Compare commits
2 Commits
main
...
b972784d90
| Author | SHA1 | Date | |
|---|---|---|---|
|
b972784d90 | ||
|
|
8b2c9709fc |
12
README.md
12
README.md
@@ -1,5 +1,11 @@
|
||||
# vppn: Virtual Potentially Private Network
|
||||
|
||||
## TO DO
|
||||
|
||||
* peer - write status to file instead of using sockets
|
||||
* peer - improve relay selection
|
||||
* Double buffering in IFReader and ConnReader ?
|
||||
|
||||
## Hub Server Configuration
|
||||
|
||||
```
|
||||
@@ -53,17 +59,15 @@ Sign-in and configure.
|
||||
|
||||
Install the binary somewhere, for example `~/bin/vppn`.
|
||||
|
||||
Add the API key for your network name in `~/.vppn/<netname>/apikey`.
|
||||
|
||||
Create systemd file in `/etc/systemd/system/vppn.service`.
|
||||
|
||||
```
|
||||
[Service]
|
||||
AmbientCapabilities=AP_NET_ADMIN CAP_DAC_OVERRIDE CAP_CHOWN
|
||||
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_ADMIN
|
||||
Type=simple
|
||||
User=user
|
||||
WorkingDirectory=/home/user/
|
||||
ExecStart=/home/user/bin/vppn -name my_net_name -hub https://my.hub
|
||||
ExecStart=/home/user/vppn run my_net_name https://my.hub my_api_key
|
||||
Restart=always
|
||||
RestartSec=8
|
||||
TimeoutStopSec=24
|
||||
|
||||
@@ -1,69 +1,11 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"flag"
|
||||
"log"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
|
||||
"vppn/peer"
|
||||
|
||||
"git.crumpington.com/lib/flock"
|
||||
)
|
||||
|
||||
func main() {
|
||||
log.SetFlags(0)
|
||||
|
||||
name := flag.String("name", "", "network name (required)")
|
||||
hub := flag.String("hub", "", "hub base URL (required)")
|
||||
flag.Parse()
|
||||
|
||||
if *name == "" || *hub == "" {
|
||||
flag.Usage()
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
apiKey, err := loadAPIKey(*name)
|
||||
if err != nil {
|
||||
log.Fatalf("api key: %v", err)
|
||||
}
|
||||
|
||||
// Directory existence is guaranteed by the apikey file read above.
|
||||
lockFile, err := flock.TryLock(vppnPath(*name, "lock"))
|
||||
if err != nil {
|
||||
log.Fatalf("lock: %v", err)
|
||||
}
|
||||
defer flock.Unlock(lockFile)
|
||||
|
||||
state, err := peer.LoadOrInit(vppnPath(*name, "state.json"), *hub, apiKey)
|
||||
if err != nil {
|
||||
log.Fatalf("init: %v", err)
|
||||
}
|
||||
|
||||
ifaceName := strings.TrimSuffix(state.LocalDomain, ".local")
|
||||
app, err := peer.New(state, *hub, apiKey, ifaceName, state.LocalDomain, vppnPath(*name, "network.json"))
|
||||
if err != nil {
|
||||
log.Fatalf("start: %v", err)
|
||||
}
|
||||
|
||||
if err := app.Run(); err != nil {
|
||||
log.Fatalf("run: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func loadAPIKey(name string) (string, error) {
|
||||
data, err := os.ReadFile(vppnPath(name, "apikey"))
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
return strings.TrimSpace(string(data)), nil
|
||||
}
|
||||
|
||||
func vppnPath(name, file string) string {
|
||||
home, err := os.UserHomeDir()
|
||||
if err != nil {
|
||||
return filepath.Join(".vppn", name, file)
|
||||
}
|
||||
return filepath.Join(home, ".vppn", name, file)
|
||||
peer.Main2()
|
||||
}
|
||||
|
||||
34
go.mod
34
go.mod
@@ -3,25 +3,23 @@ module vppn
|
||||
go 1.25.1
|
||||
|
||||
require (
|
||||
git.crumpington.com/lib/flock v1.1.0
|
||||
git.crumpington.com/lib/idgen v1.0.0
|
||||
git.crumpington.com/lib/keyedmutex v1.1.0
|
||||
git.crumpington.com/lib/ratelimiter v1.1.1
|
||||
git.crumpington.com/lib/sqliteutil v1.1.1
|
||||
git.crumpington.com/lib/webutil v1.1.0
|
||||
github.com/mattn/go-sqlite3 v1.14.45
|
||||
golang.org/x/crypto v0.53.0
|
||||
golang.org/x/sys v0.46.0
|
||||
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
|
||||
git.crumpington.com/lib/go v0.9.1
|
||||
golang.org/x/crypto v0.42.0
|
||||
golang.org/x/sys v0.36.0
|
||||
)
|
||||
|
||||
require (
|
||||
github.com/google/go-cmp v0.7.0 // indirect
|
||||
github.com/mdlayher/genetlink v1.4.0 // indirect
|
||||
github.com/mdlayher/netlink v1.11.2 // indirect
|
||||
github.com/mdlayher/socket v0.6.1 // indirect
|
||||
golang.org/x/net v0.56.0 // indirect
|
||||
golang.org/x/sync v0.21.0 // indirect
|
||||
golang.org/x/text v0.38.0 // indirect
|
||||
golang.zx2c4.com/wireguard v0.0.0-20260522210424-ecfc5a8d5446 // indirect
|
||||
github.com/google/go-cmp v0.6.0 // indirect
|
||||
github.com/josharian/native v1.1.0 // indirect
|
||||
github.com/mattn/go-sqlite3 v1.14.32 // indirect
|
||||
github.com/mdlayher/genetlink v1.3.2 // indirect
|
||||
github.com/mdlayher/netlink v1.7.2 // indirect
|
||||
github.com/mdlayher/socket v0.5.1 // indirect
|
||||
github.com/vishvananda/netlink v1.3.1 // indirect
|
||||
github.com/vishvananda/netns v0.0.5 // indirect
|
||||
golang.org/x/net v0.44.0 // indirect
|
||||
golang.org/x/sync v0.17.0 // indirect
|
||||
golang.org/x/text v0.29.0 // indirect
|
||||
golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173 // indirect
|
||||
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10 // indirect
|
||||
)
|
||||
|
||||
68
go.sum
68
go.sum
@@ -1,38 +1,34 @@
|
||||
git.crumpington.com/lib/flock v1.1.0 h1:NzPUAXnywikN+ZPabzQw9eXAwvZolGUE3pjnSxnDwFk=
|
||||
git.crumpington.com/lib/flock v1.1.0/go.mod h1:prUmtkjpGDUakQh6TiEAylrgDTPG0HuBOUe8Lq4HKsc=
|
||||
git.crumpington.com/lib/idgen v1.0.0 h1:0Jre8R3B+RaMOKmCgagBT659wGM93QNpamuGF2e9SII=
|
||||
git.crumpington.com/lib/idgen v1.0.0/go.mod h1:Q8kV11Zta4P5WKDpBwsekEsnOe9IysVLsW+gPhbzFTc=
|
||||
git.crumpington.com/lib/keyedmutex v1.1.0 h1:XOlk9f0rnwmr5yNoIvPteM2W2uakZqT4tnZKficrXho=
|
||||
git.crumpington.com/lib/keyedmutex v1.1.0/go.mod h1:ova6v/794UCZJ5FKKrLpaol0wfNZZTB3plLObSWaGk4=
|
||||
git.crumpington.com/lib/ratelimiter v1.1.1 h1:8jVDVK/I0zzE3EHCu+sUeZN8a9Aqzm+PG4WrlnEvLes=
|
||||
git.crumpington.com/lib/ratelimiter v1.1.1/go.mod h1:TycyPTi/aBfnWW8F51yfo/5fSP/qKywDREqsph7TEns=
|
||||
git.crumpington.com/lib/sqliteutil v1.1.1 h1:xwfp/l2BL4nfw8Ye0Cex2HdGJQKQ1YBCFtDiMeUhnzk=
|
||||
git.crumpington.com/lib/sqliteutil v1.1.1/go.mod h1:K8OelqOwhSYAZK42v8hKK6UmafItGf2WcMfNlq9Gfeo=
|
||||
git.crumpington.com/lib/webutil v1.1.0 h1:S9CaRBbVgYOUsgZ5AU1gAJxkxzr8Zjn2v84MoMOy1+I=
|
||||
git.crumpington.com/lib/webutil v1.1.0/go.mod h1:+LNLGApoe9InAJ7DCeLfiDmYov87XU3crYRHr/RYv2E=
|
||||
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
|
||||
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
|
||||
github.com/mattn/go-sqlite3 v1.14.45 h1:6KA/spDguL3KV8rnybG7ezSaE4SeMR3KC9VbUoAQaIk=
|
||||
github.com/mattn/go-sqlite3 v1.14.45/go.mod h1:pjEuOr8IwzLJP2MfGeTb0A35jauH+C2kbHKBr7yXKVQ=
|
||||
github.com/mdlayher/genetlink v1.4.0 h1:f/Xs7Y2T+GyX9b3dbiUhnLE9InGs5F9RxJ2JwBMl71o=
|
||||
github.com/mdlayher/genetlink v1.4.0/go.mod h1:d1hrKr8fwZU2JkcAtQUAzeTrI7nbgQSl+5k1cC0biSA=
|
||||
github.com/mdlayher/netlink v1.11.2 h1:HKh2jqe+omdSWcQ88nrT7INE61B0NXfiSPFdgL4YbNI=
|
||||
github.com/mdlayher/netlink v1.11.2/go.mod h1:uT2Yc/QLaZubzDpZIBi9d4GoeLwtp3x1AMeqSRrK2sA=
|
||||
github.com/mdlayher/socket v0.6.1 h1:M7uj2NtuujUY4mYr1C57NmfNiRHbkKpnBxO856lsc3A=
|
||||
github.com/mdlayher/socket v0.6.1/go.mod h1:+/SGtqc9V+5dAuRgQsU0fGBI+oRDiW7O2Obx10OIWfg=
|
||||
github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721 h1:RlZweED6sbSArvlE924+mUcZuXKLBHA35U7LN621Bws=
|
||||
github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721/go.mod h1:Ickgr2WtCLZ2MDGd4Gr0geeCH5HybhRJbonOgQpvSxc=
|
||||
golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
|
||||
golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
|
||||
golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
|
||||
golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
|
||||
golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
|
||||
golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
|
||||
golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
|
||||
golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||
golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
|
||||
golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
|
||||
golang.zx2c4.com/wireguard v0.0.0-20260522210424-ecfc5a8d5446 h1:cqHQ3AycTHvM2R7ikgyX57D+XvtcSnGylsLkOVhta/w=
|
||||
golang.zx2c4.com/wireguard v0.0.0-20260522210424-ecfc5a8d5446/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
|
||||
git.crumpington.com/lib/go v0.9.1 h1:xLBzcgiZRB6Ky3Ce9hKE+Ko0YbkA4USF4eJk5i5RJF4=
|
||||
git.crumpington.com/lib/go v0.9.1/go.mod h1:5nnfjdnUnj/FHhakaliKQKsKeSkUb0GEUKF3PqRgUXg=
|
||||
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
|
||||
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
|
||||
github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
|
||||
github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
|
||||
github.com/mattn/go-sqlite3 v1.14.32 h1:JD12Ag3oLy1zQA+BNn74xRgaBbdhbNIDYvQUEuuErjs=
|
||||
github.com/mattn/go-sqlite3 v1.14.32/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
|
||||
github.com/mdlayher/genetlink v1.3.2 h1:KdrNKe+CTu+IbZnm/GVUMXSqBBLqcGpRDa0xkQy56gw=
|
||||
github.com/mdlayher/genetlink v1.3.2/go.mod h1:tcC3pkCrPUGIKKsCsp0B3AdaaKuHtaxoJRz3cc+528o=
|
||||
github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
|
||||
github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
|
||||
github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
|
||||
github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
|
||||
github.com/vishvananda/netlink v1.3.1 h1:3AEMt62VKqz90r0tmNhog0r/PpWKmrEShJU0wJW6bV0=
|
||||
github.com/vishvananda/netlink v1.3.1/go.mod h1:ARtKouGSTGchR8aMwmkzC0qiNPrrWO5JS/XMVl45+b4=
|
||||
github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY=
|
||||
github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
|
||||
golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI=
|
||||
golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8=
|
||||
golang.org/x/net v0.44.0 h1:evd8IRDyfNBMBTTY5XRF1vaZlD+EmWx6x8PkhR04H/I=
|
||||
golang.org/x/net v0.44.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
|
||||
golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
|
||||
golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
|
||||
golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
|
||||
golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
|
||||
golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
|
||||
golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
|
||||
golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173 h1:/jFs0duh4rdb8uIfPMv78iAJGcPKDeqAFnaLBropIC4=
|
||||
golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173/go.mod h1:tkCQ4FQXmpAgYVh++1cq16/dH4QJtmvpRv19DWGAHSA=
|
||||
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10 h1:3GDAcqdIg1ozBNLgPy4SLT84nfcBjr6rhGtXYtrkWLU=
|
||||
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10/go.mod h1:T97yPqesLiNrOYxkwmhMI0ZIlJDm+p0PMR8eRVeR5tQ=
|
||||
|
||||
206
hub/api/api.go
206
hub/api/api.go
@@ -8,11 +8,10 @@ import (
|
||||
"sync"
|
||||
"time"
|
||||
"vppn/hub/api/db"
|
||||
"vppn/hub/errs"
|
||||
"vppn/m"
|
||||
|
||||
"git.crumpington.com/lib/idgen"
|
||||
"git.crumpington.com/lib/sqliteutil"
|
||||
"git.crumpington.com/lib/go/idgen"
|
||||
"git.crumpington.com/lib/go/sqliteutil"
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
)
|
||||
|
||||
@@ -27,8 +26,7 @@ type API struct {
|
||||
}
|
||||
|
||||
func New(dbPath string) (*API, error) {
|
||||
dbPath += "?_journal=WAL&_foreign_keys=on&_busy_timeout=5000&_txlock=immediate"
|
||||
sqlDB, err := sql.Open("sqlite3", dbPath)
|
||||
sqlDB, err := sql.Open("sqlite3", dbPath+"?_journal=WAL")
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
@@ -42,13 +40,7 @@ func New(dbPath string) (*API, error) {
|
||||
sessions: make(map[string]*Session),
|
||||
}
|
||||
|
||||
if err := a.ensurePassword(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
go a.sweepSessions()
|
||||
|
||||
return a, nil
|
||||
return a, a.ensurePassword()
|
||||
}
|
||||
|
||||
func (a *API) ensurePassword() error {
|
||||
@@ -66,194 +58,130 @@ func (a *API) ensurePassword() error {
|
||||
|
||||
hashed, err := bcrypt.GenerateFromPassword([]byte(pwd), bcrypt.DefaultCost)
|
||||
if err != nil {
|
||||
log.Printf("Failed to generate password: %v", err)
|
||||
return errs.ErrUnexpected
|
||||
return err
|
||||
}
|
||||
|
||||
conf := &Config{ConfigID: 1, Password: hashed}
|
||||
return errs.DB(db.Config_Insert(a.db, conf))
|
||||
return db.Config_Insert(a.db, conf)
|
||||
}
|
||||
|
||||
func (a *API) Config_Get() (*Config, error) {
|
||||
func (a *API) Config_Get() *Config {
|
||||
conf, err := db.Config_Get(a.db, 1)
|
||||
return conf, errs.DB(err)
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
return conf
|
||||
}
|
||||
|
||||
func (a *API) Config_Update(conf *Config) error {
|
||||
a.lock.Lock()
|
||||
defer a.lock.Unlock()
|
||||
return errs.DB(db.Config_Update(a.db, conf))
|
||||
return db.Config_Update(a.db, conf)
|
||||
}
|
||||
|
||||
func (a *API) Session_Delete(sessionID string) {
|
||||
func (a *API) Session_Delete(sessionID string) error {
|
||||
a.sessionsMu.Lock()
|
||||
defer a.sessionsMu.Unlock()
|
||||
delete(a.sessions, sessionID)
|
||||
return nil
|
||||
}
|
||||
|
||||
const (
|
||||
sessionTTL = 24 * 21 * time.Hour // sessions expire 21 days after last use
|
||||
sessionSweepEvery = time.Hour // cadence of expired-session eviction
|
||||
)
|
||||
|
||||
// Session_Get returns a snapshot copy of the signed-in session for sessionID,
|
||||
// or the zero Session if the cookie is missing/unknown/expired. It never
|
||||
// creates a session, so anonymous requests cost no memory — a session is minted
|
||||
// only by Session_SignIn. Returning a value (not the stored pointer) keeps
|
||||
// callers from racing on the shared struct.
|
||||
func (a *API) Session_Get(sessionID string) Session {
|
||||
func (a *API) Session_Get(sessionID string) (*Session, error) {
|
||||
a.sessionsMu.Lock()
|
||||
defer a.sessionsMu.Unlock()
|
||||
|
||||
s, ok := a.sessions[sessionID]
|
||||
|
||||
if sessionID == "" || !ok {
|
||||
return Session{}
|
||||
}
|
||||
|
||||
if time.Since(s.LastSeenAt) > sessionTTL {
|
||||
delete(a.sessions, sessionID)
|
||||
return Session{}
|
||||
}
|
||||
|
||||
s.LastSeenAt = time.Now()
|
||||
return *s
|
||||
}
|
||||
|
||||
// Session_SignIn verifies pwd and, on success, mints a fresh signed-in session,
|
||||
// returning it so the caller can set the cookie. A new ID per sign-in rotates
|
||||
// the session at the privilege boundary (session-fixation resistance).
|
||||
func (a *API) Session_SignIn(pwd string) (Session, error) {
|
||||
conf, err := a.Config_Get()
|
||||
if err != nil {
|
||||
log.Printf("Failed to get config: %v", err)
|
||||
return Session{}, errs.ErrUnexpected
|
||||
}
|
||||
if err := bcrypt.CompareHashAndPassword(conf.Password, []byte(pwd)); err != nil {
|
||||
return Session{}, errs.ErrNotAuthorized
|
||||
}
|
||||
|
||||
a.sessionsMu.Lock()
|
||||
defer a.sessionsMu.Unlock()
|
||||
s := &Session{
|
||||
SessionID: idgen.NewToken(),
|
||||
LastSeenAt: time.Now(),
|
||||
}
|
||||
a.sessions[s.SessionID] = s
|
||||
return *s, nil
|
||||
}
|
||||
|
||||
func (a *API) Session_InvalidateAll() Session {
|
||||
a.sessionsMu.Lock()
|
||||
defer a.sessionsMu.Unlock()
|
||||
|
||||
clear(a.sessions)
|
||||
s := &Session{
|
||||
SessionID: idgen.NewToken(),
|
||||
LastSeenAt: time.Now(),
|
||||
}
|
||||
a.sessions[s.SessionID] = s
|
||||
return *s
|
||||
}
|
||||
|
||||
// sweepSessions periodically evicts sessions past their TTL. Without it, a
|
||||
// signed-in session whose ID is never presented again would linger forever
|
||||
// (Session_Get only evicts on a lookup of that same ID).
|
||||
func (a *API) sweepSessions() {
|
||||
for range time.Tick(sessionSweepEvery) {
|
||||
a.sessionsMu.Lock()
|
||||
for id, s := range a.sessions {
|
||||
if time.Since(s.LastSeenAt) > sessionTTL {
|
||||
delete(a.sessions, id)
|
||||
if sessionID != "" {
|
||||
s, ok := a.sessions[sessionID]
|
||||
if ok {
|
||||
if timeSince(s.LastSeenAt) <= 86400*21 {
|
||||
if timeSince(s.LastSeenAt) > 86400*7 {
|
||||
s.LastSeenAt = time.Now().Unix()
|
||||
}
|
||||
return s, nil
|
||||
}
|
||||
delete(a.sessions, sessionID)
|
||||
}
|
||||
a.sessionsMu.Unlock()
|
||||
}
|
||||
|
||||
return a.session_Create(), nil
|
||||
}
|
||||
|
||||
// caller must hold sessionsMu
|
||||
func (a *API) session_Create() *Session {
|
||||
s := &Session{
|
||||
SessionID: idgen.NewToken(),
|
||||
CreatedAt: time.Now().Unix(),
|
||||
LastSeenAt: time.Now().Unix(),
|
||||
}
|
||||
a.sessions[s.SessionID] = s
|
||||
return s
|
||||
}
|
||||
|
||||
func (a *API) Session_SignIn(s *Session, pwd string) error {
|
||||
conf := a.Config_Get()
|
||||
if err := bcrypt.CompareHashAndPassword(conf.Password, []byte(pwd)); err != nil {
|
||||
return ErrNotAuthorized
|
||||
}
|
||||
a.sessionsMu.Lock()
|
||||
s.SignedIn = true
|
||||
a.sessionsMu.Unlock()
|
||||
return nil
|
||||
}
|
||||
|
||||
func (a *API) Network_Create(n *Network) error {
|
||||
a.lock.Lock()
|
||||
defer a.lock.Unlock()
|
||||
|
||||
n.NetworkID = idgen.NextID(0)
|
||||
return errs.DB(db.Network_Insert(a.db, n))
|
||||
return db.Network_Insert(a.db, n)
|
||||
}
|
||||
|
||||
func (a *API) Network_Delete(n *Network) error {
|
||||
a.lock.Lock()
|
||||
defer a.lock.Unlock()
|
||||
|
||||
exists, err := db.Network_HasPeers(a.db, n.NetworkID)
|
||||
if err != nil {
|
||||
return errs.DB(err)
|
||||
}
|
||||
if exists {
|
||||
return errs.Conflict.WithMsg("Delete all peers before deleting network.")
|
||||
}
|
||||
|
||||
return errs.DB(db.Network_Delete(a.db, n.NetworkID))
|
||||
return db.Network_Delete(a.db, n.NetworkID)
|
||||
}
|
||||
|
||||
func (a *API) Network_Get(id int64) (*Network, error) {
|
||||
n, err := db.Network_Get(a.db, id)
|
||||
return n, errs.DB(err)
|
||||
return db.Network_Get(a.db, id)
|
||||
}
|
||||
|
||||
func (a *API) Network_List() ([]*Network, error) {
|
||||
const query = db.Network_SelectQuery + ` ORDER BY LocalDomain ASC`
|
||||
n, err := db.Network_List(a.db, query)
|
||||
return n, errs.DB(err)
|
||||
const query = db.Network_SelectQuery + ` ORDER BY Name ASC`
|
||||
return db.Network_List(a.db, query)
|
||||
}
|
||||
|
||||
func (a *API) Peer_CreateNew(p *Peer) error {
|
||||
a.lock.Lock()
|
||||
defer a.lock.Unlock()
|
||||
|
||||
p.Version = idgen.NextID(0)
|
||||
p.WGPubKey = []byte{}
|
||||
p.SignPubKey = []byte{}
|
||||
p.APIKey = idgen.NewToken()
|
||||
|
||||
return errs.DB(db.Peer_Insert(a.db, p))
|
||||
return db.Peer_Insert(a.db, p)
|
||||
}
|
||||
|
||||
func (a *API) Peer_Init(peer *Peer, args m.PeerInitArgs) error {
|
||||
a.lock.Lock()
|
||||
defer a.lock.Unlock()
|
||||
|
||||
// Re-read from DB inside the lock — the caller's copy was fetched before
|
||||
// we held the lock, so it may be stale under concurrent requests.
