
||||
} else {
|
||||
eprintln!(
|
||||
"Rosenpass keys already exist in {:#?}: not regenerating",
|
||||
private_keys_dir
|
||||
);
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub fn pubkey(private_keys_dir: &Path, public_keys_dir: &Path) -> Result<()> {
|
||||
if public_keys_dir.exists() {
|
||||
return Err(anyhow!("Directory {:?} already exists", public_keys_dir));
|
||||
}
|
||||
|
||||
fs::create_dir_all(public_keys_dir)?;
|
||||
|
||||
let private_wgsk = private_keys_dir.join("wgsk");
|
||||
let public_wgpk = public_keys_dir.join("wgpk");
|
||||
let private_pqpk = private_keys_dir.join("pqpk");
|
||||
let public_pqpk = public_keys_dir.join("pqpk");
|
||||
|
||||
let wgsk = Secret::from_slice(
|
||||
&base64::engine::general_purpose::STANDARD.decode(fs::read_to_string(private_wgsk)?)?,
|
||||
);
|
||||
let mut wgpk: x25519_dalek::PublicKey = {
|
||||
let mut secret = x25519_dalek::StaticSecret::from(wgsk.secret().clone());
|
||||
let public = x25519_dalek::PublicKey::from(&secret);
|
||||
secret.zeroize();
|
||||
public
|
||||
};
|
||||
|
||||
fs::write(
|
||||
public_wgpk,
|
||||
base64::engine::general_purpose::STANDARD.encode(wgpk.as_bytes()),
|
||||
)?;
|
||||
wgpk.zeroize();
|
||||
|
||||
fs::copy(private_pqpk, public_pqpk)?;
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use std::fs;
|
||||
|
||||
use base64::Engine;
|
||||
use rosenpass::protocol::{SPk, SSk};
|
||||
use rosenpass_util::file::LoadValue;
|
||||
use tempfile::tempdir;
|
||||
|
||||
use crate::key::{genkey, pubkey};
|
||||
|
||||
#[test]
|
||||
fn it_works() {
|
||||
let private_keys_dir = tempdir().unwrap();
|
||||
fs::remove_dir(private_keys_dir.path()).unwrap();
|
||||
|
||||
// Guranteed to have 16MB of stack size
|
||||
stacker::grow(8 * 1024 * 1024, || {
|
||||
assert!(genkey(private_keys_dir.path()).is_ok());
|
||||
});
|
||||
|
||||
assert!(private_keys_dir.path().exists());
|
||||
assert!(private_keys_dir.path().is_dir());
|
||||
assert!(SPk::load(private_keys_dir.path().join("pqpk")).is_ok());
|
||||
assert!(SSk::load(private_keys_dir.path().join("pqsk")).is_ok());
|
||||
assert!(base64::engine::general_purpose::STANDARD
|
||||
.decode(&fs::read_to_string(private_keys_dir.path().join("wgsk")).unwrap())
|
||||
.is_ok());
|
||||
|
||||
let public_keys_dir = tempdir().unwrap();
|
||||
fs::remove_dir(public_keys_dir.path()).unwrap();
|
||||
|
||||
// Guranteed to have 16MB of stack size
|
||||
stacker::grow(8 * 1024 * 1024, || {
|
||||
assert!(pubkey(private_keys_dir.path(), public_keys_dir.path()).is_ok());
|
||||
});
|
||||
|
||||
assert!(public_keys_dir.path().exists());
|
||||
assert!(public_keys_dir.path().is_dir());
|
||||
assert!(SPk::load(public_keys_dir.path().join("pqpk")).is_ok());
|
||||
assert!(base64::engine::general_purpose::STANDARD
|
||||
.decode(&fs::read_to_string(public_keys_dir.path().join("wgpk")).unwrap())
|
||||
.is_ok());
|
||||
|
||||
let pk_1 = fs::read(private_keys_dir.path().join("pqpk")).unwrap();
|
||||
let pk_2 = fs::read(public_keys_dir.path().join("pqpk")).unwrap();
|
||||
assert_eq!(pk_1, pk_2);
|
||||
}
|
||||
}
|
||||
46
rp/src/main.rs
Normal file
46
rp/src/main.rs
Normal file
@@ -0,0 +1,46 @@
|
||||
use std::process::exit;
|
||||
|
||||
use cli::{Cli, Command};
|
||||
use exchange::exchange;
|
||||
use key::{genkey, pubkey};
|
||||
|
||||
mod cli;
|
||||
mod exchange;
|
||||
mod key;
|
||||
|
||||
#[tokio::main]
|
||||
async fn main() {
|
||||
let cli = match Cli::parse(std::env::args().peekable()) {
|
||||
Ok(cli) => cli,
|
||||
Err(err) => {
|
||||
eprintln!("{}", err);
|
||||
exit(1);
|
||||
}
|
||||
};
|
||||
|
||||
let command = cli.command.unwrap();
|
||||
|
||||
let res = match command {
|
||||
Command::GenKey { private_keys_dir } => genkey(&private_keys_dir),
|
||||
Command::PubKey {
|
||||
private_keys_dir,
|
||||
public_keys_dir,
|
||||
} => pubkey(&private_keys_dir, &public_keys_dir),
|
||||
Command::Exchange(mut options) => {
|
||||
options.verbose = cli.verbose;
|
||||
exchange(options).await
|
||||
}
|
||||
Command::Help => {
|
||||
println!("Usage: rp [verbose] genkey|pubkey|exchange [ARGS]...");
|
||||
Ok(())
|
||||
}
|
||||
};
|
||||
|
||||
match res {
|
||||
Ok(_) => {}
|
||||
Err(err) => {
|
||||
eprintln!("An error occurred: {}", err);
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user