mirror of
https://github.com/rosenpass/rosenpass.git
synced 2026-02-27 22:13:12 -08:00
258efe408c
This commit resolves multiple issues with the PSK broker integration. - The manual testing procedure never actually utilized the brokers due to the use of the outfile option, this led to issues with the broker being hidden. - The manual testing procedure omitted checking whether a PSK was actually sent to WireGuard entirely. This was fixed by writing an entirely new manual integration testing shell-script that can serve as a blueprint for future integration tests. - Many parts of the PSK broker code did not report (log) errors accurately; added error logging - BrokerServer set message.payload.return_code to the msg_type value, this led to crashes - The PSK broker commands all omitted to set the memfd policy, this led to immediate crashes once secrets where actually allocated - The MioBrokerClient IO state machine was broken and the design was too obtuse to debug. The state machine returned the length prefix as a message instead of actually interpreting it as a state machine. Seems the code was integrated but never actually tested. This was fixed by rewriting the entire state machine code using the new LengthPrefixEncoder/Decoder facilities. A write-buffer that was not being flushed is now handled by flushing the buffer in blocking-io mode.
115 lines
3.2 KiB
Rust
115 lines
3.2 KiB
Rust
#![cfg(target_os = "linux")]
|
|
|
|
use std::fmt::Debug;
|
|
|
|
use wireguard_uapi::linux as wg;
|
|
|
|
use crate::api::config::NetworkBrokerConfig;
|
|
use crate::api::msgs;
|
|
use crate::{SerializedBrokerConfig, WireGuardBroker};
|
|
|
|
#[derive(thiserror::Error, Debug)]
|
|
pub enum ConnectError {
|
|
#[error(transparent)]
|
|
ConnectError(#[from] wg::err::ConnectError),
|
|
}
|
|
|
|
#[derive(thiserror::Error, Debug)]
|
|
pub enum NetlinkError {
|
|
#[error(transparent)]
|
|
SetDevice(#[from] wg::err::SetDeviceError),
|
|
#[error(transparent)]
|
|
GetDevice(#[from] wg::err::GetDeviceError),
|
|
}
|
|
|
|
#[derive(thiserror::Error, Debug)]
|
|
pub enum SetPskError {
|
|
#[error("The indicated wireguard interface does not exist")]
|
|
NoSuchInterface,
|
|
#[error("The indicated peer does not exist on the wireguard interface")]
|
|
NoSuchPeer,
|
|
#[error(transparent)]
|
|
NetlinkError(#[from] NetlinkError),
|
|
}
|
|
|
|
impl From<wg::err::SetDeviceError> for SetPskError {
|
|
fn from(err: wg::err::SetDeviceError) -> Self {
|
|
NetlinkError::from(err).into()
|
|
}
|
|
}
|
|
|
|
impl From<wg::err::GetDeviceError> for SetPskError {
|
|
fn from(err: wg::err::GetDeviceError) -> Self {
|
|
NetlinkError::from(err).into()
|
|
}
|
|
}
|
|
|
|
use msgs::SetPskError as SetPskMsgsError;
|
|
use SetPskError as SetPskNetlinkError;
|
|
impl From<SetPskNetlinkError> for SetPskMsgsError {
|
|
fn from(err: SetPskError) -> Self {
|
|
match err {
|
|
SetPskNetlinkError::NoSuchPeer => SetPskMsgsError::NoSuchPeer,
|
|
_ => SetPskMsgsError::InternalError,
|
|
}
|
|
}
|
|
}
|
|
|
|
pub struct NetlinkWireGuardBroker {
|
|
sock: wg::WgSocket,
|
|
}
|
|
|
|
impl NetlinkWireGuardBroker {
|
|
pub fn new() -> Result<Self, ConnectError> {
|
|
let sock = wg::WgSocket::connect()?;
|
|
Ok(Self { sock })
|
|
}
|
|
}
|
|
|
|
impl Debug for NetlinkWireGuardBroker {
|
|
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
|
|
//TODO: Add useful info in Debug
|
|
f.debug_struct("NetlinkWireGuardBroker").finish()
|
|
}
|
|
}
|
|
|
|
impl WireGuardBroker for NetlinkWireGuardBroker {
|
|
type Error = SetPskError;
|
|
|
|
fn set_psk(&mut self, config: SerializedBrokerConfig) -> Result<(), Self::Error> {
|
|
let config: NetworkBrokerConfig = config
|
|
.try_into()
|
|
// TODO: I think this is the wrong error
|
|
.map_err(|_e| SetPskError::NoSuchInterface)?;
|
|
// Ensure that the peer exists by querying the device configuration
|
|
// TODO: Use InvalidInterfaceError
|
|
|
|
let state = self
|
|
.sock
|
|
.get_device(wg::DeviceInterface::from_name(config.iface))?;
|
|
|
|
if !state
|
|
.peers
|
|
.iter()
|
|
.any(|p| p.public_key == config.peer_id.value)
|
|
{
|
|
return Err(SetPskError::NoSuchPeer);
|
|
}
|
|
|
|
// Peer update description
|
|
let mut set_peer = wireguard_uapi::set::Peer::from_public_key(config.peer_id);
|
|
set_peer
|
|
.flags
|
|
.push(wireguard_uapi::linux::set::WgPeerF::UpdateOnly);
|
|
set_peer.preshared_key = Some(config.psk.secret());
|
|
|
|
// Device update description
|
|
let mut set_dev = wireguard_uapi::set::Device::from_ifname(config.iface);
|
|
set_dev.peers.push(set_peer);
|
|
|
|
self.sock.set_device(set_dev)?;
|
|
|
|
Ok(())
|
|
}
|
|
}
|