|
||||
current, err := db.Peer_Get(a.db, peer.NetworkID, peer.PeerIP)
|
||||
if err != nil {
|
||||
return errs.DB(err)
|
||||
}
|
||||
if len(current.WGPubKey) != 0 {
|
||||
return errs.ErrAlreadyExists
|
||||
}
|
||||
|
||||
peer.Version = idgen.NextID(0)
|
||||
peer.WGPubKey = args.WGPubKey
|
||||
peer.SignPubKey = args.SignPubKey
|
||||
|
||||
return errs.DB(db.Peer_UpdateFull(a.db, peer))
|
||||
return db.Peer_UpdateFull(a.db, peer)
|
||||
}
|
||||
|
||||
func (a *API) Peer_Delete(networkID int64, peerIP byte) error {
|
||||
func (a *API) Peer_Update(p *Peer) error {
|
||||
a.lock.Lock()
|
||||
defer a.lock.Unlock()
|
||||
|
||||
return errs.DB(db.Peer_Delete(a.db, networkID, peerIP))
|
||||
p.Version = idgen.NextID(0)
|
||||
return db.Peer_Update(a.db, p)
|
||||
}
|
||||
|
||||
func (a *API) Peer_Delete(networkID int64, peerIP byte) error {
|
||||
return db.Peer_Delete(a.db, networkID, peerIP)
|
||||
}
|
||||
|
||||
func (a *API) Peer_List(networkID int64) ([]*Peer, error) {
|
||||
p, err := db.Peer_ListAll(a.db, networkID)
|
||||
return p, errs.DB(err)
|
||||
return db.Peer_ListAll(a.db, networkID)
|
||||
}
|
||||
|
||||
func (a *API) Peer_Get(networkID int64, ip byte) (*Peer, error) {
|
||||
p, err := db.Peer_Get(a.db, networkID, ip)
|
||||
return p, errs.DB(err)
|
||||
return db.Peer_Get(a.db, networkID, ip)
|
||||
}
|
||||
|
||||
func (a *API) Peer_GetByAPIKey(key string) (*Peer, error) {
|
||||
p, err := db.Peer_GetByAPIKey(a.db, key)
|
||||
return p, errs.DB(err)
|
||||
return db.Peer_GetByAPIKey(a.db, key)
|
||||
}
|
||||
|
||||
@@ -51,7 +51,7 @@ func Config_Update(
|
||||
|
||||
n, err := result.RowsAffected()
|
||||
if err != nil {
|
||||
return err
|
||||
panic(err)
|
||||
}
|
||||
switch n {
|
||||
case 0:
|
||||
@@ -79,7 +79,7 @@ func Config_UpdateFull(
|
||||
|
||||
n, err := result.RowsAffected()
|
||||
if err != nil {
|
||||
return err
|
||||
panic(err)
|
||||
}
|
||||
switch n {
|
||||
case 0:
|
||||
@@ -102,7 +102,7 @@ func Config_Delete(
|
||||
|
||||
n, err := result.RowsAffected()
|
||||
if err != nil {
|
||||
return err
|
||||
panic(err)
|
||||
}
|
||||
switch n {
|
||||
case 0:
|
||||
@@ -191,12 +191,12 @@ func Config_List(
|
||||
// ----------------------------------------------------------------------------
|
||||
|
||||
type Network struct {
|
||||
NetworkID int64
|
||||
LocalDomain string
|
||||
Network []byte
|
||||
NetworkID int64
|
||||
Name string
|
||||
Network []byte
|
||||
}
|
||||
|
||||
const Network_SelectQuery = "SELECT NetworkID,LocalDomain,Network FROM networks"
|
||||
const Network_SelectQuery = "SELECT NetworkID,Name,Network FROM networks"
|
||||
|
||||
func Network_Insert(
|
||||
tx TX,
|
||||
@@ -207,7 +207,7 @@ func Network_Insert(
|
||||
return err
|
||||
}
|
||||
|
||||
_, err = tx.Exec("INSERT INTO networks(NetworkID,LocalDomain,Network) VALUES(?,?,?)", row.NetworkID, row.LocalDomain, row.Network)
|
||||
_, err = tx.Exec("INSERT INTO networks(NetworkID,Name,Network) VALUES(?,?,?)", row.NetworkID, row.Name, row.Network)
|
||||
return err
|
||||
}
|
||||
|
||||
@@ -220,14 +220,14 @@ func Network_UpdateFull(
|
||||
return err
|
||||
}
|
||||
|
||||
result, err := tx.Exec("UPDATE networks SET LocalDomain=?,Network=? WHERE NetworkID=?", row.LocalDomain, row.Network, row.NetworkID)
|
||||
result, err := tx.Exec("UPDATE networks SET Name=?,Network=? WHERE NetworkID=?", row.Name, row.Network, row.NetworkID)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
n, err := result.RowsAffected()
|
||||
if err != nil {
|
||||
return err
|
||||
panic(err)
|
||||
}
|
||||
switch n {
|
||||
case 0:
|
||||
@@ -250,7 +250,7 @@ func Network_Delete(
|
||||
|
||||
n, err := result.RowsAffected()
|
||||
if err != nil {
|
||||
return err
|
||||
panic(err)
|
||||
}
|
||||
switch n {
|
||||
case 0:
|
||||
@@ -270,8 +270,8 @@ func Network_Get(
|
||||
err error,
|
||||
) {
|
||||
row = &Network{}
|
||||
r := tx.QueryRow("SELECT NetworkID,LocalDomain,Network FROM networks WHERE NetworkID=?", NetworkID)
|
||||
if err = r.Scan(&row.NetworkID, &row.LocalDomain, &row.Network); err != nil {
|
||||
r := tx.QueryRow("SELECT NetworkID,Name,Network FROM networks WHERE NetworkID=?", NetworkID)
|
||||
if err = r.Scan(&row.NetworkID, &row.Name, &row.Network); err != nil {
|
||||
row = nil
|
||||
}
|
||||
return
|
||||
@@ -287,7 +287,7 @@ func Network_GetWhere(
|
||||
) {
|
||||
row = &Network{}
|
||||
r := tx.QueryRow(query, args...)
|
||||
if err = r.Scan(&row.NetworkID, &row.LocalDomain, &row.Network); err != nil {
|
||||
if err = r.Scan(&row.NetworkID, &row.Name, &row.Network); err != nil {
|
||||
row = nil
|
||||
}
|
||||
return
|
||||
@@ -309,7 +309,7 @@ func Network_Iterate(
|
||||
defer rows.Close()
|
||||
for rows.Next() {
|
||||
row := &Network{}
|
||||
err := rows.Scan(&row.NetworkID, &row.LocalDomain, &row.Network)
|
||||
err := rows.Scan(&row.NetworkID, &row.Name, &row.Network)
|
||||
if !yield(row, err) {
|
||||
return
|
||||
}
|
||||
@@ -339,19 +339,20 @@ func Network_List(
|
||||
// ----------------------------------------------------------------------------
|
||||
|
||||
type Peer struct {
|
||||
NetworkID int64
|
||||
PeerIP byte
|
||||
APIKey string
|
||||
Name string
|
||||
Addr4 []byte
|
||||
Addr6 []byte
|
||||
Port uint16
|
||||
Relay bool
|
||||
WGPubKey []byte
|
||||
SignPubKey []byte
|
||||
NetworkID int64
|
||||
PeerIP byte
|
||||
Version int64
|
||||
APIKey string
|
||||
Name string
|
||||
PublicIP1 []byte
|
||||
Port1 uint16
|
||||
PublicIP2 []byte
|
||||
Port2 uint16
|
||||
Relay bool
|
||||
WGPubKey []byte
|
||||
}
|
||||
|
||||
const Peer_SelectQuery = "SELECT NetworkID,PeerIP,APIKey,Name,Addr4,Addr6,Port,Relay,WGPubKey,SignPubKey FROM peers"
|
||||
const Peer_SelectQuery = "SELECT NetworkID,PeerIP,Version,APIKey,Name,PublicIP1,Port1,PublicIP2,Port2,Relay,WGPubKey FROM peers"
|
||||
|
||||
func Peer_Insert(
|
||||
tx TX,
|
||||
@@ -362,10 +363,38 @@ func Peer_Insert(
|
||||
return err
|
||||
}
|
||||
|
||||
_, err = tx.Exec("INSERT INTO peers(NetworkID,PeerIP,APIKey,Name,Addr4,Addr6,Port,Relay,WGPubKey,SignPubKey) VALUES(?,?,?,?,?,?,?,?,?,?)", row.NetworkID, row.PeerIP, row.APIKey, row.Name, row.Addr4, row.Addr6, row.Port, row.Relay, row.WGPubKey, row.SignPubKey)
|
||||
_, err = tx.Exec("INSERT INTO peers(NetworkID,PeerIP,Version,APIKey,Name,PublicIP1,Port1,PublicIP2,Port2,Relay,WGPubKey) VALUES(?,?,?,?,?,?,?,?,?,?,?)", row.NetworkID, row.PeerIP, row.Version, row.APIKey, row.Name, row.PublicIP1, row.Port1, row.PublicIP2, row.Port2, row.Relay, row.WGPubKey)
|
||||
return err
|
||||
}
|
||||
|
||||
func Peer_Update(
|
||||
tx TX,
|
||||
row *Peer,
|
||||
) (err error) {
|
||||
Peer_Sanitize(row)
|
||||
if err = Peer_Validate(row); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
result, err := tx.Exec("UPDATE peers SET Version=?,Name=?,PublicIP1=?,Port1=?,PublicIP2=?,Port2=?,Relay=? WHERE NetworkID=? AND PeerIP=?", row.Version, row.Name, row.PublicIP1, row.Port1, row.PublicIP2, row.Port2, row.Relay, row.NetworkID, row.PeerIP)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
n, err := result.RowsAffected()
|
||||
if err != nil {
|
||||
panic(err)
|
||||
}
|
||||
switch n {
|
||||
case 0:
|
||||
return sql.ErrNoRows
|
||||
case 1:
|
||||
return nil
|
||||
default:
|
||||
panic("multiple rows updated")
|
||||
}
|
||||
}
|
||||
|
||||
func Peer_UpdateFull(
|
||||
tx TX,
|
||||
row *Peer,
|
||||
@@ -375,14 +404,14 @@ func Peer_UpdateFull(
|
||||
return err
|
||||
}
|
||||
|
||||
result, err := tx.Exec("UPDATE peers SET APIKey=?,Name=?,Addr4=?,Addr6=?,Port=?,Relay=?,WGPubKey=?,SignPubKey=? WHERE NetworkID=? AND PeerIP=?", row.APIKey, row.Name, row.Addr4, row.Addr6, row.Port, row.Relay, row.WGPubKey, row.SignPubKey, row.NetworkID, row.PeerIP)
|
||||
result, err := tx.Exec("UPDATE peers SET Version=?,APIKey=?,Name=?,PublicIP1=?,Port1=?,PublicIP2=?,Port2=?,Relay=?,WGPubKey=? WHERE NetworkID=? AND PeerIP=?", row.Version, row.APIKey, row.Name, row.PublicIP1, row.Port1, row.PublicIP2, row.Port2, row.Relay, row.WGPubKey, row.NetworkID, row.PeerIP)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
n, err := result.RowsAffected()
|
||||
if err != nil {
|
||||
return err
|
||||
panic(err)
|
||||
}
|
||||
switch n {
|
||||
case 0:
|
||||
@@ -406,7 +435,7 @@ func Peer_Delete(
|
||||
|
||||
n, err := result.RowsAffected()
|
||||
if err != nil {
|
||||
return err
|
||||
panic(err)
|
||||
}
|
||||
switch n {
|
||||
case 0:
|
||||
@@ -427,8 +456,8 @@ func Peer_Get(
|
||||
err error,
|
||||
) {
|
||||
row = &Peer{}
|
||||
r := tx.QueryRow("SELECT NetworkID,PeerIP,APIKey,Name,Addr4,Addr6,Port,Relay,WGPubKey,SignPubKey FROM peers WHERE NetworkID=? AND PeerIP=?", NetworkID, PeerIP)
|
||||
if err = r.Scan(&row.NetworkID, &row.PeerIP, &row.APIKey, &row.Name, &row.Addr4, &row.Addr6, &row.Port, &row.Relay, &row.WGPubKey, &row.SignPubKey); err != nil {
|
||||
r := tx.QueryRow("SELECT NetworkID,PeerIP,Version,APIKey,Name,PublicIP1,Port1,PublicIP2,Port2,Relay,WGPubKey FROM peers WHERE NetworkID=? AND PeerIP=?", NetworkID, PeerIP)
|
||||
if err = r.Scan(&row.NetworkID, &row.PeerIP, &row.Version, &row.APIKey, &row.Name, &row.PublicIP1, &row.Port1, &row.PublicIP2, &row.Port2, &row.Relay, &row.WGPubKey); err != nil {
|
||||
row = nil
|
||||
}
|
||||
return
|
||||
@@ -444,7 +473,7 @@ func Peer_GetWhere(
|
||||
) {
|
||||
row = &Peer{}
|
||||
r := tx.QueryRow(query, args...)
|
||||
if err = r.Scan(&row.NetworkID, &row.PeerIP, &row.APIKey, &row.Name, &row.Addr4, &row.Addr6, &row.Port, &row.Relay, &row.WGPubKey, &row.SignPubKey); err != nil {
|
||||
if err = r.Scan(&row.NetworkID, &row.PeerIP, &row.Version, &row.APIKey, &row.Name, &row.PublicIP1, &row.Port1, &row.PublicIP2, &row.Port2, &row.Relay, &row.WGPubKey); err != nil {
|
||||
row = nil
|
||||
}
|
||||
return
|
||||
@@ -466,7 +495,7 @@ func Peer_Iterate(
|
||||
defer rows.Close()
|
||||
for rows.Next() {
|
||||
row := &Peer{}
|
||||
err := rows.Scan(&row.NetworkID, &row.PeerIP, &row.APIKey, &row.Name, &row.Addr4, &row.Addr6, &row.Port, &row.Relay, &row.WGPubKey, &row.SignPubKey)
|
||||
err := rows.Scan(&row.NetworkID, &row.PeerIP, &row.Version, &row.APIKey, &row.Name, &row.PublicIP1, &row.Port1, &row.PublicIP2, &row.Port2, &row.Relay, &row.WGPubKey)
|
||||
if !yield(row, err) {
|
||||
return
|
||||
}
|
||||
|
||||
@@ -1,9 +1,17 @@
|
||||
package db
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"net/netip"
|
||||
"strings"
|
||||
"vppn/hub/errs"
|
||||
)
|
||||
|
||||
var (
|
||||
ErrInvalidIP = errors.New("invalid IP")
|
||||
ErrNonPrivateIP = errors.New("non-private IP")
|
||||
ErrInvalidPort = errors.New("invalid port")
|
||||
ErrInvalidNetName = errors.New("invalid network name")
|
||||
ErrInvalidPeerName = errors.New("invalid peer name")
|
||||
)
|
||||
|
||||
func Config_Sanitize(c *Config) {
|
||||
@@ -14,7 +22,7 @@ func Config_Validate(c *Config) error {
|
||||
}
|
||||
|
||||
func Network_Sanitize(n *Network) {
|
||||
n.LocalDomain = strings.TrimSpace(n.LocalDomain)
|
||||
n.Name = strings.TrimSpace(n.Name)
|
||||
|
||||
if addr, ok := netip.AddrFromSlice(n.Network); ok {
|
||||
n.Network = addr.AsSlice()
|
||||
@@ -22,79 +30,71 @@ func Network_Sanitize(n *Network) {
|
||||
}
|
||||
|
||||
func Network_Validate(c *Network) error {
|
||||
// 15 bytes is linux limit for network interface names. With ending .local,
|
||||
// max length is 21.
|
||||
if len(c.LocalDomain) == 0 || len(c.LocalDomain) > 21 {
|
||||
return errs.ErrInvalidNetName
|
||||
// 16 bytes is linux limit for network interface names.
|
||||
if len(c.Name) == 0 || len(c.Name) > 16 {
|
||||
return ErrInvalidNetName
|
||||
}
|
||||
|
||||
if !strings.HasSuffix(c.LocalDomain, ".local") {
|
||||
return errs.ErrNetNameNotLocal
|
||||
}
|
||||
|
||||
for _, c := range strings.TrimSuffix(c.LocalDomain, ".local") {
|
||||
for _, c := range c.Name {
|
||||
if c >= 'a' && c <= 'z' {
|
||||
continue
|
||||
}
|
||||
if c >= '0' && c <= '9' {
|
||||
continue
|
||||
}
|
||||
return errs.ErrInvalidNetName
|
||||
return ErrInvalidNetName
|
||||
}
|
||||
|
||||
addr, ok := netip.AddrFromSlice(c.Network)
|
||||
if !ok || !addr.Is4() || addr.As4()[3] != 0 || addr.As4()[0] == 0 {
|
||||
return errs.ErrInvalidIP
|
||||
return ErrInvalidIP
|
||||
}
|
||||
|
||||
if !addr.IsPrivate() {
|
||||
return errs.ErrNonPrivateIP
|
||||
return ErrNonPrivateIP
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func Peer_Sanitize(p *Peer) {
|
||||
p.Name = strings.TrimSpace(strings.ToLower(p.Name))
|
||||
if len(p.Addr4) != 0 {
|
||||
if addr, ok := netip.AddrFromSlice(p.Addr4); ok {
|
||||
// Unmap so an IPv4-mapped form is stored canonically as 4 bytes.
|
||||
p.Addr4 = addr.Unmap().AsSlice()
|
||||
p.Name = strings.TrimSpace(p.Name)
|
||||
if len(p.PublicIP1) != 0 {
|
||||
if addr, ok := netip.AddrFromSlice(p.PublicIP1); ok {
|
||||
p.PublicIP1 = addr.AsSlice()
|
||||
}
|
||||
}
|
||||
if len(p.Addr6) != 0 {
|
||||
if addr, ok := netip.AddrFromSlice(p.Addr6); ok {
|
||||
p.Addr6 = addr.AsSlice()
|
||||
if len(p.PublicIP2) != 0 {
|
||||
if addr, ok := netip.AddrFromSlice(p.PublicIP2); ok {
|
||||
p.PublicIP2 = addr.AsSlice()
|
||||
}
|
||||
}
|
||||
if p.Port == 0 {
|
||||
p.Port = 51820
|
||||
if p.Port1 == 0 {
|
||||
p.Port1 = 456
|
||||
}
|
||||
if len(p.PublicIP2) != 0 && p.Port2 == 0 {
|
||||
p.Port2 = 456
|
||||
}
|
||||
}
|
||||
|
||||
func Peer_Validate(p *Peer) error {
|
||||
if p.PeerIP < 1 || p.PeerIP > 254 {
|
||||
return errs.ErrInvalidPeerIP
|
||||
}
|
||||
if len(p.Addr4) > 0 {
|
||||
// Must be a genuine IPv4 address (reject an IPv6 in the v4 field).
|
||||
if addr, ok := netip.AddrFromSlice(p.Addr4); !ok || !addr.Is4() {
|
||||
return errs.ErrInvalidIP
|
||||
if len(p.PublicIP1) > 0 {
|
||||
if _, ok := netip.AddrFromSlice(p.PublicIP1); !ok {
|
||||
return ErrInvalidIP
|
||||
}
|
||||
}
|
||||
if len(p.Addr6) > 0 {
|
||||
// Must be a genuine IPv6 address (reject IPv4 / IPv4-mapped in the v6 field).
|
||||
if addr, ok := netip.AddrFromSlice(p.Addr6); !ok || !addr.Is6() || addr.Is4In6() {
|
||||
return errs.ErrInvalidIP
|
||||
if len(p.PublicIP2) > 0 {
|
||||
if _, ok := netip.AddrFromSlice(p.PublicIP2); !ok {
|
||||
return ErrInvalidIP
|
||||
}
|
||||
if p.Port2 == 0 {
|
||||
return ErrInvalidPort
|
||||
}
|
||||
}
|
||||
if p.Port == 0 {
|
||||
return errs.ErrInvalidPort
|
||||
if p.Port1 == 0 {
|
||||
return ErrInvalidPort
|
||||
}
|
||||
|
||||
if len(p.Name) == 0 || len(p.Name) > 63 {
|
||||
return errs.ErrInvalidPeerName
|
||||
}
|
||||
for _, c := range p.Name {
|
||||
if c >= 'a' && c <= 'z' {
|
||||
continue
|
||||
@@ -102,10 +102,10 @@ func Peer_Validate(p *Peer) error {
|
||||
if c >= '0' && c <= '9' {
|
||||
continue
|
||||
}
|
||||
if c == '-' {
|
||||
if c == '.' || c == '-' || c == '_' {
|
||||
continue
|
||||
}
|
||||
return errs.ErrInvalidPeerName
|
||||
return ErrInvalidPeerName
|
||||
}
|
||||
|
||||
return nil
|
||||
|
||||
@@ -4,20 +4,21 @@ TABLE config OF Config (
|
||||
);
|
||||
|
||||
TABLE networks OF Network (
|
||||
NetworkID int64 PK,
|
||||
LocalDomain string NoUpdate,
|
||||
Network []byte NoUpdate
|
||||
NetworkID int64 PK,
|
||||
Name string NoUpdate,
|
||||
Network []byte NoUpdate
|
||||
);
|
||||
|
||||
TABLE peers OF Peer (
|
||||
NetworkID int64 PK,
|
||||
PeerIP byte PK,
|
||||
Version int64,
|
||||
APIKey string NoUpdate,
|
||||
Name string NoUpdate,
|
||||
Addr4 []byte NoUpdate,
|
||||
Addr6 []byte NoUpdate,
|
||||
Port uint16 NoUpdate,
|
||||
Relay bool NoUpdate,
|
||||
WGPubKey []byte NoUpdate,
|
||||
SignPubKey []byte NoUpdate
|
||||
Name string,
|
||||
PublicIP1 []byte,
|
||||
Port1 uint16,
|
||||
PublicIP2 []byte,
|
||||
Port2 uint16,
|
||||
Relay bool,
|
||||
WGPubKey []byte NoUpdate
|
||||
);
|
||||
|
||||
@@ -12,8 +12,8 @@ func Peer_GetByAPIKey(tx TX, apiKey string) (*Peer, error) {
|
||||
apiKey)
|
||||
}
|
||||
|
||||
func Network_HasPeers(tx TX, networkID int64) (exists bool, err error) {
|
||||
const query = "SELECT EXISTS(SELECT 1 FROM peers WHERE NetworkID=?)"
|
||||
err = tx.QueryRow(query, networkID).Scan(&exists)
|
||||
return exists, err
|
||||
func Peer_Exists(tx TX, networkID int64, ip byte) (exists bool, err error) {
|
||||
const query = `SELECT EXISTS(SELECT 1 FROM peers WHERE NetworkID=? AND PeerIP=?)`
|
||||
err = tx.QueryRow(query, networkID, ip).Scan(&exists)
|
||||
return
|
||||
}
|
||||
|
||||
13
hub/api/errors.go
Normal file
13
hub/api/errors.go
Normal file
@@ -0,0 +1,13 @@
|
||||
package api
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"vppn/hub/api/db"
|
||||
)
|
||||
|
||||
var (
|
||||
ErrNotAuthorized = errors.New("not authorized")
|
||||
ErrNoIPAvailable = errors.New("no IP address available")
|
||||
ErrInvalidIP = db.ErrInvalidIP
|
||||
ErrInvalidPort = db.ErrInvalidPort
|
||||
)
|
||||
@@ -5,22 +5,21 @@ CREATE TABLE config (
|
||||
|
||||
CREATE TABLE networks (
|
||||
NetworkID INTEGER NOT NULL PRIMARY KEY,
|
||||
LocalDomain TEXT NOT NULL UNIQUE, -- Network/interface name.
|
||||
Name TEXT NOT NULL UNIQUE, -- Network/interface name.
|
||||
Network BLOB NOT NULL UNIQUE -- Network (/24), example 10.51.50.0
|
||||
) WITHOUT ROWID;
|
||||
|
||||
CREATE TABLE peers (
|
||||
NetworkID INTEGER NOT NULL,
|
||||
PeerIP INTEGER NOT NULL, -- Final byte of IP.
|
||||
Version INTEGER NOT NULL, -- Changes when updated.
|
||||
APIKey TEXT NOT NULL UNIQUE, -- Peer's secret API key.
|
||||
Name TEXT NOT NULL, -- For humans.
|
||||
Addr4 BLOB NOT NULL,
|
||||
Addr6 BLOB NOT NULL,
|
||||
Port INTEGER NOT NULL,
|
||||
Name TEXT NOT NULL UNIQUE, -- For humans.
|
||||
PublicIP1 BLOB NOT NULL,
|
||||
Port1 INTEGER NOT NULL,
|
||||
PublicIP2 BLOB NOT NULL,
|
||||
Port2 INTEGER NOT NULL,
|
||||
Relay INTEGER NOT NULL DEFAULT 0, -- Boolean if peer will forward packets.
|
||||
WGPubKey BLOB NOT NULL,
|
||||
SignPubKey BLOB NOT NULL,
|
||||
UNIQUE(NetworkID, Name),
|
||||
PRIMARY KEY(NetworkID, PeerIP),
|
||||
FOREIGN KEY(NetworkID) REFERENCES networks(NetworkID)
|
||||
PRIMARY KEY(NetworkID, PeerIP)
|
||||
) WITHOUT ROWID;
|
||||
|
||||
7
hub/api/time.go
Normal file
7
hub/api/time.go
Normal file
@@ -0,0 +1,7 @@
|
||||
package api
|
||||
|
||||
import "time"
|
||||
|
||||
func timeSince(ts int64) int64 {
|
||||
return time.Now().Unix() - ts
|
||||
}
|
||||
@@ -1,9 +1,6 @@
|
||||
package api
|
||||
|
||||
import (
|
||||
"time"
|
||||
"vppn/hub/api/db"
|
||||
)
|
||||
import "vppn/hub/api/db"
|
||||
|
||||
type Config = db.Config
|
||||
type Network = db.Network
|
||||
@@ -11,5 +8,7 @@ type Peer = db.Peer
|
||||
|
||||
type Session struct {
|
||||
SessionID string
|
||||
LastSeenAt time.Time
|
||||
SignedIn bool
|
||||
CreatedAt int64
|
||||
LastSeenAt int64
|
||||
}
|
||||
|
||||
15
hub/app.go
15
hub/app.go
@@ -8,8 +8,7 @@ import (
|
||||
"path/filepath"
|
||||
"vppn/hub/api"
|
||||
|
||||
"git.crumpington.com/lib/keyedmutex"
|
||||
"git.crumpington.com/lib/webutil"
|
||||
"git.crumpington.com/lib/go/webutil"
|
||||
)
|
||||
|
||||
//go:embed static
|
||||
@@ -29,9 +28,6 @@ type App struct {
|
||||
mux *http.ServeMux
|
||||
tmpl map[string]*template.Template
|
||||
insecure bool
|
||||
|
||||
// Per-remote address sign-in serialization lock.
|
||||
signInLock *keyedmutex.KeyedMutex[string]
|
||||
}
|
||||
|
||||
func NewApp(conf Config) (*App, error) {
|
||||
@@ -41,11 +37,10 @@ func NewApp(conf Config) (*App, error) {
|
||||
}
|
||||
|
||||
app := &App{
|
||||
api: api,
|
||||
mux: http.NewServeMux(),
|
||||
tmpl: webutil.ParseTemplateSet(templateFuncs, templateFS),
|
||||
insecure: conf.Insecure,
|
||||
signInLock: keyedmutex.New[string](),
|
||||
api: api,
|
||||
mux: http.NewServeMux(),
|
||||
tmpl: webutil.ParseTemplateSet(templateFuncs, templateFS),
|
||||
insecure: conf.Insecure,
|
||||
}
|
||||
|
||||
app.registerRoutes()
|
||||
|
||||
@@ -2,6 +2,7 @@ package hub
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"time"
|
||||
)
|
||||
|
||||
func (a *App) getCookie(r *http.Request, name string) string {
|
||||
@@ -25,12 +26,9 @@ func (a *App) setCookie(w http.ResponseWriter, name, value string) {
|
||||
|
||||
func (a *App) deleteCookie(w http.ResponseWriter, name string) {
|
||||
http.SetCookie(w, &http.Cookie{
|
||||
Name: name,
|
||||
Value: "",
|
||||
Path: "/",
|
||||
Secure: !a.insecure,
|
||||
SameSite: http.SameSiteStrictMode,
|
||||
HttpOnly: true,
|
||||
MaxAge: -1, // delete now
|
||||
Name: name,
|
||||
Value: "",
|
||||
Path: "/",
|
||||
Expires: time.Unix(0, 0),
|
||||
})
|
||||
}
|
||||
|
||||
@@ -1,37 +0,0 @@
|
||||
package errs
|
||||
|
||||
import (
|
||||
"database/sql"
|
||||
"errors"
|
||||
"log"
|
||||
|
||||
sqlite3 "github.com/mattn/go-sqlite3"
|
||||
)
|
||||
|
||||
func DB(err error) error {
|
||||
if err == nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
var e *Error
|
||||
if errors.As(err, &e) {
|
||||
return err
|
||||
}
|
||||
|
||||
if errors.Is(err, sql.ErrNoRows) {
|
||||
return ErrNotFound
|
||||
}
|
||||
|
||||
var se sqlite3.Error
|
||||
if errors.As(err, &se) {
|
||||
switch se.ExtendedCode {
|
||||
case sqlite3.ErrConstraintUnique, sqlite3.ErrConstraintPrimaryKey:
|
||||
return ErrAlreadyExists
|
||||
case sqlite3.ErrConstraintForeignKey, sqlite3.ErrConstraintCheck:
|
||||
return ErrConstraint
|
||||
}
|
||||
}
|
||||
|
||||
log.Printf("Unexpected error: %v", err)
|
||||
return ErrUnexpected
|
||||
}
|
||||
@@ -1,61 +0,0 @@
|
||||
package errs
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net/http"
|
||||
)
|
||||
|
||||
type Error struct {
|
||||
Code int
|
||||
Msg string
|
||||
}
|
||||
|
||||
func (e *Error) Error() string {
|
||||
return fmt.Sprintf("[%d] %s", e.Code, e.Msg)
|
||||
}
|
||||
|
||||
var (
|
||||
ErrNotAuthorized = NotAuthorized.WithMsg("Not authorized.")
|
||||
ErrInvalidPassword = BadRequest.WithMsg("Invalid password.")
|
||||
ErrPasswordMismatch = BadRequest.WithMsg("Passwords don't match.")
|
||||
ErrUnexpected = Internal.WithMsg("Unexpected internal error.")
|
||||
ErrNotFound = NotFound.WithMsg("Not found.")
|
||||
ErrAlreadyExists = Conflict.WithMsg("Already exists.")
|
||||
|
||||
// Validation errors.
|
||||
ErrInvalidIP = BadRequest.WithMsg("Invalid IP.")
|
||||
ErrInvalidPeerIP = BadRequest.WithMsg("Invalid peer IP.")
|
||||
ErrNonPrivateIP = BadRequest.WithMsg("Non-private IP.")
|
||||
ErrInvalidPort = BadRequest.WithMsg("Invalid port.")
|
||||
ErrInvalidNetName = BadRequest.WithMsg("Invalid network name.")
|
||||
ErrNetNameNotLocal = BadRequest.WithMsg("Network name must end with .local.")
|
||||
ErrInvalidPeerName = BadRequest.WithMsg("Invalid peer name.")
|
||||
ErrConstraint = BadRequest.WithMsg("Constraint error.")
|
||||
)
|
||||
|
||||
// ----------------------------------------------------------------------------
|
||||
|
||||
type Type struct {
|
||||
Code int
|
||||
Msg string
|
||||
}
|
||||
|
||||
func (t Type) WithErr(err error) *Error {
|
||||
return &Error{Code: t.Code, Msg: err.Error()}
|
||||
}
|
||||
|
||||
func (t Type) WithMsg(msg string) *Error {
|
||||
return &Error{Code: t.Code, Msg: msg}
|
||||
}
|
||||
|
||||
func (t Type) WithMsgf(msg string, args ...any) *Error {
|
||||
return &Error{Code: t.Code, Msg: fmt.Sprintf(msg, args...)}
|
||||
}
|
||||
|
||||
var (
|
||||
Internal = Type{Code: http.StatusInternalServerError}
|
||||
NotAuthorized = Type{Code: http.StatusUnauthorized}
|
||||
NotFound = Type{Code: http.StatusNotFound}
|
||||
BadRequest = Type{Code: http.StatusBadRequest}
|
||||
Conflict = Type{Code: http.StatusConflict}
|
||||
)
|
||||
@@ -4,7 +4,7 @@ import (
|
||||
"net/url"
|
||||
"vppn/hub/api"
|
||||
|
||||
"git.crumpington.com/lib/webutil"
|
||||
"git.crumpington.com/lib/go/webutil"
|
||||
)
|
||||
|
||||
func (app *App) formGetNetwork(form url.Values) (*api.Network, error) {
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
package hub
|
||||
|
||||
const (
|
||||
sessionIDCookieName = "SessionID"
|
||||
SESSION_ID_COOKIE_NAME = "SessionID"
|
||||
)
|
||||
|
||||
@@ -1,38 +1,48 @@
|
||||
package hub
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"log"
|
||||
"net/http"
|
||||
"vppn/hub/api"
|
||||
"vppn/hub/errs"
|
||||
|
||||
"git.crumpington.com/lib/go/webutil"
|
||||
)
|
||||
|
||||
type handlerFunc func(s *api.Session, w http.ResponseWriter, r *http.Request) error
|
||||
|
||||
func (app *App) handlePub(pattern string, fn handlerFunc) {
|
||||
wrapped := func(w http.ResponseWriter, r *http.Request) {
|
||||
sessionID := app.getCookie(r, sessionIDCookieName)
|
||||
s := app.api.Session_Get(sessionID)
|
||||
sessionID := app.getCookie(r, SESSION_ID_COOKIE_NAME)
|
||||
s, err := app.api.Session_Get(sessionID)
|
||||
if err != nil {
|
||||
log.Printf("Failed to get session: %v", err)
|
||||
http.Error(w, "Internal error", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
|
||||
if s.SessionID != sessionID {
|
||||
app.setCookie(w, SESSION_ID_COOKIE_NAME, s.SessionID)
|
||||
}
|
||||
|
||||
if r.Method == http.MethodPost {
|
||||
r.Body = http.MaxBytesReader(w, r.Body, 128*1024)
|
||||
r.ParseMultipartForm(64 * 1024)
|
||||
} else {
|
||||
r.ParseForm()
|
||||
}
|
||||
|
||||
if err := fn(&s, w, r); err != nil {
|
||||
handleError(w, err)
|
||||
if err := fn(s, w, r); err != nil {
|
||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||
}
|
||||
}
|
||||
|
||||
app.mux.HandleFunc(pattern, withLogging(wrapped))
|
||||
app.mux.HandleFunc(pattern,
|
||||
webutil.WithLogging(
|
||||
wrapped))
|
||||
}
|
||||
|
||||
func (app *App) handleNotSignedIn(pattern string, fn handlerFunc) {
|
||||
app.handlePub(pattern, func(s *api.Session, w http.ResponseWriter, r *http.Request) error {
|
||||
if s.SessionID != "" {
|
||||
if s.SignedIn {
|
||||
http.Redirect(w, r, "/", http.StatusSeeOther)
|
||||
return nil
|
||||
}
|
||||
@@ -42,7 +52,7 @@ func (app *App) handleNotSignedIn(pattern string, fn handlerFunc) {
|
||||
|
||||
func (app *App) handleSignedIn(pattern string, fn handlerFunc) {
|
||||
app.handlePub(pattern, func(s *api.Session, w http.ResponseWriter, r *http.Request) error {
|
||||
if s.SessionID == "" {
|
||||
if !s.SignedIn {
|
||||
http.Redirect(w, r, "/", http.StatusSeeOther)
|
||||
return nil
|
||||
}
|
||||
@@ -60,7 +70,6 @@ func (app *App) handlePeer(pattern string, fn peerHandlerFunc) {
|
||||
return
|
||||
}
|
||||
|
||||
// Not doing constant time compare because index lookup time dominates.
|
||||
peer, err := app.api.Peer_GetByAPIKey(apiKey)
|
||||
if err != nil {
|
||||
http.Error(w, "Not authorized", http.StatusUnauthorized)
|
||||
@@ -69,19 +78,12 @@ func (app *App) handlePeer(pattern string, fn peerHandlerFunc) {
|
||||
|
||||
r.ParseForm()
|
||||
if err := fn(peer, w, r); err != nil {
|
||||
handleError(w, err)
|
||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
app.mux.HandleFunc(pattern, withLogging(wrapped))
|
||||
}
|
||||
|
||||
func handleError(w http.ResponseWriter, err error) {
|
||||
var e *errs.Error
|
||||
if errors.As(err, &e) {
|
||||
http.Error(w, e.Msg, e.Code)
|
||||
} else {
|
||||
log.Printf("Unexpected error: %v", err)
|
||||
http.Error(w, "Internal server error.", http.StatusInternalServerError)
|
||||
}
|
||||
app.mux.HandleFunc(pattern,
|
||||
webutil.WithLogging(
|
||||
wrapped))
|
||||
}
|
||||
|
||||
182
hub/handlers.go
182
hub/handlers.go
@@ -2,22 +2,18 @@ package hub
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"log"
|
||||
"math/rand/v2"
|
||||
"net"
|
||||
"net/http"
|
||||
"time"
|
||||
"vppn/hub/api"
|
||||
"vppn/hub/errs"
|
||||
"vppn/m"
|
||||
|
||||
"git.crumpington.com/lib/webutil"
|
||||
"git.crumpington.com/lib/go/webutil"
|
||||
"golang.org/x/crypto/bcrypt"
|
||||
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||
)
|
||||
|
||||
func (a *App) _root(s *api.Session, w http.ResponseWriter, r *http.Request) error {
|
||||
if s.SessionID != "" {
|
||||
if s.SignedIn {
|
||||
return a.redirect(w, r, "/admin/network/list/")
|
||||
} else {
|
||||
return a.redirect(w, r, "/sign-in/")
|
||||
@@ -29,15 +25,6 @@ func (a *App) _signin(s *api.Session, w http.ResponseWriter, r *http.Request) er
|
||||
}
|
||||
|
||||
func (a *App) _signinSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
|
||||
// Ignoring error here - if host is the empty string, it will contend for the
|
||||
// lock anyway.
|
||||
host, _, _ := net.SplitHostPort(r.RemoteAddr)
|
||||
if !a.signInLock.TryLock(host) {
|
||||
time.Sleep(time.Second + time.Duration(rand.Int64N(int64(3*time.Second))))
|
||||
return errs.ErrNotAuthorized
|
||||
}
|
||||
defer a.signInLock.Unlock(host)
|
||||
|
||||
var pwd string
|
||||
err := webutil.NewFormScanner(r.Form).
|
||||
Scan("Password", &pwd).
|
||||
@@ -46,14 +33,10 @@ func (a *App) _signinSubmit(s *api.Session, w http.ResponseWriter, r *http.Reque
|
||||
return err
|
||||
}
|
||||
|
||||
sess, err := a.api.Session_SignIn(pwd)
|
||||
if err != nil {
|
||||
time.Sleep(time.Second + time.Duration(rand.Int64N(int64(3*time.Second))))
|
||||
if err := a.api.Session_SignIn(s, pwd); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
a.setCookie(w, sessionIDCookieName, sess.SessionID)
|
||||
|
||||
return a.redirect(w, r, "/")
|
||||
}
|
||||
|
||||
@@ -62,8 +45,10 @@ func (a *App) _adminSignOut(s *api.Session, w http.ResponseWriter, r *http.Reque
|
||||
}
|
||||
|
||||
func (a *App) _adminSignOutSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
|
||||
a.api.Session_Delete(s.SessionID)
|
||||
a.deleteCookie(w, sessionIDCookieName)
|
||||
if err := a.api.Session_Delete(s.SessionID); err != nil {
|
||||
log.Printf("Failed to delete session cookie %s: %v", s.SessionID, err)
|
||||
}
|
||||
a.deleteCookie(w, SESSION_ID_COOKIE_NAME)
|
||||
return a.redirect(w, r, "/")
|
||||
}
|
||||
|
||||
@@ -87,7 +72,7 @@ func (a *App) _adminNetworkCreateSubmit(s *api.Session, w http.ResponseWriter, r
|
||||
var netStr string
|
||||
|
||||
err := webutil.NewFormScanner(r.Form).
|
||||
Scan("LocalDomain", &n.LocalDomain).
|
||||
Scan("Name", &n.Name).
|
||||
Scan("Network", &netStr).
|
||||
Error()
|
||||
if err != nil {
|
||||
@@ -157,26 +142,27 @@ func (a *App) _adminPeerCreate(s *api.Session, w http.ResponseWriter, r *http.Re
|
||||
}
|
||||
|
||||
func (a *App) _adminPeerCreateSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
|
||||
var addr4Str, addr6Str string
|
||||
var ip1Str, ip2Str string
|
||||
|
||||
p := &api.Peer{}
|
||||
err := webutil.NewFormScanner(r.Form).
|
||||
Scan("NetworkID", &p.NetworkID).
|
||||
Scan("IP", &p.PeerIP).
|
||||
Scan("Name", &p.Name).
|
||||
Scan("Addr4", &addr4Str).
|
||||
Scan("Addr6", &addr6Str).
|
||||
Scan("Port", &p.Port).
|
||||
Scan("PublicIP1", &ip1Str).
|
||||
Scan("Port1", &p.Port1).
|
||||
Scan("PublicIP2", &ip2Str).
|
||||
Scan("Port2", &p.Port2).
|
||||
Scan("Relay", &p.Relay).
|
||||
Error()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if p.Addr4, err = stringToIP(addr4Str); err != nil {
|
||||
if p.PublicIP1, err = stringToIP(ip1Str); err != nil {
|
||||
return err
|
||||
}
|
||||
if p.Addr6, err = stringToIP(addr6Str); err != nil {
|
||||
if p.PublicIP2, err = stringToIP(ip2Str); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
@@ -199,6 +185,53 @@ func (a *App) _adminPeerView(s *api.Session, w http.ResponseWriter, r *http.Requ
|
||||
}{s, net, peer})
|
||||
}
|
||||
|
||||
func (a *App) _adminPeerEdit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
|
||||
net, peer, err := a.formGetPeer(r.Form)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return a.render("/network/peer-edit.html", w, struct {
|
||||
Session *api.Session
|
||||
Network *api.Network
|
||||
Peer *api.Peer
|
||||
}{s, net, peer})
|
||||
}
|
||||
|
||||
func (a *App) _adminPeerEditSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
|
||||
_, peer, err := a.formGetPeer(r.Form)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
var ip1Str, ip2Str string
|
||||
|
||||
err = webutil.NewFormScanner(r.Form).
|
||||
Scan("Name", &peer.Name).
|
||||
Scan("PublicIP1", &ip1Str).
|
||||
Scan("Port1", &peer.Port1).
|
||||
Scan("PublicIP2", &ip2Str).
|
||||
Scan("Port2", &peer.Port2).
|
||||
Scan("Relay", &peer.Relay).
|
||||
Error()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if peer.PublicIP1, err = stringToIP(ip1Str); err != nil {
|
||||
return err
|
||||
}
|
||||
if peer.PublicIP2, err = stringToIP(ip2Str); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if err = a.api.Peer_Update(peer); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return a.redirect(w, r, "/admin/peer/view/?NetworkID=%d&PeerIP=%d", peer.NetworkID, peer.PeerIP)
|
||||
}
|
||||
|
||||
func (a *App) _adminPeerDelete(s *api.Session, w http.ResponseWriter, r *http.Request) error {
|
||||
n, peer, err := a.formGetPeer(r.Form)
|
||||
if err != nil {
|
||||
@@ -229,17 +262,13 @@ func (a *App) _adminPasswordEdit(s *api.Session, w http.ResponseWriter, r *http.
|
||||
|
||||
func (a *App) _adminPasswordSubmit(s *api.Session, w http.ResponseWriter, r *http.Request) error {
|
||||
var (
|
||||
conf = a.api.Config_Get()
|
||||
curPwd string
|
||||
newPwd string
|
||||
newPwd2 string
|
||||
)
|
||||
|
||||
conf, err := a.api.Config_Get()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
err = webutil.NewFormScanner(r.Form).
|
||||
err := webutil.NewFormScanner(r.Form).
|
||||
Scan("CurrentPassword", &curPwd).
|
||||
Scan("NewPassword", &newPwd).
|
||||
Scan("NewPassword2", &newPwd2).
|
||||
@@ -248,24 +277,22 @@ func (a *App) _adminPasswordSubmit(s *api.Session, w http.ResponseWriter, r *htt
|
||||
return err
|
||||
}
|
||||
|
||||
// 72 is max password length for bcrypt.
|
||||
if len(newPwd) < 8 || len(newPwd) > 72 {
|
||||
return errs.ErrInvalidPassword
|
||||
if len(newPwd) < 8 {
|
||||
return errors.New("password is too short")
|
||||
}
|
||||
|
||||
if newPwd != newPwd2 {
|
||||
return errs.ErrPasswordMismatch
|
||||
return errors.New("passwords don't match")
|
||||
}
|
||||
|
||||
err = bcrypt.CompareHashAndPassword(conf.Password, []byte(curPwd))
|
||||
if err != nil {
|
||||
return errs.ErrNotAuthorized
|
||||
return err
|
||||
}
|
||||
|
||||
hash, err := bcrypt.GenerateFromPassword([]byte(newPwd), bcrypt.DefaultCost)
|
||||
if err != nil {
|
||||
log.Printf("Failed to hash password with bcrypt: %v", err)
|
||||
return errs.ErrUnexpected
|
||||
return err
|
||||
}
|
||||
|
||||
conf.Password = hash
|
||||
@@ -274,29 +301,18 @@ func (a *App) _adminPasswordSubmit(s *api.Session, w http.ResponseWriter, r *htt
|
||||
return err
|
||||
}
|
||||
|
||||
*s = a.api.Session_InvalidateAll()
|
||||
a.setCookie(w, sessionIDCookieName, s.SessionID)
|
||||
|
||||
return a.redirect(w, r, "/admin/network/list/")
|
||||
return a.redirect(w, r, "/admin/config/")
|
||||
}
|
||||
|
||||
func (a *App) _peerInit(peer *api.Peer, w http.ResponseWriter, r *http.Request) error {
|
||||
if len(peer.WGPubKey) != 0 {
|
||||
return errs.BadRequest.WithMsg("Already initialized")
|
||||
http.Error(w, "Already initialized", http.StatusConflict)
|
||||
return nil
|
||||
}
|
||||
|
||||
r.Body = http.MaxBytesReader(w, r.Body, 2048)
|
||||
|
||||
args := m.PeerInitArgs{}
|
||||
if err := json.NewDecoder(r.Body).Decode(&args); err != nil {
|
||||
return errs.BadRequest.WithMsg("Invalid request body.")
|
||||
}
|
||||
|
||||
if len(args.WGPubKey) != 32 {
|
||||
return errs.BadRequest.WithMsg("Invalid WGPubKey.")
|
||||
}
|
||||
if len(args.SignPubKey) != 32 {
|
||||
return errs.BadRequest.WithMsg("Invalid SignPubKey.")
|
||||
return err
|
||||
}
|
||||
|
||||
net, err := a.api.Network_Get(peer.NetworkID)
|
||||
@@ -309,12 +325,11 @@ func (a *App) _peerInit(peer *api.Peer, w http.ResponseWriter, r *http.Request)
|
||||
}
|
||||
|
||||
resp := m.PeerInitResp{
|
||||
PeerIP: peer.PeerIP,
|
||||
Network: net.Network,
|
||||
LocalDomain: net.LocalDomain,
|
||||
PeerIP: peer.PeerIP,
|
||||
Network: net.Network,
|
||||
}
|
||||
|
||||
resp.NetworkState.Peers, err = a.peersList(net.NetworkID)
|
||||
resp.NetworkState.Peers, err = a.peersArray(net.NetworkID)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
@@ -323,44 +338,35 @@ func (a *App) _peerInit(peer *api.Peer, w http.ResponseWriter, r *http.Request)
|
||||
}
|
||||
|
||||
func (a *App) _peerFetchState(peer *api.Peer, w http.ResponseWriter, r *http.Request) error {
|
||||
peers, err := a.peersList(peer.NetworkID)
|
||||
|
||||
peers, err := a.peersArray(peer.NetworkID)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return a.sendJSON(w, m.NetworkState{Peers: peers})
|
||||
}
|
||||
|
||||
func (a *App) peersList(networkID int64) (peers []m.Peer, err error) {
|
||||
func (a *App) peersArray(networkID int64) (peers [256]*m.Peer, err error) {
|
||||
l, err := a.api.Peer_List(networkID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
return peers, err
|
||||
}
|
||||
|
||||
peers = make([]m.Peer, 0, len(l))
|
||||
|
||||
for _, p := range l {
|
||||
if len(p.WGPubKey) == 0 {
|
||||
continue
|
||||
if len(p.WGPubKey) != 0 {
|
||||
peers[p.PeerIP] = &m.Peer{
|
||||
PeerIP: p.PeerIP,
|
||||
Version: p.Version,
|
||||
Name: p.Name,
|
||||
PublicIP1: p.PublicIP1,
|
||||
Port1: p.Port1,
|
||||
PublicIP2: p.PublicIP2,
|
||||
Port2: p.Port2,
|
||||
Relay: p.Relay,
|
||||
WGPubKey: p.WGPubKey,
|
||||
}
|
||||
}
|
||||
wgKey, err := wgtypes.NewKey(p.WGPubKey)
|
||||
if err != nil {
|
||||
log.Printf("Bad WG key in DB for peer %d/%d", p.NetworkID, p.PeerIP)
|
||||
continue // malformed key; skip rather than serve garbage
|
||||
}
|
||||
|
||||
var signKey [32]byte
|
||||
copy(signKey[:], p.SignPubKey)
|
||||
peers = append(peers, m.Peer{
|
||||
PeerIP: p.PeerIP,
|
||||
Name: p.Name,
|
||||
Addr4: addrFromBytes(p.Addr4),
|
||||
Addr6: addrFromBytes(p.Addr6),
|
||||
Port: p.Port,
|
||||
Relay: p.Relay,
|
||||
WGPubKey: wgKey,
|
||||
SignPubKey: signKey,
|
||||
})
|
||||
}
|
||||
|
||||
return peers, nil
|
||||
return
|
||||
}
|
||||
|
||||
11
hub/main.go
11
hub/main.go
@@ -5,9 +5,8 @@ import (
|
||||
"log"
|
||||
"net/http"
|
||||
"os"
|
||||
"time"
|
||||
|
||||
"git.crumpington.com/lib/webutil"
|
||||
"git.crumpington.com/lib/go/webutil"
|
||||
)
|
||||
|
||||
func Main() {
|
||||
@@ -31,12 +30,8 @@ func Main() {
|
||||
}
|
||||
|
||||
srv := &http.Server{
|
||||
Addr: conf.ListenAddr,
|
||||
Handler: app.Handler(),
|
||||
ReadHeaderTimeout: 30 * time.Second,
|
||||
ReadTimeout: 60 * time.Second,
|
||||
WriteTimeout: 120 * time.Second,
|
||||
IdleTimeout: 180 * time.Second,
|
||||
Addr: conf.ListenAddr,
|
||||
Handler: app.Handler(),
|
||||
}
|
||||
|
||||
log.Fatal(webutil.ListenAndServe(srv))
|
||||
|
||||
@@ -1,47 +0,0 @@
|
||||
package hub
|
||||
|
||||
import (
|
||||
"log"
|
||||
"net/http"
|
||||
"os"
|
||||
"time"
|
||||
)
|
||||
|
||||
var _log = log.New(os.Stderr, "", 0)
|
||||
|
||||
type responseWriterWrapper struct {
|
||||
http.ResponseWriter
|
||||
httpStatus int
|
||||
responseSize int
|
||||
}
|
||||
|
||||
func (w *responseWriterWrapper) WriteHeader(status int) {
|
||||
w.httpStatus = status
|
||||
w.ResponseWriter.WriteHeader(status)
|
||||
}
|
||||
|
||||
func (w *responseWriterWrapper) Write(b []byte) (int, error) {
|
||||
if w.httpStatus == 0 {
|
||||
w.httpStatus = 200
|
||||
}
|
||||
w.responseSize += len(b)
|
||||
return w.ResponseWriter.Write(b)
|
||||
}
|
||||
|
||||
func withLogging(inner http.HandlerFunc) http.HandlerFunc {
|
||||
return func(w http.ResponseWriter, r *http.Request) {
|
||||
t := time.Now()
|
||||
wrapper := responseWriterWrapper{w, 0, 0}
|
||||
|
||||
inner(&wrapper, r)
|
||||
_log.Printf("%s \"%s %s %s\" %d %d %v",
|
||||
r.RemoteAddr,
|
||||
r.Method,
|
||||
r.URL.Path,
|
||||
r.Proto,
|
||||
wrapper.httpStatus,
|
||||
wrapper.responseSize,
|
||||
time.Since(t),
|
||||
)
|
||||
}
|
||||
}
|
||||
@@ -3,7 +3,7 @@ package hub
|
||||
import "net/http"
|
||||
|
||||
func (a *App) registerRoutes() {
|
||||
a.mux.Handle("GET /static/", withLogging(http.FileServerFS(staticFS).ServeHTTP))
|
||||
a.mux.Handle("GET /static/", http.FileServerFS(staticFS))
|
||||
a.handlePub("GET /", a._root)
|
||||
|
||||
a.handleNotSignedIn("GET /sign-in/", a._signin)
|
||||
@@ -22,6 +22,8 @@ func (a *App) registerRoutes() {
|
||||
a.handleSignedIn("GET /admin/peer/create/", a._adminPeerCreate)
|
||||
a.handleSignedIn("POST /admin/peer/create/", a._adminPeerCreateSubmit)
|
||||
a.handleSignedIn("GET /admin/peer/view/", a._adminPeerView)
|
||||
a.handleSignedIn("GET /admin/peer/edit/", a._adminPeerEdit)
|
||||
a.handleSignedIn("POST /admin/peer/edit/", a._adminPeerEditSubmit)
|
||||
a.handleSignedIn("GET /admin/peer/delete/", a._adminPeerDelete)
|
||||
a.handleSignedIn("POST /admin/peer/delete/", a._adminPeerDeleteSubmit)
|
||||
|
||||
|
||||
@@ -3,8 +3,8 @@
|
||||
|
||||
<form method="POST">
|
||||
<p>
|
||||
<label>Local Domain (ending with .local)</label><br>
|
||||
<input type="text" name="LocalDomain">
|
||||
<label>Name</label><br>
|
||||
<input type="text" name="Name">
|
||||
</p>
|
||||
<p>
|
||||
<label>Network /24</label><br>
|
||||
|
||||
@@ -9,7 +9,7 @@
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Local Domain</th>
|
||||
<th>Name</th>
|
||||
<th>Network</th>
|
||||
</tr>
|
||||
</thead>
|
||||
@@ -18,7 +18,7 @@
|
||||
<tr>
|
||||
<td>
|
||||
<a href="/admin/network/view/?NetworkID={{.NetworkID}}">
|
||||
{{.LocalDomain}}
|
||||
{{.Name}}
|
||||
</a>
|
||||
</td>
|
||||
<td>{{ipToString .Network}}</td>
|
||||
|
||||
@@ -9,8 +9,8 @@
|
||||
<header>
|
||||
<h1>VPPN</h1>
|
||||
<nav>
|
||||
{{if .Session.SessionID -}}
|
||||
<a href="/admin/network/list/">Home</a> /
|
||||
{{if .Session.SignedIn -}}
|
||||
<a href="/admin/networks/list/">Home</a> /
|
||||
<a href="/admin/sign-out/">Sign out</a>
|
||||
{{- end}}
|
||||
</nav>
|
||||
|
||||
@@ -9,7 +9,7 @@
|
||||
<header>
|
||||
<h1>VPPN</h1>
|
||||
<nav>
|
||||
{{if .Session.SessionID -}}
|
||||
{{if .Session.SignedIn -}}
|
||||
<a href="/admin/networks/list/">Home</a> /
|
||||
<a href="/admin/sign-out/">Sign out</a>
|
||||
{{- end}}
|
||||
@@ -17,7 +17,7 @@
|
||||
</header>
|
||||
<h2>
|
||||
Network:
|
||||
<a href="/admin/network/view/?NetworkID={{.Network.NetworkID}}">{{.Network.LocalDomain}}</a>
|
||||
<a href="/admin/network/view/?NetworkID={{.Network.NetworkID}}">{{.Network.Name}}</a>
|
||||
</h2>
|
||||
|
||||
{{block "body" .}}There's nothing here.{{end}}
|
||||
|
||||
@@ -22,9 +22,10 @@
|
||||
<tr>
|
||||
<th>PeerIP</th>
|
||||
<th>Name</th>
|
||||
<th>IPv4</th>
|
||||
<th>IPv6</th>
|
||||
<th>Port</th>
|
||||
<th>Public IP 1</th>
|
||||
<th>Port 1</th>
|
||||
<th>Public IP 2</th>
|
||||
<th>Port 2</th>
|
||||
<th>Relay</th>
|
||||
</tr>
|
||||
</thead>
|
||||
@@ -37,13 +38,14 @@
|
||||
</a>
|
||||
</td>
|
||||
<td>{{.Name}}</td>
|
||||
<td>{{ipToString .Addr4}}</td>
|
||||
<td>{{ipToString .Addr6}}</td>
|
||||
<td>{{.Port}}</td>
|
||||
<td>{{ipToString .PublicIP1}}</td>
|
||||
<td>{{.Port1}}</td>
|
||||
<td>{{ipToString .PublicIP2}}</td>
|
||||
<td>{{.Port2}}</td>
|
||||
<td>{{if .Relay}}T{{else}}F{{end}}</td>
|
||||
</tr>
|
||||
{{- end}}
|
||||
</tbody>
|
||||
{{- end}}
|
||||
</table>
|
||||
{{- else}}
|
||||
<p>No peers.</p>
|
||||
|
||||
@@ -12,16 +12,20 @@
|
||||
<input type="text" name="Name">
|
||||
</p>
|
||||
<p>
|
||||
<label>IPv4 Address (optional)</label><br>
|
||||
<input type="text" name="Addr4">
|
||||
<label>Public IP 1</label><br>
|
||||
<input type="text" name="PublicIP1">
|
||||
</p>
|
||||
<p>
|
||||
<label>IPv6 Address (optional)</label><br>
|
||||
<input type="text" name="Addr6">
|
||||
<label>Port 1</label><br>
|
||||
<input type="number" name="Port1" value="456">
|
||||
</p>
|
||||
<p>
|
||||
<label>WireGuard Port</label><br>
|
||||
<input type="number" name="Port" value="51820">
|
||||
<label>Public IP 2 (optional)</label><br>
|
||||
<input type="text" name="PublicIP2">
|
||||
</p>
|
||||
<p>
|
||||
<label>Port 2</label><br>
|
||||
<input type="number" name="Port2" value="0">
|
||||
</p>
|
||||
<p>
|
||||
<label>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
{{with .Peer -}}
|
||||
<form method="POST">
|
||||
<input type="hidden" name="NetworkID" value="{{.NetworkID}}">
|
||||
<input type="hidden" name="PeerIP" value="{{.PeerIP}}">
|
||||
<input type="hidden" name="NetworkID" value="{{.PeerIP}}">
|
||||
<p>
|
||||
<button type="submit">Delete</button>
|
||||
<a href="/admin/peer/view/?PeerIP={{.PeerIP}}&NetworkID={{.NetworkID}}">Cancel</a>
|
||||
|
||||
42
hub/templates/network/peer-edit.html
Normal file
42
hub/templates/network/peer-edit.html
Normal file
@@ -0,0 +1,42 @@
|
||||
{{define "body" -}}
|
||||
<h2>Edit Peer</h2>
|
||||
|
||||
{{with .Peer -}}
|
||||
<form method="POST">
|
||||
<p>
|
||||
<label>Peer IP</label><br>
|
||||
<input type="text" value="{{.PeerIP}}" disabled>
|
||||
</p>
|
||||
<p>
|
||||
<label>Name</label><br>
|
||||
<input type="text" name="Name" value="{{.Name}}">
|
||||
</p>
|
||||
<p>
|
||||
<label>Public IP 1</label><br>
|
||||
<input type="text" name="PublicIP1" value="{{ipToString .PublicIP1}}">
|
||||
</p>
|
||||
<p>
|
||||
<label>Port 1</label><br>
|
||||
<input type="number" name="Port1" value="{{.Port1}}">
|
||||
</p>
|
||||
<p>
|
||||
<label>Public IP 2 (optional)</label><br>
|
||||
<input type="text" name="PublicIP2" value="{{ipToString .PublicIP2}}">
|
||||
</p>
|
||||
<p>
|
||||
<label>Port 2</label><br>
|
||||
<input type="number" name="Port2" value="{{.Port2}}">
|
||||
</p>
|
||||
<p>
|
||||
<label>
|
||||
<input type="checkbox" name="Relay" {{if .Relay}}checked{{end}}>
|
||||
Relay
|
||||
</label>
|
||||
</p>
|
||||
<p>
|
||||
<button type="submit">Save</button>
|
||||
<a href="/admin/peer/view/?NetworkID={{$.Network.NetworkID}}&PeerIP={{.PeerIP}}">Cancel</a>
|
||||
</p>
|
||||
</form>
|
||||
{{- end}}
|
||||
{{- end}}
|
||||
@@ -1,15 +1,17 @@
|
||||
{{define "body" -}}
|
||||
<h3>{{.Peer.Name}}</h3>
|
||||
<p>
|
||||
<a href="/admin/peer/edit/?NetworkID={{.Network.NetworkID}}&PeerIP={{.Peer.PeerIP}}">Edit</a> /
|
||||
<a href="/admin/peer/delete/?NetworkID={{.Network.NetworkID}}&PeerIP={{.Peer.PeerIP}}">Delete</a>
|
||||
</p>
|
||||
|
||||
{{with .Peer -}}
|
||||
<table class="def-list">
|
||||
<tr><td>Peer IP</td><td>{{.PeerIP}}</td></tr>
|
||||
<tr><td>IPv4 Address</td><td>{{ipToString .Addr4}}</td></tr>
|
||||
<tr><td>IPv6 Address</td><td>{{ipToString .Addr6}}</td></tr>
|
||||
<tr><td>WireGuard Port</td><td>{{.Port}}</td></tr>
|
||||
<tr><td>Public IP 1</td><td>{{ipToString .PublicIP1}}</td></tr>
|
||||
<tr><td>Port 1</td><td>{{.Port1}}</td></tr>
|
||||
<tr><td>Public IP 2</td><td>{{ipToString .PublicIP2}}</td></tr>
|
||||
<tr><td>Port 2</td><td>{{.Port2}}</td></tr>
|
||||
<tr><td>Relay</td><td>{{if .Relay}}T{{else}}F{{end}}</td></tr>
|
||||
<tr><td>WG Public Key</td><td>{{wgKeyString .WGPubKey}}</td></tr>
|
||||
</table>
|
||||
|
||||
13
hub/util.go
13
hub/util.go
@@ -38,19 +38,6 @@ func (app *App) sendJSON(w http.ResponseWriter, data any) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
// addrFromBytes parses raw IP bytes (4 or 16) into a netip.Addr, unmapping
|
||||
// IPv4-in-IPv6, returning the zero Addr for empty/invalid input.
|
||||
func addrFromBytes(b []byte) netip.Addr {
|
||||
if len(b) == 0 {
|
||||
return netip.Addr{}
|
||||
}
|
||||
addr, ok := netip.AddrFromSlice(b)
|
||||
if !ok {
|
||||
return netip.Addr{}
|
||||
}
|
||||
return addr.Unmap()
|
||||
}
|
||||
|
||||
func stringToIP(in string) ([]byte, error) {
|
||||
in = strings.TrimSpace(in)
|
||||
if len(in) == 0 {
|
||||
|
||||
127
m/models.go
127
m/models.go
@@ -1,133 +1,28 @@
|
||||
// The package `m` contains models shared between the hub and peer programs.
|
||||
package m
|
||||
|
||||
import (
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net/netip"
|
||||
|
||||
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||
)
|
||||
|
||||
type PeerInitArgs struct {
|
||||
WGPubKey []byte
|
||||
SignPubKey []byte
|
||||
WGPubKey []byte
|
||||
}
|
||||
|
||||
type PeerInitResp struct {
|
||||
PeerIP byte
|
||||
Network []byte
|
||||
LocalDomain string
|
||||
NetworkState NetworkState
|
||||
}
|
||||
|
||||
// Peer is the network membership record for a single peer, exchanged between
|
||||
// the hub and peers. Addr4/Addr6 are the peer's public endpoint addresses (zero
|
||||
// if it has none); Port is its WireGuard listen port, meaningful even for a
|
||||
// non-public peer (it is the peer's own bind/beacon port).
|
||||
type Peer struct {
|
||||
PeerIP byte
|
||||
Name string
|
||||
Addr4 netip.Addr // zero if none
|
||||
Addr6 netip.Addr // zero if none
|
||||
Port uint16
|
||||
Relay bool
|
||||
WGPubKey wgtypes.Key
|
||||
SignPubKey [32]byte
|
||||
}
|
||||
|
||||
// IsPublic reports whether the peer advertises at least one reachable endpoint.
|
||||
func (p Peer) IsPublic() bool {
|
||||
return p.Addr4.IsValid() || p.Addr6.IsValid()
|
||||
}
|
||||
|
||||
// Endpoint4 returns the IPv4 endpoint (addr+port), or the zero AddrPort if the
|
||||
// peer has no IPv4 address.
|
||||
func (p Peer) Endpoint4() netip.AddrPort {
|
||||
if !p.Addr4.IsValid() {
|
||||
return netip.AddrPort{}
|
||||
}
|
||||
return netip.AddrPortFrom(p.Addr4, p.Port)
|
||||
}
|
||||
|
||||
// Endpoint6 returns the IPv6 endpoint (addr+port), or the zero AddrPort if the
|
||||
// peer has no IPv6 address.
|
||||
func (p Peer) Endpoint6() netip.AddrPort {
|
||||
if !p.Addr6.IsValid() {
|
||||
return netip.AddrPort{}
|
||||
}
|
||||
return netip.AddrPortFrom(p.Addr6, p.Port)
|
||||
}
|
||||
|
||||
// PreferredEndpoint returns the IPv4 endpoint if present, else IPv6.
|
||||
func (p Peer) PreferredEndpoint() netip.AddrPort {
|
||||
if ep := p.Endpoint4(); ep.IsValid() {
|
||||
return ep
|
||||
}
|
||||
return p.Endpoint6()
|
||||
}
|
||||
|
||||
// peerJSON is the wire representation. netip.Addr fields round-trip as text
|
||||
// strings automatically; only the fixed-size key arrays need base64 (otherwise
|
||||
// encoding/json would emit them as arrays of numbers).
|
||||
type peerJSON struct {
|
||||
PeerIP byte
|
||||
Name string
|
||||
Addr4 netip.Addr
|
||||
Addr6 netip.Addr
|
||||
Port uint16
|
||||
Relay bool
|
||||
WGPubKey string
|
||||
SignPubKey string
|
||||
}
|
||||
|
||||
func (p Peer) MarshalJSON() ([]byte, error) {
|
||||
return json.Marshal(peerJSON{
|
||||
PeerIP: p.PeerIP,
|
||||
Name: p.Name,
|
||||
Addr4: p.Addr4,
|
||||
Addr6: p.Addr6,
|
||||
Port: p.Port,
|
||||
Relay: p.Relay,
|
||||
WGPubKey: base64.StdEncoding.EncodeToString(p.WGPubKey[:]),
|
||||
SignPubKey: base64.StdEncoding.EncodeToString(p.SignPubKey[:]),
|
||||
})
|
||||
}
|
||||
|
||||
func (p *Peer) UnmarshalJSON(data []byte) error {
|
||||
var j peerJSON
|
||||
if err := json.Unmarshal(data, &j); err != nil {
|
||||
return err
|
||||
}
|
||||
wg, err := base64.StdEncoding.DecodeString(j.WGPubKey)
|
||||
if err != nil {
|
||||
return fmt.Errorf("decode WGPubKey: %w", err)
|
||||
}
|
||||
key, err := wgtypes.NewKey(wg)
|
||||
if err != nil {
|
||||
return fmt.Errorf("invalid WGPubKey: %w", err)
|
||||
}
|
||||
sign, err := base64.StdEncoding.DecodeString(j.SignPubKey)
|
||||
if err != nil {
|
||||
return fmt.Errorf("decode SignPubKey: %w", err)
|
||||
}
|
||||
if len(sign) != 32 {
|
||||
return fmt.Errorf("invalid SignPubKey length: %d", len(sign))
|
||||
}
|
||||
*p = Peer{
|
||||
PeerIP: j.PeerIP,
|
||||
Name: j.Name,
|
||||
Addr4: j.Addr4,
|
||||
Addr6: j.Addr6,
|
||||
Port: j.Port,
|
||||
Relay: j.Relay,
|
||||
WGPubKey: key,
|
||||
SignPubKey: [32]byte(sign),
|
||||
}
|
||||
return nil
|
||||
PeerIP byte
|
||||
Version int64
|
||||
Name string
|
||||
PublicIP1 []byte
|
||||
Port1 uint16
|
||||
PublicIP2 []byte
|
||||
Port2 uint16
|
||||
Relay bool
|
||||
WGPubKey []byte
|
||||
}
|
||||
|
||||
type NetworkState struct {
|
||||
Peers []Peer
|
||||
Peers [256]*Peer
|
||||
}
|
||||
|
||||
162
peer/app.go
162
peer/app.go
@@ -1,162 +0,0 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"log"
|
||||
"net/netip"
|
||||
"os"
|
||||
"os/signal"
|
||||
"sort"
|
||||
"strings"
|
||||
"syscall"
|
||||
"time"
|
||||
|
||||
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||
|
||||
"vppn/m"
|
||||
"vppn/peer/control"
|
||||
"vppn/peer/multicast"
|
||||
"vppn/peer/wginterface"
|
||||
)
|
||||
|
||||
var _ WGDevice = (*wginterface.Device)(nil) // compile-time check: Device satisfies WGDevice
|
||||
|
||||
const (
|
||||
ControlPort = 4561
|
||||
PingInterval = 8 * time.Second
|
||||
TickInterval = 2 * time.Second
|
||||
TimeoutInterval = 30 * time.Second
|
||||
)
|
||||
|
||||
// scratchSize is large enough for the biggest buffer either the ping or the
|
||||
// multicast path serializes through the shared App scratch.
|
||||
const scratchSize = max(control.Size, multicast.SignedPacketSize)
|
||||
|
||||
type PingEvent struct {
|
||||
srcVPNIP netip.Addr
|
||||
ping control.Ping
|
||||
}
|
||||
|
||||
// App is the peer application. All mutable state lives here and is
|
||||
// accessed only from the Run goroutine.
|
||||
type App struct {
|
||||
// Identity
|
||||
vpnIP netip.Addr
|
||||
vpnNet netip.Prefix
|
||||
privKey wgtypes.Key
|
||||
pubKey wgtypes.Key
|
||||
isPublic bool
|
||||
localDomain string
|
||||
|
||||
// Infrastructure
|
||||
dev WGDevice
|
||||
controlConn ControlConn
|
||||
|
||||
// Peer state
|
||||
relay *Peer
|
||||
peersByKey map[wgtypes.Key]*Peer
|
||||
peersByIP map[netip.Addr]*Peer
|
||||
|
||||
// Our own external endpoints, learned from Dst fields in incoming pings
|
||||
selfV4 netip.AddrPort
|
||||
selfV6 netip.AddrPort
|
||||
|
||||
// Reusable serialization scratch for outgoing pings and multicast signature
|
||||
// verification. Only touched from the Run goroutine.
|
||||
scratch []byte
|
||||
|
||||
// Event channels fed by background goroutines
|
||||
hubAddCh <-chan m.Peer
|
||||
hubRemoveCh <-chan wgtypes.Key
|
||||
pingCh <-chan PingEvent
|
||||
multicastCh <-chan multicast.Packet
|
||||
}
|
||||
|
||||
// Run is the main event loop. It runs until SIGTERM/SIGINT.
|
||||
func (a *App) Run() error {
|
||||
// Establish a clean hosts section before the first poll lands, clearing
|
||||
// any stale entries left by a prior run (e.g. crash, or peers removed
|
||||
// while we were down).
|
||||
a.updateHosts()
|
||||
|
||||
stateTicker := time.NewTicker(TickInterval)
|
||||
pingTicker := time.NewTicker(PingInterval)
|
||||
|
||||
sig := make(chan os.Signal, 1)
|
||||
signal.Notify(sig, syscall.SIGTERM, syscall.SIGINT)
|
||||
defer signal.Stop(sig)
|
||||
|
||||
tickCount := 0
|
||||
|
||||
for {
|
||||
select {
|
||||
case p := <-a.hubAddCh:
|
||||
a.onAddPeer(p)
|
||||
case key := <-a.hubRemoveCh:
|
||||
a.onRemovePeer(key)
|
||||
case e := <-a.pingCh:
|
||||
a.onPing(e)
|
||||
case e := <-a.multicastCh:
|
||||
a.onMulticastDiscovery(e)
|
||||
case <-stateTicker.C:
|
||||
a.onStateTick()
|
||||
case <-pingTicker.C:
|
||||
a.onPingTick()
|
||||
tickCount++
|
||||
if tickCount%8 == 0 {
|
||||
a.logNetworkState()
|
||||
}
|
||||
|
||||
case <-sig:
|
||||
return a.onShutdown()
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (a *App) onShutdown() error {
|
||||
return wginterface.Delete(a.dev.Name())
|
||||
}
|
||||
|
||||
func (a *App) logNetworkState() {
|
||||
var b strings.Builder
|
||||
fmt.Fprintf(&b, "Network state (self: %s public=%v):\n", a.vpnIP, a.isPublic)
|
||||
fmt.Fprintf(&b, " Network: %v\n", a.vpnNet)
|
||||
fmt.Fprintf(&b, " IPv4: %v\n", a.selfV4)
|
||||
fmt.Fprintf(&b, " IPv6: %v\n", a.selfV6)
|
||||
|
||||
if a.relay != nil {
|
||||
fmt.Fprintf(&b, " Relay: %s\n", a.relay.Name)
|
||||
} else {
|
||||
fmt.Fprint(&b, " Relay: -\n")
|
||||
}
|
||||
|
||||
b.WriteString("Peers:\n")
|
||||
//
|
||||
peers := make([]*Peer, 0, len(a.peersByIP))
|
||||
for _, p := range a.peersByIP {
|
||||
peers = append(peers, p)
|
||||
}
|
||||
|
||||
sort.Slice(peers, func(i, j int) bool {
|
||||
return peers[i].VPNIP.As4()[3] < peers[j].VPNIP.As4()[3]
|
||||
})
|
||||
|
||||
for _, p := range peers {
|
||||
ip := p.VPNIP.As4()[3]
|
||||
up := "DOWN"
|
||||
if p.Up() {
|
||||
up = "UP "
|
||||
}
|
||||
|
||||
endpoint := p.WGEndpoint()
|
||||
if endpoint.IsValid() {
|
||||
fmt.Fprintf(&b, " %24s %03d %s %s seen=%s @ %s\n",
|
||||
p.Name, ip, p.State, up, time.Since(p.LastPing).Round(time.Millisecond), endpoint)
|
||||
} else {
|
||||
fmt.Fprintf(&b, " %24s %03d %s %s seen=%s\n",
|
||||
p.Name, ip, p.State, up, time.Since(p.LastPing).Round(time.Millisecond))
|
||||
}
|
||||
}
|
||||
|
||||
log.Print(b.String())
|
||||
}
|
||||
@@ -1,62 +0,0 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"net/netip"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||
|
||||
"vppn/m"
|
||||
"vppn/peer/multicast"
|
||||
)
|
||||
|
||||
// addRelayPeer adds a public relay peer and marks it Up so it satisfies
|
||||
// CanRelay. It does not set a.relay — callers do that explicitly.
|
||||
func addRelayPeer(t *testing.T, a *App, vpnIP string, ep netip.AddrPort) *Peer {
|
||||
t.Helper()
|
||||
key := mustKey(t)
|
||||
ip := netip.MustParseAddr(vpnIP)
|
||||
a.onAddPeer(m.Peer{
|
||||
WGPubKey: key,
|
||||
PeerIP: ip.As4()[3],
|
||||
Addr4: ep.Addr(),
|
||||
Port: ep.Port(),
|
||||
Relay: true,
|
||||
})
|
||||
p := a.peersByKey[key]
|
||||
p.wgPeer.LastHandshakeTime = time.Now()
|
||||
p.LastPing = time.Now()
|
||||
return p
|
||||
}
|
||||
|
||||
// newTestApp returns a minimal App wired to a fakeWGDevice and fakeControlConn.
|
||||
// vpnIP is the local VPN address (e.g. "10.0.0.1").
|
||||
// isPublic / isRelay describe the local node's role.
|
||||
func newTestApp(t *testing.T, vpnIP string, isPublic bool) (*App, *fakeWGDevice, *fakeControlConn) {
|
||||
t.Helper()
|
||||
privKey, err := wgtypes.GeneratePrivateKey()
|
||||
if err != nil {
|
||||
t.Fatalf("generate key: %v", err)
|
||||
}
|
||||
ip := netip.MustParseAddr(vpnIP)
|
||||
dev := &fakeWGDevice{}
|
||||
cc := &fakeControlConn{}
|
||||
a := &App{
|
||||
vpnIP: ip,
|
||||
vpnNet: netip.MustParsePrefix("10.0.0.0/24"),
|
||||
privKey: privKey,
|
||||
pubKey: privKey.PublicKey(),
|
||||
isPublic: isPublic,
|
||||
dev: dev,
|
||||
controlConn: cc,
|
||||
peersByKey: make(map[wgtypes.Key]*Peer),
|
||||
peersByIP: make(map[netip.Addr]*Peer),
|
||||
scratch: make([]byte, scratchSize),
|
||||
hubAddCh: make(chan m.Peer),
|
||||
hubRemoveCh: make(chan wgtypes.Key),
|
||||
pingCh: make(chan PingEvent),
|
||||
multicastCh: make(chan multicast.Packet),
|
||||
}
|
||||
return a, dev, cc
|
||||
}
|
||||
@@ -1,91 +0,0 @@
|
||||
// Package control implements the VPN-internal peer control protocol.
|
||||
// Peers exchange Ping packets over UDP on the VPN control port to maintain
|
||||
// liveness and discover external endpoints for direct connection attempts.
|
||||
package control
|
||||
|
||||
import (
|
||||
"encoding/binary"
|
||||
"fmt"
|
||||
"net/netip"
|
||||
)
|
||||
|
||||
const (
|
||||
version = 1
|
||||
Size = 51 // 1 version + 8 PingTS + 6 SrcV4 + 18 SrcV6 + 18 Dst
|
||||
)
|
||||
|
||||
// Ping is the single control packet type exchanged between VPN peers.
|
||||
//
|
||||
// In each peer pair, the peer with the lower VPN IP is the client: it sets
|
||||
// PingTS and sends pings on a timer. The server echoes PingTS back in its
|
||||
// response, allowing the client to compute RTT = now - PingTS.
|
||||
//
|
||||
// Both client and server populate SrcV4, SrcV6, and Dst on every packet so
|
||||
// endpoint information flows in both directions.
|
||||
//
|
||||
// Dst is the recipient's external endpoint as observed by the sender from the
|
||||
// WireGuard handshake source. Zero if the sender has not observed a handshake
|
||||
// from the recipient.
|
||||
type Ping struct {
|
||||
PingTS int64 // Client ping send time in nanoseconds.
|
||||
SrcV4 netip.AddrPort // Sender's discovered IPv4 address and port.
|
||||
SrcV6 netip.AddrPort // Sender's discovered IPv6 address and port.
|
||||
Dst netip.AddrPort
|
||||
}
|
||||
|
||||
// Marshal encodes p into buf (which must be at least Size bytes) and returns
|
||||
// buf[:Size]. Taking the buffer lets callers reuse one across sends; every
|
||||
// field is written unconditionally so a reused buffer needs no pre-zeroing.
|
||||
func (p Ping) Marshal(buf []byte) []byte {
|
||||
_ = buf[Size-1] // Panic if buffer is too small.
|
||||
|
||||
buf[0] = version
|
||||
binary.BigEndian.PutUint64(buf[1:9], uint64(p.PingTS))
|
||||
|
||||
// SrcV4.
|
||||
if p.SrcV4.IsValid() {
|
||||
a4 := p.SrcV4.Addr().As4()
|
||||
copy(buf[9:13], a4[:])
|
||||
binary.BigEndian.PutUint16(buf[13:15], p.SrcV4.Port())
|
||||
} else {
|
||||
clear(buf[9:15])
|
||||
}
|
||||
|
||||
// SrcV6.
|
||||
a16 := p.SrcV6.Addr().As16()
|
||||
copy(buf[15:31], a16[:])
|
||||
binary.BigEndian.PutUint16(buf[31:33], p.SrcV6.Port())
|
||||
|
||||
// Dst.
|
||||
a16 = p.Dst.Addr().As16()
|
||||
copy(buf[33:49], a16[:])
|
||||
binary.BigEndian.PutUint16(buf[49:51], p.Dst.Port())
|
||||
return buf[:Size]
|
||||
}
|
||||
|
||||
// Unmarshal decodes a Ping from a fixed-size 51-byte array.
|
||||
func Unmarshal(buf [Size]byte) (Ping, error) {
|
||||
if buf[0] != version {
|
||||
return Ping{}, fmt.Errorf("unknown ping version %d", buf[0])
|
||||
}
|
||||
p := Ping{
|
||||
PingTS: int64(binary.BigEndian.Uint64(buf[1:9])),
|
||||
}
|
||||
|
||||
addr := netip.AddrFrom4([4]byte(buf[9:13]))
|
||||
if !addr.IsUnspecified() {
|
||||
p.SrcV4 = netip.AddrPortFrom(addr, binary.BigEndian.Uint16(buf[13:15]))
|
||||
}
|
||||
|
||||
addr = netip.AddrFrom16([16]byte(buf[15:31])).Unmap()
|
||||
if !addr.IsUnspecified() {
|
||||
p.SrcV6 = netip.AddrPortFrom(addr, binary.BigEndian.Uint16(buf[31:33]))
|
||||
}
|
||||
|
||||
addr = netip.AddrFrom16([16]byte(buf[33:49])).Unmap()
|
||||
if !addr.IsUnspecified() {
|
||||
p.Dst = netip.AddrPortFrom(addr, binary.BigEndian.Uint16(buf[49:51]))
|
||||
}
|
||||
|
||||
return p, nil
|
||||
}
|
||||
@@ -1,106 +0,0 @@
|
||||
package control_test
|
||||
|
||||
import (
|
||||
"net/netip"
|
||||
"testing"
|
||||
|
||||
"vppn/peer/control"
|
||||
)
|
||||
|
||||
func TestRoundTrip(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
ping control.Ping
|
||||
}{
|
||||
{
|
||||
name: "zero",
|
||||
ping: control.Ping{},
|
||||
},
|
||||
{
|
||||
name: "client ping",
|
||||
ping: control.Ping{
|
||||
PingTS: 1234567890,
|
||||
SrcV4: netip.MustParseAddrPort("1.2.3.4:51820"),
|
||||
Dst: netip.MustParseAddrPort("5.6.7.8:51820"),
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "server response",
|
||||
ping: control.Ping{
|
||||
PingTS: 1234567890,
|
||||
SrcV4: netip.MustParseAddrPort("5.6.7.8:51820"),
|
||||
Dst: netip.MustParseAddrPort("1.2.3.4:9999"),
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "IPv6 only",
|
||||
ping: control.Ping{
|
||||
PingTS: 999,
|
||||
SrcV6: netip.MustParseAddrPort("[2001:db8::1]:51820"),
|
||||
Dst: netip.MustParseAddrPort("[2001:db8::2]:51820"),
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "dual stack",
|
||||
ping: control.Ping{
|
||||
PingTS: 555,
|
||||
SrcV4: netip.MustParseAddrPort("1.2.3.4:51820"),
|
||||
SrcV6: netip.MustParseAddrPort("[2001:db8::1]:51820"),
|
||||
Dst: netip.MustParseAddrPort("5.6.7.8:9999"),
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "no src known",
|
||||
ping: control.Ping{
|
||||
Dst: netip.MustParseAddrPort("5.6.7.8:51820"),
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
var buf [control.Size]byte
|
||||
tc.ping.Marshal(buf[:])
|
||||
got, err := control.Unmarshal(buf)
|
||||
if err != nil {
|
||||
t.Fatalf("Unmarshal: %v", err)
|
||||
}
|
||||
if got != tc.ping {
|
||||
t.Fatalf("round-trip mismatch:\n got %+v\n want %+v", got, tc.ping)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestUnmarshalBadVersion(t *testing.T) {
|
||||
var buf [control.Size]byte
|
||||
buf[0] = 99
|
||||
if _, err := control.Unmarshal(buf); err == nil {
|
||||
t.Fatal("expected error for unknown version, got nil")
|
||||
}
|
||||
}
|
||||
|
||||
func TestZeroEncoding(t *testing.T) {
|
||||
var buf [control.Size]byte
|
||||
(control.Ping{}).Marshal(buf[:])
|
||||
for i, b := range buf {
|
||||
if i == 0 {
|
||||
continue // version byte
|
||||
}
|
||||
if b != 0 {
|
||||
t.Fatalf("expected zero encoding at byte %d, got %d", i, b)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestRoleFor(t *testing.T) {
|
||||
lo := netip.MustParseAddr("10.0.0.1")
|
||||
hi := netip.MustParseAddr("10.0.0.2")
|
||||
|
||||
if control.RoleFor(lo, hi) != control.Client {
|
||||
t.Error("lower IP should be client")
|
||||
}
|
||||
if control.RoleFor(hi, lo) != control.Server {
|
||||
t.Error("higher IP should be server")
|
||||
}
|
||||
}
|
||||
@@ -1,22 +0,0 @@
|
||||
package control
|
||||
|
||||
import "net/netip"
|
||||
|
||||
// Role identifies a peer's role in a ping exchange with a specific remote peer.
|
||||
type Role string
|
||||
|
||||
const (
|
||||
// Client initiates pings and measures RTT.
|
||||
Client Role = "CLIENT"
|
||||
// Server responds to pings.
|
||||
Server Role = "SERVER"
|
||||
)
|
||||
|
||||
// RoleFor returns the Role of local relative to remote.
|
||||
// The peer with the lower VPN IP is the client.
|
||||
func RoleFor(local, remote netip.Addr) Role {
|
||||
if local.Compare(remote) < 0 {
|
||||
return Client
|
||||
}
|
||||
return Server
|
||||
}
|
||||
@@ -1,68 +0,0 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"log"
|
||||
"net"
|
||||
"net/netip"
|
||||
"time"
|
||||
|
||||
"vppn/peer/control"
|
||||
)
|
||||
|
||||
var _ ControlConn = (*udpControlConn)(nil)
|
||||
|
||||
type udpControlConn struct {
|
||||
conn *net.UDPConn
|
||||
}
|
||||
|
||||
// newUDPControlConn opens a UDP socket bound to localIP:port.
|
||||
func newUDPControlConn(localIP netip.Addr, port uint16) (*udpControlConn, error) {
|
||||
addr := net.UDPAddrFromAddrPort(netip.AddrPortFrom(localIP, port))
|
||||
conn, err := net.ListenUDP("udp4", addr)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &udpControlConn{conn: conn}, nil
|
||||
}
|
||||
|
||||
func (c *udpControlConn) SendPing(dst netip.AddrPort, ping control.Ping, buf []byte) error {
|
||||
_, err := c.conn.WriteToUDP(ping.Marshal(buf), net.UDPAddrFromAddrPort(dst))
|
||||
return err
|
||||
}
|
||||
|
||||
// run reads incoming ping packets and forwards them to ch until ctx is done.
|
||||
// Call this in a goroutine before starting the App event loop.
|
||||
func (c *udpControlConn) run(ch chan<- PingEvent) {
|
||||
const errorTimeout = 8 * time.Second
|
||||
|
||||
var buf [control.Size]byte
|
||||
for {
|
||||
n, src, err := c.conn.ReadFromUDP(buf[:])
|
||||
if err != nil {
|
||||
log.Printf("control read: %v", err)
|
||||
time.Sleep(errorTimeout)
|
||||
continue
|
||||
}
|
||||
|
||||
if n != control.Size {
|
||||
continue
|
||||
}
|
||||
|
||||
ping, err := control.Unmarshal(buf)
|
||||
if err != nil {
|
||||
log.Printf("control unmarshal: %v", err)
|
||||
continue
|
||||
}
|
||||
|
||||
srcIP, ok := netip.AddrFromSlice(src.IP)
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
|
||||
ch <- PingEvent{srcVPNIP: srcIP.Unmap(), ping: ping}
|
||||
}
|
||||
}
|
||||
|
||||
func (c *udpControlConn) Close() error {
|
||||
return c.conn.Close()
|
||||
}
|
||||
15
peer/crypto.go
Normal file
15
peer/crypto.go
Normal file
@@ -0,0 +1,15 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"log"
|
||||
|
||||
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||
)
|
||||
|
||||
func generateWGKey() wgtypes.Key {
|
||||
key, err := wgtypes.GeneratePrivateKey()
|
||||
if err != nil {
|
||||
log.Fatalf("Failed to generate WireGuard private key: %v", err)
|
||||
}
|
||||
return key
|
||||
}
|
||||
@@ -1,90 +0,0 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"log"
|
||||
"net/netip"
|
||||
"syscall"
|
||||
"time"
|
||||
|
||||
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||
)
|
||||
|
||||
// devRetry calls fn up to 6 times with exponential backoff, retrying on EBUSY
|
||||
// (transient netlink contention during WireGuard handshake/rekey). Fatal on
|
||||
// any other error.
|
||||
func devRetry(vpnIP netip.Addr, op string, fn func() error) {
|
||||
const attempts = 6
|
||||
timeout := 10 * time.Millisecond
|
||||
for i := range attempts {
|
||||
err := fn()
|
||||
if err == nil {
|
||||
return
|
||||
}
|
||||
if errors.Is(err, syscall.EBUSY) && i < attempts-1 {
|
||||
time.Sleep(timeout)
|
||||
timeout *= 2
|
||||
continue
|
||||
}
|
||||
log.Fatalf("%s %v: %v", op, vpnIP, err)
|
||||
}
|
||||
}
|
||||
|
||||
func (a *App) devPeers() []wgtypes.Peer {
|
||||
peers, err := a.dev.Peers()
|
||||
if err != nil {
|
||||
log.Fatalf("Failed to get peers %v: %v", a.vpnIP, err)
|
||||
}
|
||||
return peers
|
||||
}
|
||||
|
||||
func (a *App) devAddRelayed(p *Peer) {
|
||||
log.Printf("RELAYED: %s - %s ", p.Name, p.VPNIP.String())
|
||||
devRetry(p.VPNIP, "AddPeer", func() error { return a.dev.AddPeer(p.PubKey()) })
|
||||
|
||||
p.State = StateRelayed
|
||||
p.EndpointV4 = netip.AddrPort{}
|
||||
p.EndpointV6 = netip.AddrPort{}
|
||||
p.EndpointLAN = netip.AddrPort{}
|
||||
}
|
||||
|
||||
func (a *App) devAddDirect(p *Peer, endpoint netip.AddrPort) {
|
||||
log.Printf("DIRECT: %s - %s @ %s", p.Name, p.VPNIP.String(), endpoint.String())
|
||||
devRetry(p.VPNIP, "AddDirect", func() error { return a.dev.AddDirect(p.PubKey(), endpoint, p.VPNIP) })
|
||||
|
||||
p.State = StateDirect
|
||||
}
|
||||
|
||||
func (a *App) devSetRelay(p *Peer, endpoint netip.AddrPort) {
|
||||
log.Printf("RELAY: %s - %s @ %s", p.Name, p.VPNIP.String(), endpoint.String())
|
||||
devRetry(p.VPNIP, "SetRelay", func() error { return a.dev.SetRelay(p.PubKey(), endpoint, a.vpnNet) })
|
||||
|
||||
p.State = StateDirect // Direct connection. The app marks peer as relay.
|
||||
}
|
||||
|
||||
func (a *App) devPromote(p *Peer) {
|
||||
ep := p.WGEndpoint()
|
||||
if ep.IsValid() {
|
||||
log.Printf("PROMOTED: %s - %s @ %s", p.Name, p.VPNIP.String(), p.WGEndpoint().String())
|
||||
} else {
|
||||
log.Printf("DIRECT: %s - %s (waiting for handshake)", p.Name, p.VPNIP.String())
|
||||
}
|
||||
devRetry(p.VPNIP, "Promote", func() error { return a.dev.Promote(p.PubKey(), p.VPNIP) })
|
||||
|
||||
p.State = StateDirect
|
||||
p.LastPing = time.Now() // Assume the peer is up after being promoted.
|
||||
}
|
||||
|
||||
func (a *App) devAddProbe(p *Peer, endpoint netip.AddrPort) {
|
||||
log.Printf("PROBE: %s - %s @ %s", p.Name, p.VPNIP.String(), endpoint.String())
|
||||
devRetry(p.VPNIP, "AddProbe", func() error { return a.dev.AddProbe(p.PubKey(), endpoint) })
|
||||
|
||||
p.State = StateProbing
|
||||
p.ProbeStart = time.Now()
|
||||
p.ProbeEndpoint = endpoint
|
||||
}
|
||||
|
||||
func (a *App) devRemove(p *Peer) {
|
||||
log.Printf("REMOVED: %s", p.PubKey())
|
||||
devRetry(p.VPNIP, "RemovePeer", func() error { return a.dev.RemovePeer(p.PubKey()) })
|
||||
}
|
||||
@@ -1,43 +0,0 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"net/netip"
|
||||
"testing"
|
||||
|
||||
"vppn/peer/control"
|
||||
)
|
||||
|
||||
type sentPing struct {
|
||||
Dst netip.AddrPort
|
||||
Ping control.Ping
|
||||
}
|
||||
|
||||
type fakeControlConn struct {
|
||||
Sent []sentPing
|
||||
}
|
||||
|
||||
func (f *fakeControlConn) SendPing(dst netip.AddrPort, ping control.Ping, _ []byte) error {
|
||||
f.Sent = append(f.Sent, sentPing{Dst: dst, Ping: ping})
|
||||
return nil
|
||||
}
|
||||
|
||||
func (f *fakeControlConn) AssertNone(t *testing.T) {
|
||||
t.Helper()
|
||||
if len(f.Sent) != 0 {
|
||||
t.Fatalf("expected no pings sent, got %d: %v", len(f.Sent), f.Sent)
|
||||
}
|
||||
}
|
||||
|
||||
func (f *fakeControlConn) AssertSent(t *testing.T, i int, dst netip.AddrPort, ping control.Ping) {
|
||||
t.Helper()
|
||||
if i >= len(f.Sent) {
|
||||
t.Fatalf("no ping at index %d (have %d)", i, len(f.Sent))
|
||||
}
|
||||
got := f.Sent[i]
|
||||
if got.Dst != dst {
|
||||
t.Errorf("ping[%d].Dst = %v, want %v", i, got.Dst, dst)
|
||||
}
|
||||
if got.Ping != ping {
|
||||
t.Errorf("ping[%d].Ping = %+v, want %+v", i, got.Ping, ping)
|
||||
}
|
||||
}
|
||||
@@ -1,123 +0,0 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"net/netip"
|
||||
"sync"
|
||||
"testing"
|
||||
|
||||
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||
)
|
||||
|
||||
// fakeWGDevice records every call made to it. It is safe to read Calls after
|
||||
// the event loop has processed the event under test (single-threaded loop
|
||||
// means no extra synchronisation needed, but the mutex guards concurrent test
|
||||
// helpers if needed).
|
||||
type fakeWGDevice struct {
|
||||
mu sync.Mutex
|
||||
Calls []fakeCall
|
||||
peers []wgtypes.Peer
|
||||
}
|
||||
|
||||
type fakeCall struct {
|
||||
Method string
|
||||
PubKey wgtypes.Key
|
||||
Endpoint netip.AddrPort
|
||||
VPNiP netip.Addr
|
||||
Network netip.Prefix
|
||||
}
|
||||
|
||||
func (f *fakeWGDevice) record(c fakeCall) {
|
||||
f.mu.Lock()
|
||||
f.Calls = append(f.Calls, c)
|
||||
f.mu.Unlock()
|
||||
}
|
||||
|
||||
func (f *fakeWGDevice) Name() string { return "wg-test" }
|
||||
|
||||
func (f *fakeWGDevice) Peers() ([]wgtypes.Peer, error) {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
out := make([]wgtypes.Peer, len(f.peers))
|
||||
copy(out, f.peers)
|
||||
return out, nil
|
||||
}
|
||||
|
||||
func (f *fakeWGDevice) AddPeer(pubKey wgtypes.Key) error {
|
||||
f.record(fakeCall{Method: "AddPeer", PubKey: pubKey})
|
||||
return nil
|
||||
}
|
||||
|
||||
func (f *fakeWGDevice) AddDirect(pubKey wgtypes.Key, endpoint netip.AddrPort, vpnIP netip.Addr) error {
|
||||
f.record(fakeCall{Method: "AddDirect", PubKey: pubKey, Endpoint: endpoint, VPNiP: vpnIP})
|
||||
return nil
|
||||
}
|
||||
|
||||
func (f *fakeWGDevice) SetRelay(pubKey wgtypes.Key, endpoint netip.AddrPort, network netip.Prefix) error {
|
||||
f.record(fakeCall{Method: "SetRelay", PubKey: pubKey, Endpoint: endpoint, Network: network})
|
||||
return nil
|
||||
}
|
||||
|
||||
func (f *fakeWGDevice) AddProbe(pubKey wgtypes.Key, endpoint netip.AddrPort) error {
|
||||
f.record(fakeCall{Method: "AddProbe", PubKey: pubKey, Endpoint: endpoint})
|
||||
return nil
|
||||
}
|
||||
|
||||
func (f *fakeWGDevice) Promote(pubKey wgtypes.Key, vpnIP netip.Addr) error {
|
||||
f.record(fakeCall{Method: "Promote", PubKey: pubKey, VPNiP: vpnIP})
|
||||
return nil
|
||||
}
|
||||
|
||||
func (f *fakeWGDevice) RemovePeer(pubKey wgtypes.Key) error {
|
||||
f.record(fakeCall{Method: "RemovePeer", PubKey: pubKey})
|
||||
return nil
|
||||
}
|
||||
|
||||
// AssertNoCalls fails the test if any dev calls were recorded.
|
||||
func (f *fakeWGDevice) AssertNoCalls(t *testing.T) {
|
||||
t.Helper()
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
if len(f.Calls) != 0 {
|
||||
t.Fatalf("unexpected dev calls: %v", f.Calls)
|
||||
}
|
||||
}
|
||||
|
||||
func (f *fakeWGDevice) AssertAddPeer(t *testing.T, i int, pubKey wgtypes.Key) {
|
||||
t.Helper()
|
||||
f.assertCall(t, i, fakeCall{Method: "AddPeer", PubKey: pubKey})
|
||||
}
|
||||
|
||||
func (f *fakeWGDevice) AssertAddDirect(t *testing.T, i int, pubKey wgtypes.Key, endpoint netip.AddrPort, vpnIP netip.Addr) {
|
||||
t.Helper()
|
||||
f.assertCall(t, i, fakeCall{Method: "AddDirect", PubKey: pubKey, Endpoint: endpoint, VPNiP: vpnIP})
|
||||
}
|
||||
|
||||
func (f *fakeWGDevice) AssertSetRelay(t *testing.T, i int, pubKey wgtypes.Key, endpoint netip.AddrPort, network netip.Prefix) {
|
||||
t.Helper()
|
||||
f.assertCall(t, i, fakeCall{Method: "SetRelay", PubKey: pubKey, Endpoint: endpoint, Network: network})
|
||||
}
|
||||
|
||||
func (f *fakeWGDevice) AssertAddProbe(t *testing.T, i int, pubKey wgtypes.Key, endpoint netip.AddrPort) {
|
||||
t.Helper()
|
||||
f.assertCall(t, i, fakeCall{Method: "AddProbe", PubKey: pubKey, Endpoint: endpoint})
|
||||
}
|
||||
|
||||
func (f *fakeWGDevice) AssertPromote(t *testing.T, i int, pubKey wgtypes.Key, vpnIP netip.Addr) {
|
||||
t.Helper()
|
||||
f.assertCall(t, i, fakeCall{Method: "Promote", PubKey: pubKey, VPNiP: vpnIP})
|
||||
}
|
||||
|
||||
func (f *fakeWGDevice) AssertRemovePeer(t *testing.T, i int, pubKey wgtypes.Key) {
|
||||
t.Helper()
|
||||
f.assertCall(t, i, fakeCall{Method: "RemovePeer", PubKey: pubKey})
|
||||
}
|
||||
|
||||
func (f *fakeWGDevice) assertCall(t *testing.T, i int, c fakeCall) {
|
||||
t.Helper()
|
||||
if len(f.Calls) <= i {
|
||||
t.Fatalf("no call at index %d: %v", i, c)
|
||||
}
|
||||
if c != f.Calls[i] {
|
||||
t.Fatalf("call[%d]: got %v, want %v", i, f.Calls[i], c)
|
||||
}
|
||||
}
|
||||
97
peer/files.go
Normal file
97
peer/files.go
Normal file
@@ -0,0 +1,97 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"log"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"vppn/m"
|
||||
)
|
||||
|
||||
type LocalConfig struct {
|
||||
LocalPeerIP byte
|
||||
Network []byte
|
||||
WGPrivKey string
|
||||
}
|
||||
|
||||
func configDir(netName string) string {
|
||||
d, err := os.UserHomeDir()
|
||||
if err != nil {
|
||||
log.Fatalf("Failed to get user home directory: %v", err)
|
||||
}
|
||||
return filepath.Join(d, ".vppn", netName)
|
||||
}
|
||||
|
||||
func lockFilePath(netName string) string {
|
||||
return filepath.Join(configDir(netName), "__lock__")
|
||||
}
|
||||
|
||||
func peerConfigPath(netName string) string {
|
||||
return filepath.Join(configDir(netName), "config.json")
|
||||
}
|
||||
|
||||
func peerStatePath(netName string) string {
|
||||
return filepath.Join(configDir(netName), "state.json")
|
||||
}
|
||||
|
||||
func statusSocketPath(netName string) string {
|
||||
return filepath.Join(configDir(netName), "status.sock")
|
||||
}
|
||||
|
||||
func storeJson(x any, outPath string) error {
|
||||
outDir := filepath.Dir(outPath)
|
||||
_ = os.MkdirAll(outDir, 0700)
|
||||
|
||||
tmpPath := outPath + ".tmp"
|
||||
buf, err := json.Marshal(x)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
f, err := os.Create(tmpPath)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if _, err := f.Write(buf); err != nil {
|
||||
f.Close()
|
||||
return err
|
||||
}
|
||||
|
||||
if err := f.Sync(); err != nil {
|
||||
f.Close()
|
||||
return err
|
||||
}
|
||||
|
||||
if err := f.Close(); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return os.Rename(tmpPath, outPath)
|
||||
}
|
||||
|
||||
func storePeerConfig(netName string, pc LocalConfig) error {
|
||||
return storeJson(pc, peerConfigPath(netName))
|
||||
}
|
||||
|
||||
func storeNetworkState(netName string, ps m.NetworkState) error {
|
||||
return storeJson(ps, peerStatePath(netName))
|
||||
}
|
||||
|
||||
func loadJson(dataPath string, ptr any) error {
|
||||
data, err := os.ReadFile(dataPath)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return json.Unmarshal(data, ptr)
|
||||
}
|
||||
|
||||
func loadPeerConfig(netName string) (pc LocalConfig, err error) {
|
||||
return pc, loadJson(peerConfigPath(netName), &pc)
|
||||
}
|
||||
|
||||
func loadNetworkState(netName string) (ps m.NetworkState, err error) {
|
||||
return ps, loadJson(peerStatePath(netName), &ps)
|
||||
}
|
||||
|
||||
57
peer/files_test.go
Normal file
57
peer/files_test.go
Normal file
@@ -0,0 +1,57 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"path/filepath"
|
||||
"reflect"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestFilePaths(t *testing.T) {
|
||||
confDir := configDir("netName")
|
||||
if filepath.Base(confDir) != "netName" {
|
||||
t.Fatal(confDir)
|
||||
}
|
||||
if filepath.Base(filepath.Dir(confDir)) != ".vppn" {
|
||||
t.Fatal(confDir)
|
||||
}
|
||||
|
||||
path := peerConfigPath("netName")
|
||||
if path != filepath.Join(confDir, "config.json") {
|
||||
t.Fatal(path)
|
||||
}
|
||||
|
||||
path = peerStatePath("netName")
|
||||
if path != filepath.Join(confDir, "state.json") {
|
||||
t.Fatal(path)
|
||||
}
|
||||
}
|
||||
|
||||
func TestStoreLoadJson(t *testing.T) {
|
||||
type Object struct {
|
||||
Name string
|
||||
Age int
|
||||
Price float64
|
||||
}
|
||||
|
||||
tmpDir := t.TempDir()
|
||||
outPath := filepath.Join(tmpDir, "object.json")
|
||||
|
||||
obj := Object{
|
||||
Name: "Jason",
|
||||
Age: 22,
|
||||
Price: 123.534,
|
||||
}
|
||||
|
||||
if err := storeJson(obj, outPath); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
obj2 := Object{}
|
||||
if err := loadJson(outPath, &obj2); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
if !reflect.DeepEqual(obj, obj2) {
|
||||
t.Fatal(obj, obj2)
|
||||
}
|
||||
}
|
||||
39
peer/globals.go
Normal file
39
peer/globals.go
Normal file
@@ -0,0 +1,39 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"net"
|
||||
"net/netip"
|
||||
"time"
|
||||
|
||||
"golang.zx2c4.com/wireguard/wgctrl"
|
||||
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||
)
|
||||
|
||||
const (
|
||||
broadcastInterval = 16 * time.Second
|
||||
broadcastErrorTimeoutInterval = 8 * time.Second
|
||||
)
|
||||
|
||||
var multicastAddr = net.UDPAddrFromAddrPort(netip.AddrPortFrom(
|
||||
netip.AddrFrom4([4]byte{224, 0, 0, 157}),
|
||||
4560))
|
||||
|
||||
type Globals struct {
|
||||
LocalConfig // Embed, immutable.
|
||||
|
||||
// WireGuard private key, client, and device name. Immutable after init.
|
||||
WGPrivKey wgtypes.Key
|
||||
WGClient *wgctrl.Client
|
||||
WGDevName string
|
||||
|
||||
// Local public address (if available). Immutable.
|
||||
LocalAddr netip.AddrPort
|
||||
LocalAddrValid bool
|
||||
}
|
||||
|
||||
func NewGlobals(localConfig LocalConfig, localAddr netip.AddrPort) (g Globals) {
|
||||
g.LocalConfig = localConfig
|
||||
g.LocalAddr = localAddr
|
||||
g.LocalAddrValid = localAddr.IsValid()
|
||||
return g
|
||||
}
|
||||
128
peer/hosts.go
128
peer/hosts.go
@@ -1,128 +0,0 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"log"
|
||||
"net/netip"
|
||||
"os"
|
||||
"sort"
|
||||
"strings"
|
||||
"syscall"
|
||||
|
||||
"git.crumpington.com/lib/flock"
|
||||
)
|
||||
|
||||
const (
|
||||
hostsFile = "/etc/hosts"
|
||||
hostsBegin = "# BEGIN vppn"
|
||||
hostsEnd = "# END vppn"
|
||||
)
|
||||
|
||||
// hostMarkers returns the begin/end marker lines that delimit the managed
|
||||
// section for localDomain. The domain is wrapped in parentheses so one domain's
|
||||
// marker can never be a prefix of another's (e.g. "net" vs "net2") when
|
||||
// multiple vppn instances share /etc/hosts.
|
||||
func hostMarkers(localDomain string) (begin, end string) {
|
||||
return hostsBegin + "(" + localDomain + ")", hostsEnd + "(" + localDomain + ")"
|
||||
}
|
||||
|
||||
// updateHosts rewrites the managed vppn section in /etc/hosts using the
|
||||
// current peersByIP map. Peers without a Name are skipped.
|
||||
func (a *App) updateHosts() {
|
||||
if a.localDomain == "" {
|
||||
return
|
||||
}
|
||||
if err := updateHosts(hostsFile, a.localDomain, a.peersByIP); err != nil {
|
||||
log.Printf("Failed to update hosts file: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func updateHosts(hostsPath, localDomain string, peers map[netip.Addr]*Peer) error {
|
||||
lockFile, err := flock.Lock(hostsPath + ".vppn.lock")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer lockFile.Close()
|
||||
|
||||
begin, end := hostMarkers(localDomain)
|
||||
|
||||
info, err := os.Stat(hostsPath)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
raw, err := os.ReadFile(hostsPath)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
data := string(raw)
|
||||
|
||||
before := strings.TrimSpace(data)
|
||||
after := ""
|
||||
|
||||
if idxBegin := strings.Index(data, begin); idxBegin != -1 {
|
||||
idxEnd := strings.Index(data[idxBegin:], end)
|
||||
if idxEnd != -1 {
|
||||
after = strings.TrimSpace(data[idxBegin+idxEnd+len(end):])
|
||||
}
|
||||
before = strings.TrimSpace(data[:idxBegin])
|
||||
}
|
||||
|
||||
b := strings.Builder{}
|
||||
b.WriteString(before)
|
||||
b.WriteRune('\n')
|
||||
b.WriteString(after)
|
||||
b.WriteRune('\n')
|
||||
b.WriteRune('\n')
|
||||
|
||||
b.WriteString(begin)
|
||||
b.WriteRune('\n')
|
||||
|
||||
// Collect entries so we can sort by IP for stable output. Pad the IP
|
||||
// column to the width of the widest possible address ("255.255.255.255")
|
||||
// for readability.
|
||||
type entry struct {
|
||||
ip netip.Addr
|
||||
host string
|
||||
}
|
||||
var entries []entry
|
||||
for ip, p := range peers {
|
||||
if p.Name == "" {
|
||||
continue
|
||||
}
|
||||
entries = append(entries, entry{ip: ip, host: p.Name + "." + localDomain})
|
||||
}
|
||||
sort.Slice(entries, func(i, j int) bool {
|
||||
return entries[i].ip.Less(entries[j].ip)
|
||||
})
|
||||
|
||||
for _, e := range entries {
|
||||
b.WriteString(fmt.Sprintf("%-15s %s\n", e.ip.String(), e.host))
|
||||
}
|
||||
|
||||
b.WriteString(end)
|
||||
b.WriteRune('\n')
|
||||
|
||||
// Write to a temp file in the same directory, then rename over the
|
||||
// original so readers never observe a partial file. Preserve the
|
||||
// original's mode and ownership, since rename replaces the inode.
|
||||
tmpPath := hostsPath + ".vppn.tmp"
|
||||
if err := os.WriteFile(tmpPath, []byte(b.String()), info.Mode().Perm()); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if st, ok := info.Sys().(*syscall.Stat_t); ok {
|
||||
if err := os.Chown(tmpPath, int(st.Uid), int(st.Gid)); err != nil {
|
||||
os.Remove(tmpPath)
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
if err := os.Rename(tmpPath, hostsPath); err != nil {
|
||||
os.Remove(tmpPath)
|
||||
return err
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
@@ -1,205 +0,0 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"net/netip"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"sort"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// writeTempHosts creates a temp hosts file with the given content and returns
|
||||
// its path.
|
||||
func writeTempHosts(t *testing.T, content string) string {
|
||||
t.Helper()
|
||||
path := filepath.Join(t.TempDir(), "hosts")
|
||||
if err := os.WriteFile(path, []byte(content), 0600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return path
|
||||
}
|
||||
|
||||
// readManagedSection returns the lines between the begin/end markers for the
|
||||
// given localDomain, plus everything outside the section ("outside").
|
||||
func readManagedSection(t *testing.T, path, localDomain string) (inside, outside []string) {
|
||||
t.Helper()
|
||||
raw, err := os.ReadFile(path)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
begin, end := hostMarkers(localDomain)
|
||||
|
||||
inSection := false
|
||||
for _, line := range strings.Split(string(raw), "\n") {
|
||||
switch {
|
||||
case strings.HasPrefix(line, begin):
|
||||
inSection = true
|
||||
case strings.HasPrefix(line, end):
|
||||
inSection = false
|
||||
case inSection:
|
||||
if f := strings.Join(strings.Fields(line), " "); f != "" {
|
||||
inside = append(inside, f)
|
||||
}
|
||||
default:
|
||||
if f := strings.Join(strings.Fields(line), " "); f != "" {
|
||||
outside = append(outside, f)
|
||||
}
|
||||
}
|
||||
}
|
||||
return inside, outside
|
||||
}
|
||||
|
||||
func peer(name string) *Peer {
|
||||
return &Peer{Name: name}
|
||||
}
|
||||
|
||||
func TestUpdateHosts_AddsSection(t *testing.T) {
|
||||
path := writeTempHosts(t, "127.0.0.1 localhost\n")
|
||||
|
||||
peers := map[netip.Addr]*Peer{
|
||||
netip.MustParseAddr("10.11.12.1"): peer("hub"),
|
||||
netip.MustParseAddr("10.11.12.10"): peer("laptop"),
|
||||
}
|
||||
|
||||
if err := updateHosts(path, "mynet.local", peers); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
inside, outside := readManagedSection(t, path, "mynet.local")
|
||||
|
||||
sort.Strings(inside)
|
||||
want := []string{
|
||||
"10.11.12.1 hub.mynet.local",
|
||||
"10.11.12.10 laptop.mynet.local",
|
||||
}
|
||||
if strings.Join(inside, "\n") != strings.Join(want, "\n") {
|
||||
t.Errorf("managed section = %v, want %v", inside, want)
|
||||
}
|
||||
|
||||
if !contains(outside, "127.0.0.1 localhost") {
|
||||
t.Errorf("original content lost; outside = %v", outside)
|
||||
}
|
||||
}
|
||||
|
||||
func TestUpdateHosts_ReplacesExistingSection(t *testing.T) {
|
||||
path := writeTempHosts(t, "127.0.0.1 localhost\n")
|
||||
|
||||
// First write.
|
||||
first := map[netip.Addr]*Peer{
|
||||
netip.MustParseAddr("10.11.12.1"): peer("hub"),
|
||||
}
|
||||
if err := updateHosts(path, "mynet.local", first); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
// Second write with a different set of peers.
|
||||
second := map[netip.Addr]*Peer{
|
||||
netip.MustParseAddr("10.11.12.20"): peer("phone"),
|
||||
}
|
||||
if err := updateHosts(path, "mynet.local", second); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
inside, outside := readManagedSection(t, path, "mynet.local")
|
||||
|
||||
if len(inside) != 1 || inside[0] != "10.11.12.20 phone.mynet.local" {
|
||||
t.Errorf("section not replaced; inside = %v", inside)
|
||||
}
|
||||
if contains(inside, "10.11.12.1 hub.mynet.local") {
|
||||
t.Errorf("stale entry remained; inside = %v", inside)
|
||||
}
|
||||
if !contains(outside, "127.0.0.1 localhost") {
|
||||
t.Errorf("original content lost; outside = %v", outside)
|
||||
}
|
||||
}
|
||||
|
||||
func TestUpdateHosts_SkipsEmptyNames(t *testing.T) {
|
||||
path := writeTempHosts(t, "127.0.0.1 localhost\n")
|
||||
|
||||
peers := map[netip.Addr]*Peer{
|
||||
netip.MustParseAddr("10.11.12.1"): peer("hub"),
|
||||
netip.MustParseAddr("10.11.12.99"): peer(""), // no name
|
||||
}
|
||||
if err := updateHosts(path, "mynet.local", peers); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
inside, _ := readManagedSection(t, path, "mynet.local")
|
||||
if len(inside) != 1 || inside[0] != "10.11.12.1 hub.mynet.local" {
|
||||
t.Errorf("expected only named peer; inside = %v", inside)
|
||||
}
|
||||
}
|
||||
|
||||
func TestUpdateHosts_Idempotent(t *testing.T) {
|
||||
path := writeTempHosts(t, "127.0.0.1 localhost\n")
|
||||
|
||||
peers := map[netip.Addr]*Peer{
|
||||
netip.MustParseAddr("10.11.12.1"): peer("hub"),
|
||||
}
|
||||
if err := updateHosts(path, "mynet.local", peers); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
first, err := os.ReadFile(path)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := updateHosts(path, "mynet.local", peers); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
second, err := os.ReadFile(path)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if string(first) != string(second) {
|
||||
t.Errorf("repeated update changed file:\nfirst:\n%s\nsecond:\n%s", first, second)
|
||||
}
|
||||
}
|
||||
|
||||
// TestUpdateHosts_PrefixDomainsCoexist guards finding 4.4: two domains where
|
||||
// one label is a prefix of the other ("net" vs "net2") must each manage their
|
||||
// own section without clobbering the other's, even sharing one hosts file.
|
||||
func TestUpdateHosts_PrefixDomainsCoexist(t *testing.T) {
|
||||
path := writeTempHosts(t, "127.0.0.1 localhost\n")
|
||||
|
||||
if err := updateHosts(path, "net2.local", map[netip.Addr]*Peer{
|
||||
netip.MustParseAddr("10.0.2.1"): peer("a"),
|
||||
}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := updateHosts(path, "net.local", map[netip.Addr]*Peer{
|
||||
netip.MustParseAddr("10.0.1.1"): peer("b"),
|
||||
}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
// Both sections coexist after writing the prefix domain.
|
||||
if in, _ := readManagedSection(t, path, "net2.local"); len(in) != 1 || in[0] != "10.0.2.1 a.net2.local" {
|
||||
t.Errorf("net2 section clobbered: %v", in)
|
||||
}
|
||||
if in, _ := readManagedSection(t, path, "net.local"); len(in) != 1 || in[0] != "10.0.1.1 b.net.local" {
|
||||
t.Errorf("net section wrong: %v", in)
|
||||
}
|
||||
|
||||
// Re-updating net2 must not disturb the net section.
|
||||
if err := updateHosts(path, "net2.local", map[netip.Addr]*Peer{
|
||||
netip.MustParseAddr("10.0.2.2"): peer("c"),
|
||||
}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if in, _ := readManagedSection(t, path, "net.local"); len(in) != 1 || in[0] != "10.0.1.1 b.net.local" {
|
||||
t.Errorf("net section disturbed by net2 update: %v", in)
|
||||
}
|
||||
if in, _ := readManagedSection(t, path, "net2.local"); len(in) != 1 || in[0] != "10.0.2.2 c.net2.local" {
|
||||
t.Errorf("net2 section not updated: %v", in)
|
||||
}
|
||||
}
|
||||
|
||||
func contains(ss []string, s string) bool {
|
||||
for _, x := range ss {
|
||||
if x == s {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
@@ -1,154 +0,0 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"io"
|
||||
"log"
|
||||
"net/http"
|
||||
"net/netip"
|
||||
"net/url"
|
||||
"time"
|
||||
|
||||
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||
|
||||
"vppn/m"
|
||||
)
|
||||
|
||||
const hubPollInterval = 64 * time.Second
|
||||
|
||||
type HubPoller struct {
|
||||
selfVPNIP netip.Addr
|
||||
vpnNet netip.Prefix
|
||||
hubURL string
|
||||
apiKey string
|
||||
statePath string // where the network state cache is persisted
|
||||
addCh chan<- m.Peer
|
||||
removeCh chan<- wgtypes.Key
|
||||
known map[wgtypes.Key]struct{} // pubKeys currently configured
|
||||
}
|
||||
|
||||
func NewHubPoller(
|
||||
selfVPNIP netip.Addr,
|
||||
vpnNet netip.Prefix,
|
||||
hubURL, apiKey string,
|
||||
statePath string,
|
||||
addCh chan<- m.Peer,
|
||||
removeCh chan<- wgtypes.Key,
|
||||
) (*HubPoller, error) {
|
||||
u, err := url.Parse(hubURL)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
u.Path = "/peer/fetch-state/"
|
||||
|
||||
return &HubPoller{
|
||||
selfVPNIP: selfVPNIP,
|
||||
vpnNet: vpnNet,
|
||||
hubURL: u.String(),
|
||||
apiKey: apiKey,
|
||||
statePath: statePath,
|
||||
addCh: addCh,
|
||||
removeCh: removeCh,
|
||||
known: make(map[wgtypes.Key]struct{}),
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (hp *HubPoller) Run() {
|
||||
// Prime from the on-disk cache before reaching the hub, so the peer
|
||||
// configures WireGuard from its last known state even if the hub is down.
|
||||
// known starts empty, so this emits every cached peer as an add; the first
|
||||
// real poll then emits only deltas (adds for new peers, removes for gone).
|
||||
if state, err := loadNetworkState(hp.statePath); err == nil {
|
||||
hp.apply(state)
|
||||
}
|
||||
|
||||
client := &http.Client{Timeout: 32 * time.Second}
|
||||
|
||||
hp.poll(client)
|
||||
for range time.Tick(hubPollInterval) {
|
||||
hp.poll(client)
|
||||
}
|
||||
}
|
||||
|
||||
func (hp *HubPoller) poll(client *http.Client) {
|
||||
req, err := http.NewRequest(http.MethodGet, hp.hubURL, nil)
|
||||
if err != nil {
|
||||
log.Printf("[HubPoller] build request: %v", err)
|
||||
return
|
||||
}
|
||||
req.SetBasicAuth("", hp.apiKey)
|
||||
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
log.Printf("[HubPoller] fetch: %v", err)
|
||||
return
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
log.Printf("[HubPoller] unexpected status %d", resp.StatusCode)
|
||||
return
|
||||
}
|
||||
|
||||
body, err := io.ReadAll(io.LimitReader(resp.Body, 128*1024))
|
||||
if err != nil {
|
||||
log.Printf("[HubPoller] read body: %v", err)
|
||||
return
|
||||
}
|
||||
|
||||
var state m.NetworkState
|
||||
if err := json.Unmarshal(body, &state); err != nil {
|
||||
log.Printf("[HubPoller] unmarshal: %v", err)
|
||||
return
|
||||
}
|
||||
|
||||
// Persist only when the state actually changed, to avoid needless writes
|
||||
// on every poll.
|
||||
if hp.apply(state) {
|
||||
if err := saveNetworkState(hp.statePath, state); err != nil {
|
||||
log.Printf("[HubPoller] save state: %v", err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// apply diffs state against the set of known peers, emitting an add for each
|
||||
// newly-seen peer and a remove for each that disappeared. It returns true if
|
||||
// anything changed. A peer's config is immutable under a stable WG key (the hub
|
||||
// has no peer-edit path), so a key already in known needs no re-emit.
|
||||
func (hp *HubPoller) apply(state m.NetworkState) (changed bool) {
|
||||
seen := make(map[wgtypes.Key]struct{}, len(hp.known))
|
||||
|
||||
netAddr := hp.vpnNet.Addr().As4()
|
||||
|
||||
for _, p := range state.Peers {
|
||||
if p.WGPubKey == (wgtypes.Key{}) {
|
||||
continue
|
||||
}
|
||||
|
||||
octets := netAddr
|
||||
octets[3] = p.PeerIP
|
||||
vpnIP := netip.AddrFrom4(octets)
|
||||
if vpnIP == hp.selfVPNIP {
|
||||
continue
|
||||
}
|
||||
|
||||
seen[p.WGPubKey] = struct{}{}
|
||||
|
||||
if _, ok := hp.known[p.WGPubKey]; ok {
|
||||
continue
|
||||
}
|
||||
hp.known[p.WGPubKey] = struct{}{}
|
||||
hp.addCh <- p
|
||||
changed = true
|
||||
}
|
||||
|
||||
for key := range hp.known {
|
||||
if _, ok := seen[key]; !ok {
|
||||
delete(hp.known, key)
|
||||
hp.removeCh <- key
|
||||
changed = true
|
||||
}
|
||||
}
|
||||
|
||||
return changed
|
||||
}
|
||||
@@ -1,80 +0,0 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"net/netip"
|
||||
"testing"
|
||||
|
||||
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||
|
||||
"vppn/m"
|
||||
)
|
||||
|
||||
func testPoller(t *testing.T) (*HubPoller, chan m.Peer, chan wgtypes.Key) {
|
||||
t.Helper()
|
||||
addCh := make(chan m.Peer, 8)
|
||||
removeCh := make(chan wgtypes.Key, 8)
|
||||
hp := &HubPoller{
|
||||
selfVPNIP: netip.MustParseAddr("10.0.0.1"),
|
||||
vpnNet: netip.MustParsePrefix("10.0.0.0/24"),
|
||||
addCh: addCh,
|
||||
removeCh: removeCh,
|
||||
known: make(map[wgtypes.Key]struct{}),
|
||||
}
|
||||
return hp, addCh, removeCh
|
||||
}
|
||||
|
||||
func stateWith(key wgtypes.Key, peerIP byte) m.NetworkState {
|
||||
return m.NetworkState{Peers: []m.Peer{{
|
||||
PeerIP: peerIP,
|
||||
WGPubKey: key,
|
||||
}}}
|
||||
}
|
||||
|
||||
func TestApply_EmitsAddsAndReportsChange(t *testing.T) {
|
||||
hp, addCh, _ := testPoller(t)
|
||||
key := mustKey(t)
|
||||
|
||||
if changed := hp.apply(stateWith(key, 2)); !changed {
|
||||
t.Fatal("expected changed=true on first apply")
|
||||
}
|
||||
if len(addCh) != 1 {
|
||||
t.Fatalf("expected 1 add, got %d", len(addCh))
|
||||
}
|
||||
if got := <-addCh; got.WGPubKey != key {
|
||||
t.Errorf("add pubkey mismatch")
|
||||
}
|
||||
}
|
||||
|
||||
func TestApply_NoChangeWhenKnown(t *testing.T) {
|
||||
hp, addCh, _ := testPoller(t)
|
||||
key := mustKey(t)
|
||||
|
||||
hp.apply(stateWith(key, 2))
|
||||
<-addCh // drain initial add
|
||||
|
||||
if changed := hp.apply(stateWith(key, 2)); changed {
|
||||
t.Fatal("expected changed=false when peer already known")
|
||||
}
|
||||
if len(addCh) != 0 {
|
||||
t.Fatalf("expected no re-emit, got %d adds", len(addCh))
|
||||
}
|
||||
}
|
||||
|
||||
func TestApply_RemovesVanishedPeer(t *testing.T) {
|
||||
hp, addCh, removeCh := testPoller(t)
|
||||
key := mustKey(t)
|
||||
|
||||
hp.apply(stateWith(key, 2))
|
||||
<-addCh
|
||||
|
||||
// Empty state: the peer is gone.
|
||||
if changed := hp.apply(m.NetworkState{}); !changed {
|
||||
t.Fatal("expected changed=true when peer vanishes")
|
||||
}
|
||||
if len(removeCh) != 1 {
|
||||
t.Fatalf("expected 1 remove, got %d", len(removeCh))
|
||||
}
|
||||
if got := <-removeCh; got != key {
|
||||
t.Errorf("remove key mismatch")
|
||||
}
|
||||
}
|
||||
148
peer/hubpoller.go
Normal file
148
peer/hubpoller.go
Normal file
@@ -0,0 +1,148 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"io"
|
||||
"log"
|
||||
"net/http"
|
||||
"net/netip"
|
||||
"net/url"
|
||||
"time"
|
||||
"vppn/m"
|
||||
|
||||
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||
)
|
||||
|
||||
type HubPoller struct {
|
||||
Globals
|
||||
holePunch *HolePunch
|
||||
client *http.Client
|
||||
req *http.Request
|
||||
versions [256]int64
|
||||
netName string
|
||||
}
|
||||
|
||||
func NewHubPoller(
|
||||
g Globals,
|
||||
hp *HolePunch,
|
||||
netName,
|
||||
hubURL,
|
||||
apiKey string,
|
||||
) (*HubPoller, error) {
|
||||
u, err := url.Parse(hubURL)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
u.Path = "/peer/fetch-state/"
|
||||
|
||||
client := &http.Client{Timeout: 8 * time.Second}
|
||||
|
||||
req := &http.Request{
|
||||
Method: http.MethodGet,
|
||||
URL: u,
|
||||
Header: http.Header{},
|
||||
}
|
||||
req.SetBasicAuth("", apiKey)
|
||||
|
||||
return &HubPoller{
|
||||
Globals: g,
|
||||
holePunch: hp,
|
||||
client: client,
|
||||
req: req,
|
||||
netName: netName,
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (hp *HubPoller) logf(s string, args ...any) {
|
||||
log.Printf("[HubPoller] "+s, args...)
|
||||
}
|
||||
|
||||
func (hp *HubPoller) Run() {
|
||||
state, err := loadNetworkState(hp.netName)
|
||||
if err != nil {
|
||||
hp.logf("Failed to load network state: %v", err)
|
||||
hp.logf("Polling hub...")
|
||||
hp.pollHub()
|
||||
} else {
|
||||
hp.applyNetworkState(state)
|
||||
}
|
||||
|
||||
for range time.Tick(64 * time.Second) {
|
||||
hp.pollHub()
|
||||
}
|
||||
}
|
||||
|
||||
func (hp *HubPoller) pollHub() {
|
||||
var state m.NetworkState
|
||||
|
||||
resp, err := hp.client.Do(hp.req)
|
||||
if err != nil {
|
||||
hp.logf("Failed to fetch peer state: %v", err)
|
||||
return
|
||||
}
|
||||
body, err := io.ReadAll(resp.Body)
|
||||
_ = resp.Body.Close()
|
||||
if err != nil {
|
||||
hp.logf("Failed to read body from hub: %v", err)
|
||||
return
|
||||
}
|
||||
|
||||
if err := json.Unmarshal(body, &state); err != nil {
|
||||
hp.logf("Failed to unmarshal response from hub: %v\n%s", err, body)
|
||||
return
|
||||
}
|
||||
|
||||
if err := storeNetworkState(hp.netName, state); err != nil {
|
||||
hp.logf("Failed to store network state: %v", err)
|
||||
}
|
||||
|
||||
hp.applyNetworkState(state)
|
||||
}
|
||||
|
||||
func (hp *HubPoller) applyNetworkState(state m.NetworkState) {
|
||||
for i, peer := range state.Peers {
|
||||
if i == int(hp.LocalPeerIP) {
|
||||
continue
|
||||
}
|
||||
if peer != nil && peer.Version == hp.versions[i] {
|
||||
continue
|
||||
}
|
||||
hp.applyPeerConfig(peer)
|
||||
if peer != nil {
|
||||
hp.versions[i] = peer.Version
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func (hp *HubPoller) applyPeerConfig(peer *m.Peer) {
|
||||
if peer == nil || len(peer.WGPubKey) != wgtypes.KeyLen {
|
||||
return
|
||||
}
|
||||
if len(peer.PublicIP1) == 0 || peer.Port1 == 0 {
|
||||
return
|
||||
}
|
||||
|
||||
pubKey, err := wgtypes.NewKey(peer.WGPubKey)
|
||||
if err != nil {
|
||||
hp.logf("Invalid WG key for peer %d: %v", peer.PeerIP, err)
|
||||
return
|
||||
}
|
||||
|
||||
ip, ok := netip.AddrFromSlice(peer.PublicIP1)
|
||||
if !ok {
|
||||
hp.logf("Invalid public IP for peer %d", peer.PeerIP)
|
||||
return
|
||||
}
|
||||
endpoint := netip.AddrPortFrom(ip.Unmap(), peer.Port1)
|
||||
|
||||
if peer.Relay {
|
||||
if err := applyBaseConfig(hp.WGClient, hp.WGDevName, pubKey, endpoint, hp.Network); err != nil {
|
||||
hp.logf("Failed to update relay config: %v", err)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
if hp.holePunch != nil {
|
||||
hp.holePunch.OnEndpointLearned(peer.PeerIP, pubKey, endpoint, true)
|
||||
}
|
||||
}
|
||||
191
peer/init.go
191
peer/init.go
@@ -1,191 +0,0 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"crypto/rand"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/netip"
|
||||
"os"
|
||||
"time"
|
||||
|
||||
"golang.org/x/crypto/nacl/sign"
|
||||
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||
|
||||
"vppn/m"
|
||||
)
|
||||
|
||||
// LocalState is the persisted identity for this peer, written on first run and
|
||||
// loaded on every subsequent run.
|
||||
type LocalState struct {
|
||||
PrivKey wgtypes.Key
|
||||
SignKey [64]byte // nacl/sign Ed25519 private key
|
||||
VPNIP netip.Addr
|
||||
VPNNet netip.Prefix
|
||||
WGPort uint16
|
||||
IsRelay bool
|
||||
IsPublic bool
|
||||
LocalDomain string
|
||||
}
|
||||
|
||||
// localStateJSON is the on-disk representation.
|
||||
type localStateJSON struct {
|
||||
PrivKey string
|
||||
SignKey string
|
||||
VPNIP netip.Addr
|
||||
VPNNet netip.Prefix
|
||||
WGPort uint16
|
||||
IsRelay bool
|
||||
IsPublic bool
|
||||
LocalDomain string
|
||||
}
|
||||
|
||||
// LoadOrInit loads LocalState from path, or registers with the hub and creates
|
||||
// the file if it doesn't exist.
|
||||
func LoadOrInit(statePath, hubURL, apiKey string) (LocalState, error) {
|
||||
var state LocalState
|
||||
switch err := loadJSON(statePath, &state); {
|
||||
case err == nil:
|
||||
return state, nil
|
||||
case !os.IsNotExist(err):
|
||||
// File exists but is unreadable/corrupt: surface it rather than
|
||||
// silently regenerating a new identity and re-registering.
|
||||
return LocalState{}, fmt.Errorf("load state: %w", err)
|
||||
}
|
||||
|
||||
privKey, err := wgtypes.GeneratePrivateKey()
|
||||
if err != nil {
|
||||
return LocalState{}, fmt.Errorf("generate key: %w", err)
|
||||
}
|
||||
|
||||
state, err = initFromHub(hubURL, apiKey, privKey)
|
||||
if err != nil {
|
||||
return LocalState{}, err
|
||||
}
|
||||
|
||||
if err := storeJSON(statePath, state); err != nil {
|
||||
return LocalState{}, fmt.Errorf("save state: %w", err)
|
||||
}
|
||||
return state, nil
|
||||
}
|
||||
|
||||
func initFromHub(hubURL, apiKey string, privKey wgtypes.Key) (LocalState, error) {
|
||||
wgPubKey := privKey.PublicKey()
|
||||
|
||||
signPubKey, signPrivKey, err := sign.GenerateKey(rand.Reader)
|
||||
if err != nil {
|
||||
return LocalState{}, fmt.Errorf("generate sign key: %w", err)
|
||||
}
|
||||
|
||||
body, err := json.Marshal(m.PeerInitArgs{
|
||||
WGPubKey: wgPubKey[:],
|
||||
SignPubKey: signPubKey[:],
|
||||
})
|
||||
if err != nil {
|
||||
return LocalState{}, fmt.Errorf("json error: %w", err)
|
||||
}
|
||||
|
||||
req, err := http.NewRequest(http.MethodPost, hubURL+"/peer/init/", bytes.NewReader(body))
|
||||
if err != nil {
|
||||
return LocalState{}, err
|
||||
}
|
||||
req.SetBasicAuth("", apiKey)
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
|
||||
resp, err := (&http.Client{Timeout: time.Minute}).Do(req)
|
||||
if err != nil {
|
||||
return LocalState{}, fmt.Errorf("hub init: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return LocalState{}, fmt.Errorf("hub init: HTTP %d", resp.StatusCode)
|
||||
}
|
||||
|
||||
var r m.PeerInitResp
|
||||
if err := json.NewDecoder(resp.Body).Decode(&r); err != nil {
|
||||
return LocalState{}, fmt.Errorf("hub init decode: %w", err)
|
||||
}
|
||||
|
||||
if len(r.Network) != 4 {
|
||||
return LocalState{}, fmt.Errorf("hub init: invalid network %v", r.Network)
|
||||
}
|
||||
|
||||
netAddr := netip.AddrFrom4([4]byte(r.Network))
|
||||
octets := netAddr.As4()
|
||||
octets[3] = r.PeerIP
|
||||
vpnIP := netip.AddrFrom4(octets)
|
||||
vpnNet := netip.PrefixFrom(netAddr, 24)
|
||||
|
||||
var self *m.Peer
|
||||
for i := range r.NetworkState.Peers {
|
||||
if r.NetworkState.Peers[i].PeerIP == r.PeerIP {
|
||||
self = &r.NetworkState.Peers[i]
|
||||
break
|
||||
}
|
||||
}
|
||||
if self == nil {
|
||||
return LocalState{}, fmt.Errorf("hub init: no peer for own IP: %d", r.PeerIP)
|
||||
}
|
||||
|
||||
public := self.IsPublic()
|
||||
|
||||
return LocalState{
|
||||
PrivKey: privKey,
|
||||
SignKey: *signPrivKey,
|
||||
VPNIP: vpnIP,
|
||||
VPNNet: vpnNet,
|
||||
WGPort: self.Port,
|
||||
IsRelay: self.Relay && public,
|
||||
IsPublic: public,
|
||||
LocalDomain: r.LocalDomain,
|
||||
}, nil
|
||||
}
|
||||
|
||||
func (s LocalState) MarshalJSON() ([]byte, error) {
|
||||
return json.Marshal(localStateJSON{
|
||||
PrivKey: base64.StdEncoding.EncodeToString(s.PrivKey[:]),
|
||||
SignKey: base64.StdEncoding.EncodeToString(s.SignKey[:]),
|
||||
VPNIP: s.VPNIP,
|
||||
VPNNet: s.VPNNet,
|
||||
WGPort: s.WGPort,
|
||||
IsRelay: s.IsRelay,
|
||||
IsPublic: s.IsPublic,
|
||||
LocalDomain: s.LocalDomain,
|
||||
})
|
||||
}
|
||||
|
||||
func (s *LocalState) UnmarshalJSON(data []byte) error {
|
||||
var j localStateJSON
|
||||
if err := json.Unmarshal(data, &j); err != nil {
|
||||
return err
|
||||
}
|
||||
keyBytes, err := base64.StdEncoding.DecodeString(j.PrivKey)
|
||||
if err != nil {
|
||||
return fmt.Errorf("decode key: %w", err)
|
||||
}
|
||||
key, err := wgtypes.NewKey(keyBytes)
|
||||
if err != nil {
|
||||
return fmt.Errorf("invalid key: %w", err)
|
||||
}
|
||||
signKeyBytes, err := base64.StdEncoding.DecodeString(j.SignKey)
|
||||
if err != nil {
|
||||
return fmt.Errorf("decode sign key: %w", err)
|
||||
}
|
||||
if len(signKeyBytes) != 64 {
|
||||
return fmt.Errorf("invalid sign key length: %d", len(signKeyBytes))
|
||||
}
|
||||
*s = LocalState{
|
||||
PrivKey: key,
|
||||
SignKey: [64]byte(signKeyBytes),
|
||||
VPNIP: j.VPNIP,
|
||||
VPNNet: j.VPNNet,
|
||||
WGPort: j.WGPort,
|
||||
IsRelay: j.IsRelay,
|
||||
IsPublic: j.IsPublic,
|
||||
LocalDomain: j.LocalDomain,
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -1,28 +0,0 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"net/netip"
|
||||
"vppn/peer/control"
|
||||
|
||||
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||
)
|
||||
|
||||
// WGDevice is the subset of wginterface.Device used by App.
|
||||
type WGDevice interface {
|
||||
Name() string
|
||||
Peers() ([]wgtypes.Peer, error)
|
||||
AddPeer(pubKey wgtypes.Key) error
|
||||
AddDirect(pubKey wgtypes.Key, endpoint netip.AddrPort, vpnIP netip.Addr) error
|
||||
SetRelay(pubKey wgtypes.Key, endpoint netip.AddrPort, network netip.Prefix) error
|
||||
AddProbe(pubKey wgtypes.Key, endpoint netip.AddrPort) error
|
||||
Promote(pubKey wgtypes.Key, vpnIP netip.Addr) error
|
||||
RemovePeer(pubKey wgtypes.Key) error
|
||||
}
|
||||
|
||||
// ControlConn sends pings to peers over the VPN control port.
|
||||
// Reading is handled separately via run, which feeds the App's pingCh.
|
||||
// buf is a caller-provided scratch buffer (at least control.Size bytes) used to
|
||||
// marshal the ping; the caller reuses one across sends.
|
||||
type ControlConn interface {
|
||||
SendPing(dst netip.AddrPort, ping control.Ping, buf []byte) error
|
||||
}
|
||||
36
peer/json.go
36
peer/json.go
@@ -1,36 +0,0 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"os"
|
||||
"path/filepath"
|
||||
)
|
||||
|
||||
func loadJSON(path string, target any) error {
|
||||
data, err := os.ReadFile(path)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return json.Unmarshal(data, target)
|
||||
}
|
||||
|
||||
func storeJSON(path string, obj any) error {
|
||||
if err := os.MkdirAll(filepath.Dir(path), 0700); err != nil {
|
||||
return err
|
||||
}
|
||||
data, err := json.MarshalIndent(obj, "", " ")
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
tmpPath := path + ".tmp"
|
||||
if err := os.WriteFile(tmpPath, data, 0600); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if err := os.Rename(tmpPath, path); err != nil {
|
||||
os.Remove(tmpPath)
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
209
peer/main.go
Normal file
209
peer/main.go
Normal file
@@ -0,0 +1,209 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"log"
|
||||
"net"
|
||||
"net/http"
|
||||
"net/netip"
|
||||
"os"
|
||||
"time"
|
||||
)
|
||||
|
||||
// Usage:
|
||||
//
|
||||
// vppn netName run
|
||||
// vppn netName status
|
||||
func Main2() {
|
||||
printUsage := func() {
|
||||
fmt.Fprintf(os.Stderr, `%s COMMAND [ARGUMENTS...]
|
||||
|
||||
Available commands:
|
||||
run
|
||||
status
|
||||
hosts
|
||||
`, os.Args[0])
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
if len(os.Args) < 2 {
|
||||
printUsage()
|
||||
}
|
||||
|
||||
command := os.Args[1]
|
||||
|
||||
switch command {
|
||||
case "run":
|
||||
main_run()
|
||||
case "status":
|
||||
main_status()
|
||||
case "hosts":
|
||||
main_hosts()
|
||||
default:
|
||||
printUsage()
|
||||
}
|
||||
}
|
||||
|
||||
// ----------------------------------------------------------------------------
|
||||
|
||||
type mainArgs struct {
|
||||
NetName string
|
||||
HubAddress string
|
||||
APIKey string
|
||||
}
|
||||
|
||||
func main_run() {
|
||||
printUsage := func() {
|
||||
fmt.Fprintf(os.Stderr, `Usage: %s run NETWORK_NAME HUB_ADDRESS API_KEY
|
||||
|
||||
NETWORK_NAME
|
||||
Unique name of the network interface created. The network name
|
||||
shouldn't change between invocations of the application.
|
||||
|
||||
HUB_ADDRESS
|
||||
The address of the hub server. This should also contain the scheme, for
|
||||
example https://hub.domain.com/.
|
||||
|
||||
API_KEY
|
||||
The API key assigned to this peer by the hub.
|
||||
|
||||
`, os.Args[0])
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
if len(os.Args) != 5 {
|
||||
printUsage()
|
||||
}
|
||||
|
||||
args := mainArgs{
|
||||
NetName: os.Args[2],
|
||||
HubAddress: os.Args[3],
|
||||
APIKey: os.Args[4],
|
||||
}
|
||||
|
||||
newPeerMain(args).Run()
|
||||
}
|
||||
|
||||
// ----------------------------------------------------------------------------
|
||||
|
||||
func main_status() {
|
||||
printUsage := func() {
|
||||
fmt.Fprintf(os.Stderr, `Usage: %s status NETWORK_NAME
|
||||
|
||||
NETWORK_NAME
|
||||
Unique name of the network interface created.
|
||||
|
||||
`, os.Args[0])
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
if len(os.Args) != 3 {
|
||||
printUsage()
|
||||
}
|
||||
|
||||
netName := os.Args[2]
|
||||
report := fetchStatusReport(netName)
|
||||
|
||||
fmt.Printf("\n%s Status\n\n", netName)
|
||||
|
||||
if len(report.Network) != 4 {
|
||||
fmt.Println("ERROR: Network isn't 4 bytes.")
|
||||
fmt.Printf("Network: %v\n\n", report.Network)
|
||||
} else {
|
||||
nw := report.Network
|
||||
fmt.Printf("%-8s %d.%d.%d.%d\n", "IP", nw[0], nw[1], nw[2], report.LocalPeerIP)
|
||||
fmt.Printf("%-8s %d.%d.%d.%d/24\n", "Network", nw[0], nw[1], nw[2], nw[3])
|
||||
}
|
||||
|
||||
if report.RelayPeerIP != 0 {
|
||||
fmt.Printf("%-8s %d\n\n", "Relay", report.RelayPeerIP)
|
||||
} else {
|
||||
fmt.Printf("%-8s -\n\n", "Relay")
|
||||
}
|
||||
|
||||
for _, status := range report.Remotes {
|
||||
fmt.Printf("%3d %s\n", status.PeerIP, status.Name)
|
||||
fmt.Printf(" %-11s %v\n", "Up", status.Up)
|
||||
|
||||
pubIP, ok := netip.AddrFromSlice(status.PublicIP)
|
||||
if ok {
|
||||
fmt.Printf(" %-11s %v\n", "Public IP", pubIP)
|
||||
} else {
|
||||
fmt.Printf(" %-11s\n", "Public IP")
|
||||
}
|
||||
fmt.Printf(" %-11s %d\n", "Port", status.Port)
|
||||
fmt.Printf(" %-11s %v\n", "Relay", status.Relay)
|
||||
fmt.Printf(" %-11s %v\n", "Server", status.Server)
|
||||
fmt.Printf(" %-11s %v\n", "Direct", status.Direct)
|
||||
if status.DirectAddr.IsValid() {
|
||||
fmt.Printf(" %-11s %v\n", "Address", status.DirectAddr)
|
||||
}
|
||||
fmt.Println("")
|
||||
}
|
||||
}
|
||||
|
||||
// ----------------------------------------------------------------------------
|
||||
|
||||
func main_hosts() {
|
||||
printUsage := func() {
|
||||
fmt.Fprintf(os.Stderr, `Usage: %s hosts NETWORK_NAME
|
||||
|
||||
NETWORK_NAME
|
||||
Unique name of the network interface created.
|
||||
|
||||
`, os.Args[0])
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
if len(os.Args) != 3 {
|
||||
printUsage()
|
||||
}
|
||||
|
||||
netName := os.Args[2]
|
||||
state, err := loadNetworkState(netName)
|
||||
if err != nil {
|
||||
log.Fatalf("Failed to load network state: %v", err)
|
||||
}
|
||||
|
||||
config, err := loadPeerConfig(netName)
|
||||
if err != nil {
|
||||
log.Fatalf("Failed to load config: %v", err)
|
||||
}
|
||||
|
||||
nw := config.Network
|
||||
for _, peer := range state.Peers {
|
||||
if peer == nil {
|
||||
continue
|
||||
}
|
||||
fmt.Printf("%d.%d.%d.%d %s\n",
|
||||
nw[0], nw[1], nw[2], peer.PeerIP, peer.Name)
|
||||
}
|
||||
fmt.Println("")
|
||||
}
|
||||
|
||||
// ----------------------------------------------------------------------------
|
||||
|
||||
func fetchStatusReport(netName string) StatusReport {
|
||||
client := http.Client{
|
||||
Transport: &http.Transport{
|
||||
Dial: func(_, _ string) (net.Conn, error) {
|
||||
return net.Dial("unix", statusSocketPath(netName))
|
||||
},
|
||||
},
|
||||
Timeout: 8 * time.Second,
|
||||
}
|
||||
|
||||
getURL := "http://unix" + statusSocketPath(netName)
|
||||
resp, err := client.Get(getURL)
|
||||
if err != nil {
|
||||
log.Fatalf("Failed to get response: %v", err)
|
||||
}
|
||||
|
||||
report := StatusReport{}
|
||||
if err := json.NewDecoder(resp.Body).Decode(&report); err != nil {
|
||||
log.Fatalf("Failed to decode status report: %v", err)
|
||||
}
|
||||
|
||||
return report
|
||||
}
|
||||
66
peer/mcreader.go
Normal file
66
peer/mcreader.go
Normal file
@@ -0,0 +1,66 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"encoding/binary"
|
||||
"fmt"
|
||||
"log"
|
||||
"net"
|
||||
"net/netip"
|
||||
"time"
|
||||
|
||||
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||
)
|
||||
|
||||
func RunMCReader(g Globals, hp *HolePunch, netName string) {
|
||||
for {
|
||||
if err := runMCReaderInner(g, hp, netName); err != nil {
|
||||
log.Printf("[MCReader] %v", err)
|
||||
}
|
||||
time.Sleep(broadcastErrorTimeoutInterval)
|
||||
}
|
||||
}
|
||||
|
||||
func runMCReaderInner(g Globals, hp *HolePunch, netName string) error {
|
||||
conn, err := net.ListenMulticastUDP("udp", nil, multicastAddr)
|
||||
if err != nil {
|
||||
return fmt.Errorf("bind: %w", err)
|
||||
}
|
||||
defer conn.Close()
|
||||
|
||||
buf := make([]byte, 64)
|
||||
for {
|
||||
conn.SetReadDeadline(time.Now().Add(32 * time.Second))
|
||||
n, src, err := conn.ReadFromUDPAddrPort(buf)
|
||||
if err != nil {
|
||||
return fmt.Errorf("read: %w", err)
|
||||
}
|
||||
if n != beaconLen {
|
||||
continue
|
||||
}
|
||||
handleBeacon(g, hp, netName, buf[:n], src)
|
||||
}
|
||||
}
|
||||
|
||||
func handleBeacon(g Globals, hp *HolePunch, netName string, beacon []byte, src netip.AddrPort) {
|
||||
peerIPByte := beacon[0]
|
||||
if peerIPByte == g.LocalPeerIP {
|
||||
return
|
||||
}
|
||||
|
||||
pubKey, err := wgtypes.NewKey(beacon[1:33])
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
|
||||
// Skip relay peers: probing would replace their /24 AllowedIPs with empty.
|
||||
if state, err := loadNetworkState(netName); err == nil {
|
||||
if p := state.Peers[peerIPByte]; p != nil && p.Relay {
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
wgPort := binary.BigEndian.Uint16(beacon[33:35])
|
||||
endpoint := netip.AddrPortFrom(src.Addr().Unmap(), wgPort)
|
||||
|
||||
hp.OnEndpointLearned(peerIPByte, pubKey, endpoint, false)
|
||||
}
|
||||
43
peer/mcwriter.go
Normal file
43
peer/mcwriter.go
Normal file
@@ -0,0 +1,43 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"encoding/binary"
|
||||
"fmt"
|
||||
"log"
|
||||
"net"
|
||||
"time"
|
||||
)
|
||||
|
||||
const beaconLen = 35 // 1 VPN IP byte + 32 WG pubkey + 2 WG listen port
|
||||
|
||||
func RunMCWriter(g Globals) {
|
||||
conn, err := net.ListenMulticastUDP("udp", nil, multicastAddr)
|
||||
if err != nil {
|
||||
log.Fatalf("[MCWriter] bind: %v", err)
|
||||
}
|
||||
|
||||
for range time.Tick(broadcastInterval) {
|
||||
beacon, err := buildBeacon(g)
|
||||
if err != nil {
|
||||
log.Printf("[MCWriter] build beacon: %v", err)
|
||||
continue
|
||||
}
|
||||
log.Printf("[MCWriter] Broadcasting on %v...", multicastAddr)
|
||||
if _, err := conn.WriteToUDP(beacon, multicastAddr); err != nil {
|
||||
log.Printf("[MCWriter] write: %v", err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func buildBeacon(g Globals) ([]byte, error) {
|
||||
dev, err := g.WGClient.Device(g.WGDevName)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("get WG device: %w", err)
|
||||
}
|
||||
beacon := make([]byte, beaconLen)
|
||||
beacon[0] = g.LocalPeerIP
|
||||
pubKey := g.WGPrivKey.PublicKey()
|
||||
copy(beacon[1:33], pubKey[:])
|
||||
binary.BigEndian.PutUint16(beacon[33:35], uint16(dev.ListenPort))
|
||||
return beacon, nil
|
||||
}
|
||||
@@ -1,62 +0,0 @@
|
||||
package multicast
|
||||
|
||||
import (
|
||||
"log"
|
||||
"net"
|
||||
"net/netip"
|
||||
"time"
|
||||
|
||||
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||
)
|
||||
|
||||
func Broadcast(
|
||||
selfVPNIP netip.Addr,
|
||||
pubKey wgtypes.Key,
|
||||
wgPort uint16,
|
||||
signKey *[64]byte,
|
||||
) {
|
||||
for {
|
||||
broadcast(selfVPNIP, pubKey, wgPort, signKey)
|
||||
time.Sleep(errorTimeout)
|
||||
}
|
||||
}
|
||||
|
||||
func broadcast(selfVPNIP netip.Addr, pubKey wgtypes.Key, wgPort uint16, signKey *[64]byte) {
|
||||
addr := multicastAddr(selfVPNIP)
|
||||
|
||||
log.Printf("[MC Broadcast] Sending on %v.", addr)
|
||||
|
||||
conn, err := net.ListenMulticastUDP("udp", nil, addr)
|
||||
if err != nil {
|
||||
log.Printf("[MC Broadcast] bind: %v", err)
|
||||
return
|
||||
}
|
||||
defer conn.Close()
|
||||
|
||||
buf := make([]byte, BufferSize)
|
||||
packet := Packet{
|
||||
PeerIP: selfVPNIP.As4()[3],
|
||||
WGPubKey: pubKey,
|
||||
WGPort: wgPort,
|
||||
}
|
||||
|
||||
// Re-sign on each send so the timestamp is fresh; a stale timestamp would be
|
||||
// dropped by receivers' freshness gate.
|
||||
send := func() error {
|
||||
packet.Timestamp = time.Now().Unix()
|
||||
payload := packet.marshal(buf, signKey)
|
||||
_, err := conn.WriteToUDP(payload, addr)
|
||||
return err
|
||||
}
|
||||
|
||||
if err := send(); err != nil {
|
||||
log.Printf("[MC Broadcast] write: %v", err)
|
||||
}
|
||||
|
||||
for range time.Tick(broadcastInterval) {
|
||||
if err := send(); err != nil {
|
||||
log.Printf("[MC Broadcast] write: %v", err)
|
||||
return
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
package multicast
|
||||
|
||||
import "time"
|
||||
|
||||
const (
|
||||
errorTimeout = 16 * time.Second
|
||||
broadcastInterval = 16 * time.Second
|
||||
maxPacketAge = time.Minute
|
||||
)
|
||||
@@ -1,54 +0,0 @@
|
||||
package multicast
|
||||
|
||||
import (
|
||||
"encoding/binary"
|
||||
"net/netip"
|
||||
|
||||
"golang.org/x/crypto/nacl/sign"
|
||||
)
|
||||
|
||||
const (
|
||||
BufferSize = packetSize + SignedPacketSize
|
||||
SignedPacketSize = packetSize + signSize
|
||||
packetSize = 43
|
||||
signSize = 64
|
||||
)
|
||||
|
||||
// Layout:
|
||||
//
|
||||
// [0] final octet of the sender's VPN IP
|
||||
// [1:33] WG public key
|
||||
// [33:35] WG listen port (big-endian uint16)
|
||||
// [35:43] send time, Unix seconds (big-endian int64) — freshness/replay gate
|
||||
type Packet struct {
|
||||
PeerIP byte // Final octet of the sender's VPN IP.
|
||||
WGPubKey [32]byte // WG public key.
|
||||
WGPort uint16 // WG listen port.
|
||||
Timestamp int64 // Unix timestamp.
|
||||
Src netip.Addr // Source of packet.
|
||||
Signed []byte // Raw signed message for verification (incoming packet).
|
||||
}
|
||||
|
||||
// marshal the packet into a buffer with prefixed signature.
|
||||
func (p Packet) marshal(buf []byte, signKey *[64]byte) []byte {
|
||||
buf[0] = p.PeerIP
|
||||
copy(buf[1:33], p.WGPubKey[:])
|
||||
binary.BigEndian.PutUint16(buf[33:35], p.WGPort)
|
||||
binary.BigEndian.PutUint64(buf[35:43], uint64(p.Timestamp))
|
||||
return sign.Sign(buf[packetSize:packetSize], buf[:packetSize], signKey)
|
||||
}
|
||||
|
||||
func (p Packet) Verify(buf []byte, pubKey *[32]byte) bool {
|
||||
_, ok := sign.Open(buf, p.Signed, pubKey)
|
||||
return ok
|
||||
}
|
||||
|
||||
func unmarshal(signed []byte) (p Packet) {
|
||||
buf := signed[signSize:]
|
||||
p.PeerIP = buf[0]
|
||||
copy(p.WGPubKey[:], buf[1:33])
|
||||
p.WGPort = binary.BigEndian.Uint16(buf[33:35])
|
||||
p.Timestamp = int64(binary.BigEndian.Uint64(buf[35:43]))
|
||||
p.Signed = signed
|
||||
return
|
||||
}
|
||||
@@ -1,38 +0,0 @@
|
||||
package multicast
|
||||
|
||||
import (
|
||||
"crypto/rand"
|
||||
"testing"
|
||||
|
||||
"golang.org/x/crypto/nacl/sign"
|
||||
)
|
||||
|
||||
func TestPacket(t *testing.T) {
|
||||
pub, priv, err := sign.GenerateKey(rand.Reader)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
p := Packet{
|
||||
PeerIP: 10,
|
||||
WGPubKey: [32]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2},
|
||||
WGPort: 44,
|
||||
Timestamp: 12948893,
|
||||
}
|
||||
|
||||
buf := make([]byte, BufferSize)
|
||||
signed := p.marshal(buf, priv)
|
||||
if len(signed) != SignedPacketSize {
|
||||
t.Fatalf("signed length = %d, want %d", len(signed), SignedPacketSize)
|
||||
}
|
||||
|
||||
got := unmarshal(signed)
|
||||
if got.PeerIP != p.PeerIP || got.WGPubKey != p.WGPubKey ||
|
||||
got.WGPort != p.WGPort || got.Timestamp != p.Timestamp {
|
||||
t.Fatalf("round-trip mismatch:\n got %+v\nwant %+v", got, p)
|
||||
}
|
||||
|
||||
if !got.Verify(nil, pub) {
|
||||
t.Error("signature did not verify")
|
||||
}
|
||||
}
|
||||
@@ -1,92 +0,0 @@
|
||||
package multicast
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"fmt"
|
||||
"log"
|
||||
"net"
|
||||
"net/netip"
|
||||
"time"
|
||||
|
||||
"git.crumpington.com/lib/ratelimiter"
|
||||
)
|
||||
|
||||
func Receiver(selfVPNIP netip.Addr, ch chan<- Packet) {
|
||||
for {
|
||||
if err := receiver(selfVPNIP, ch); err != nil {
|
||||
log.Printf("[MC Receiver] %v", err)
|
||||
}
|
||||
time.Sleep(errorTimeout)
|
||||
}
|
||||
}
|
||||
|
||||
func receiver(selfVPNIP netip.Addr, ch chan<- Packet) error {
|
||||
limiters := map[netip.Addr]*ratelimiter.Limiter{}
|
||||
|
||||
selfIP := selfVPNIP.As4()[3]
|
||||
|
||||
addr := multicastAddr(selfVPNIP)
|
||||
|
||||
log.Printf("[MC Receiver] Listening on %v.", addr)
|
||||
conn, err := net.ListenMulticastUDP("udp", nil, addr)
|
||||
if err != nil {
|
||||
return fmt.Errorf("bind: %w", err)
|
||||
}
|
||||
defer conn.Close()
|
||||
|
||||
buf := make([]byte, SignedPacketSize+1) // +1 to detect oversized packets
|
||||
|
||||
for {
|
||||
conn.SetReadDeadline(time.Now().Add(32 * time.Second))
|
||||
n, src, err := conn.ReadFromUDPAddrPort(buf)
|
||||
if err != nil {
|
||||
if ne, ok := err.(net.Error); ok && ne.Timeout() {
|
||||
continue
|
||||
}
|
||||
return fmt.Errorf("read: %w", err)
|
||||
}
|
||||
|
||||
if n != SignedPacketSize {
|
||||
continue
|
||||
}
|
||||
|
||||
packet := unmarshal(buf[:n])
|
||||
|
||||
if packet.PeerIP == selfIP {
|
||||
continue
|
||||
}
|
||||
|
||||
// Slightly cheaper than limiting.
|
||||
age := time.Since(time.Unix(packet.Timestamp, 0))
|
||||
if age > maxPacketAge || age < -maxPacketAge {
|
||||
continue
|
||||
}
|
||||
|
||||
srcAddr := src.Addr().Unmap()
|
||||
lim, ok := limiters[srcAddr]
|
||||
if !ok {
|
||||
lim = ratelimiter.New(ratelimiter.Config{
|
||||
BurstLimit: 1,
|
||||
FillPeriod: broadcastInterval / 2,
|
||||
MaxWaitCount: 0,
|
||||
})
|
||||
limiters[srcAddr] = lim
|
||||
}
|
||||
|
||||
if err := lim.Limit(); err != nil {
|
||||
log.Printf("[MC Receiver] Rate limited packet from peer IP %d.", packet.PeerIP)
|
||||
continue
|
||||
}
|
||||
|
||||
packet.Signed = bytes.Clone(packet.Signed)
|
||||
packet.Src = src.Addr().Unmap()
|
||||
ch <- packet
|
||||
}
|
||||
}
|
||||
|
||||
func multicastAddr(vpnIP netip.Addr) *net.UDPAddr {
|
||||
b := vpnIP.As4()
|
||||
return net.UDPAddrFromAddrPort(
|
||||
netip.AddrPortFrom(
|
||||
netip.AddrFrom4([4]byte{239, b[0], b[1], b[2]}), 4560))
|
||||
}
|
||||
@@ -1,18 +0,0 @@
|
||||
package peer
|
||||
|
||||
import "vppn/m"
|
||||
|
||||
// loadNetworkState reads a cached network state from disk. Any error (most
|
||||
// commonly a missing file on first run) is returned to the caller, which
|
||||
// treats it as "no cache available".
|
||||
func loadNetworkState(path string) (m.NetworkState, error) {
|
||||
var state m.NetworkState
|
||||
err := loadJSON(path, &state)
|
||||
return state, err
|
||||
}
|
||||
|
||||
// saveNetworkState writes state to path atomically (see storeJSON), so a crash
|
||||
// mid-write cannot leave a corrupt cache.
|
||||
func saveNetworkState(path string, state m.NetworkState) error {
|
||||
return storeJSON(path, state)
|
||||
}
|
||||
@@ -1,56 +0,0 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"net/netip"
|
||||
"path/filepath"
|
||||
"reflect"
|
||||
"testing"
|
||||
|
||||
"vppn/m"
|
||||
)
|
||||
|
||||
func TestNetworkState_RoundTrip(t *testing.T) {
|
||||
path := filepath.Join(t.TempDir(), "network.json")
|
||||
|
||||
var sign1 [32]byte
|
||||
copy(sign1[:], []byte("0123456789abcdef0123456789abcdef"))
|
||||
|
||||
state := m.NetworkState{Peers: []m.Peer{
|
||||
{
|
||||
PeerIP: 1,
|
||||
Name: "hub",
|
||||
Addr4: netip.MustParseAddr("10.11.12.1"),
|
||||
Port: 51820,
|
||||
Relay: true,
|
||||
WGPubKey: mustKey(t),
|
||||
SignPubKey: sign1,
|
||||
},
|
||||
{
|
||||
PeerIP: 10,
|
||||
Name: "laptop",
|
||||
Addr4: netip.MustParseAddr("10.11.12.10"),
|
||||
Port: 51820,
|
||||
WGPubKey: mustKey(t),
|
||||
},
|
||||
}}
|
||||
|
||||
if err := saveNetworkState(path, state); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
got, err := loadNetworkState(path)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
if !reflect.DeepEqual(got, state) {
|
||||
t.Errorf("round-trip mismatch:\n got: %+v\nwant: %+v", got.Peers[1], state.Peers[1])
|
||||
}
|
||||
}
|
||||
|
||||
func TestNetworkState_LoadMissing(t *testing.T) {
|
||||
path := filepath.Join(t.TempDir(), "does-not-exist.json")
|
||||
if _, err := loadNetworkState(path); err == nil {
|
||||
t.Fatal("expected error loading missing cache, got nil")
|
||||
}
|
||||
}
|
||||
108
peer/new.go
108
peer/new.go
@@ -1,108 +0,0 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net/netip"
|
||||
|
||||
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||
|
||||
"vppn/m"
|
||||
"vppn/peer/multicast"
|
||||
"vppn/peer/wginterface"
|
||||
)
|
||||
|
||||
// New constructs an App, creates the WireGuard interface, and starts the
|
||||
// background goroutines (hub poller, multicast, control conn reader).
|
||||
// The caller should invoke Run() to start the event loop.
|
||||
func New(
|
||||
state LocalState,
|
||||
hubURL, apiKey string,
|
||||
ifaceName string,
|
||||
localDomain string,
|
||||
networkStatePath string,
|
||||
) (*App, error) {
|
||||
|
||||
a4 := state.VPNIP.As4()
|
||||
if err := wginterface.Create(ifaceName, a4[:], 24); err != nil {
|
||||
return nil, fmt.Errorf("create WG interface: %w", err)
|
||||
}
|
||||
|
||||
dev, err := wginterface.Open(ifaceName)
|
||||
if err != nil {
|
||||
_ = wginterface.Delete(ifaceName)
|
||||
return nil, fmt.Errorf("open WG device: %w", err)
|
||||
}
|
||||
|
||||
cc, err := newUDPControlConn(state.VPNIP, ControlPort)
|
||||
if err != nil {
|
||||
_ = dev.Close()
|
||||
_ = wginterface.Delete(ifaceName)
|
||||
return nil, fmt.Errorf("control conn: %w", err)
|
||||
}
|
||||
|
||||
cleanup := func() {
|
||||
_ = cc.Close()
|
||||
_ = dev.Close()
|
||||
_ = wginterface.Delete(ifaceName)
|
||||
}
|
||||
|
||||
if err := dev.Configure(state.PrivKey, int(state.WGPort)); err != nil {
|
||||
cleanup()
|
||||
return nil, fmt.Errorf("configure WG device: %w", err)
|
||||
}
|
||||
|
||||
if state.IsRelay {
|
||||
if err := dev.EnableForwarding(); err != nil {
|
||||
cleanup()
|
||||
return nil, fmt.Errorf("enable forwarding: %w", err)
|
||||
}
|
||||
}
|
||||
|
||||
pingCh := make(chan PingEvent)
|
||||
hubAddCh := make(chan m.Peer)
|
||||
hubRemoveCh := make(chan wgtypes.Key)
|
||||
multicastCh := make(chan multicast.Packet)
|
||||
|
||||
poller, err := NewHubPoller(
|
||||
state.VPNIP,
|
||||
state.VPNNet,
|
||||
hubURL,
|
||||
apiKey,
|
||||
networkStatePath,
|
||||
hubAddCh,
|
||||
hubRemoveCh)
|
||||
if err != nil {
|
||||
cleanup()
|
||||
return nil, fmt.Errorf("hub poller: %w", err)
|
||||
}
|
||||
|
||||
go cc.run(pingCh)
|
||||
go poller.Run()
|
||||
|
||||
if !state.IsPublic {
|
||||
go multicast.Broadcast(state.VPNIP, state.PrivKey.PublicKey(), state.WGPort, &state.SignKey)
|
||||
go multicast.Receiver(state.VPNIP, multicastCh)
|
||||
}
|
||||
|
||||
return &App{
|
||||
vpnIP: state.VPNIP,
|
||||
vpnNet: state.VPNNet,
|
||||
privKey: state.PrivKey,
|
||||
pubKey: state.PrivKey.PublicKey(),
|
||||
isPublic: state.IsPublic,
|
||||
localDomain: localDomain,
|
||||
|
||||
dev: dev,
|
||||
controlConn: cc,
|
||||
|
||||
peersByKey: make(map[wgtypes.Key]*Peer),
|
||||
peersByIP: make(map[netip.Addr]*Peer),
|
||||
|
||||
scratch: make([]byte, scratchSize),
|
||||
|
||||
hubAddCh: hubAddCh,
|
||||
hubRemoveCh: hubRemoveCh,
|
||||
pingCh: pingCh,
|
||||
multicastCh: multicastCh,
|
||||
}, nil
|
||||
}
|
||||
118
peer/on_hub.go
118
peer/on_hub.go
@@ -1,118 +0,0 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"log"
|
||||
"math"
|
||||
"net/netip"
|
||||
"time"
|
||||
|
||||
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||
|
||||
"vppn/m"
|
||||
"vppn/peer/control"
|
||||
)
|
||||
|
||||
func (a *App) onAddPeer(p m.Peer) {
|
||||
a.onRemovePeer(p.WGPubKey)
|
||||
|
||||
octets := a.vpnNet.Addr().As4()
|
||||
octets[3] = p.PeerIP
|
||||
vpnIP := netip.AddrFrom4(octets)
|
||||
|
||||
peer := &Peer{
|
||||
wgPeer: wgtypes.Peer{PublicKey: p.WGPubKey},
|
||||
VPNIP: vpnIP,
|
||||
Name: p.Name,
|
||||
IsRelay: p.Relay,
|
||||
IsPublic: p.IsPublic(),
|
||||
EndpointV4: p.Endpoint4(),
|
||||
EndpointV6: p.Endpoint6(),
|
||||
RTT: time.Duration(math.MaxInt64) * time.Nanosecond,
|
||||
Role: roleFor(a.isPublic, a.vpnIP, p.IsPublic(), vpnIP),
|
||||
SignPubKey: p.SignPubKey,
|
||||
}
|
||||
|
||||
a.peersByKey[p.WGPubKey] = peer
|
||||
a.peersByIP[peer.VPNIP] = peer
|
||||
defer a.updateHosts()
|
||||
|
||||
if !peer.IsPublic {
|
||||
if a.isPublic {
|
||||
// Public nodes accept traffic from non-public peers as soon as they
|
||||
// initiate a handshake. Set /32 AllowedIPs now; WireGuard learns the
|
||||
// endpoint from the incoming handshake automatically.
|
||||
a.devPromote(peer)
|
||||
} else {
|
||||
a.devAddRelayed(peer)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
a.devAddDirect(peer, peer.PreferredEndpoint())
|
||||
}
|
||||
|
||||
func (a *App) onRemovePeer(key wgtypes.Key) {
|
||||
peer, exists := a.peersByKey[key]
|
||||
if !exists {
|
||||
return
|
||||
}
|
||||
a.devRemove(peer)
|
||||
delete(a.peersByKey, key)
|
||||
delete(a.peersByIP, peer.VPNIP)
|
||||
a.updateHosts()
|
||||
|
||||
if peer == a.relay {
|
||||
a.relay = nil
|
||||
a.switchActiveRelay()
|
||||
}
|
||||
}
|
||||
|
||||
// switchActiveRelay selects the live relay with the lowest VPN IP as active.
|
||||
//
|
||||
// Choosing deterministically by IP (rather than by lowest RTT) makes every
|
||||
// non-public peer converge on the same relay, so two non-public peers always
|
||||
// share a relay and can reach each other. Failover walks up to the next-lowest
|
||||
// live relay; failback returns to a lower-IP relay once it recovers. The call
|
||||
// is idempotent: if the best relay is already active it does nothing, so it's
|
||||
// safe to run every state tick.
|
||||
func (a *App) switchActiveRelay() {
|
||||
var best *Peer
|
||||
for _, p := range a.peersByKey {
|
||||
if !p.CanRelay() {
|
||||
continue
|
||||
}
|
||||
|
||||
if best == nil || p.VPNIP.Less(best.VPNIP) {
|
||||
best = p
|
||||
}
|
||||
}
|
||||
|
||||
if best == a.relay {
|
||||
return // Already on the best relay (or none available and none before).
|
||||
}
|
||||
|
||||
if a.relay != nil {
|
||||
// The old relay is public, so it goes back to being a direct peer -
|
||||
// this converts its /24 back to a /32.
|
||||
a.devAddDirect(a.relay, a.relay.PreferredEndpoint())
|
||||
}
|
||||
|
||||
if best == nil {
|
||||
log.Printf("no relay available")
|
||||
a.relay = nil
|
||||
return
|
||||
}
|
||||
|
||||
a.devSetRelay(best, best.PreferredEndpoint())
|
||||
a.relay = best
|
||||
}
|
||||
|
||||
func roleFor(selfIsPublic bool, selfIP netip.Addr, peerIsPublic bool, peerVPNIP netip.Addr) control.Role {
|
||||
if !selfIsPublic && peerIsPublic {
|
||||
return control.Client
|
||||
}
|
||||
if selfIsPublic && !peerIsPublic {
|
||||
return control.Server
|
||||
}
|
||||
return control.RoleFor(selfIP, peerVPNIP)
|
||||
}
|
||||
@@ -1,299 +0,0 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"net/netip"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||
|
||||
"vppn/m"
|
||||
)
|
||||
|
||||
func mustKey(t *testing.T) wgtypes.Key {
|
||||
t.Helper()
|
||||
k, err := wgtypes.GeneratePrivateKey()
|
||||
if err != nil {
|
||||
t.Fatalf("generate key: %v", err)
|
||||
}
|
||||
return k.PublicKey()
|
||||
}
|
||||
|
||||
func TestOnAddPeer(t *testing.T) {
|
||||
ep1 := netip.MustParseAddrPort("1.2.3.4:51820")
|
||||
ep2 := netip.MustParseAddrPort("5.6.7.8:51820")
|
||||
peerVPNIP := netip.MustParseAddr("10.0.0.2")
|
||||
|
||||
testCases := []struct {
|
||||
name string
|
||||
setup func(a *App, key wgtypes.Key)
|
||||
peer func(key wgtypes.Key) m.Peer
|
||||
check func(t *testing.T, a *App, dev *fakeWGDevice, key wgtypes.Key)
|
||||
}{
|
||||
{
|
||||
name: "non-public peer registered in WG via AddPeer",
|
||||
peer: func(k wgtypes.Key) m.Peer {
|
||||
return m.Peer{WGPubKey: k, PeerIP: 2}
|
||||
},
|
||||
check: func(t *testing.T, a *App, dev *fakeWGDevice, key wgtypes.Key) {
|
||||
p := a.peersByKey[key]
|
||||
if p == nil {
|
||||
t.Fatal("not in peersByKey")
|
||||
}
|
||||
if a.peersByIP[peerVPNIP] == nil {
|
||||
t.Fatal("not in peersByIP")
|
||||
}
|
||||
if p.State != StateRelayed {
|
||||
t.Fatalf("state = %v, want StateRelayed", p.State)
|
||||
}
|
||||
dev.AssertAddPeer(t, 0, key)
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "public peer with endpoint registered via AddDirect",
|
||||
peer: func(k wgtypes.Key) m.Peer {
|
||||
return m.Peer{WGPubKey: k, PeerIP: 2, Addr4: ep1.Addr(), Port: ep1.Port()}
|
||||
},
|
||||
check: func(t *testing.T, a *App, dev *fakeWGDevice, key wgtypes.Key) {
|
||||
p := a.peersByKey[key]
|
||||
if p == nil {
|
||||
t.Fatal("not in peersByKey")
|
||||
}
|
||||
dev.AssertAddDirect(t, 0, p.PubKey(), ep1, p.VPNIP)
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "re-add removes old WG entry before adding new one",
|
||||
setup: func(a *App, key wgtypes.Key) {
|
||||
a.onAddPeer(m.Peer{WGPubKey: key, PeerIP: 2, Addr4: ep1.Addr(), Port: ep1.Port()})
|
||||
},
|
||||
peer: func(k wgtypes.Key) m.Peer {
|
||||
return m.Peer{WGPubKey: k, PeerIP: 2, Addr4: ep2.Addr(), Port: ep2.Port()}
|
||||
},
|
||||
check: func(t *testing.T, a *App, dev *fakeWGDevice, key wgtypes.Key) {
|
||||
if len(dev.Calls) != 2 {
|
||||
t.Fatalf("dev calls = %v, want [RemovePeer, AddDirect]", dev.Calls)
|
||||
}
|
||||
dev.AssertRemovePeer(t, 0, key)
|
||||
dev.AssertAddDirect(t, 1, key, ep2, peerVPNIP)
|
||||
if len(a.peersByKey) != 1 || len(a.peersByIP) != 1 {
|
||||
t.Errorf("maps: peersByKey=%d peersByIP=%d, want 1 each", len(a.peersByKey), len(a.peersByIP))
|
||||
}
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
for _, tc := range testCases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
a, dev, _ := newTestApp(t, "10.0.0.1", false)
|
||||
key := mustKey(t)
|
||||
if tc.setup != nil {
|
||||
tc.setup(a, key)
|
||||
dev.Calls = nil
|
||||
}
|
||||
a.onAddPeer(tc.peer(key))
|
||||
tc.check(t, a, dev, key)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestOnRemovePeer(t *testing.T) {
|
||||
ep1 := netip.MustParseAddrPort("1.2.3.4:51820")
|
||||
ep2 := netip.MustParseAddrPort("5.6.7.8:51820")
|
||||
|
||||
testCases := []struct {
|
||||
name string
|
||||
setup func(t *testing.T, a *App) wgtypes.Key // returns the key to remove
|
||||
check func(t *testing.T, a *App, dev *fakeWGDevice)
|
||||
}{
|
||||
{
|
||||
name: "unknown key is a no-op",
|
||||
setup: func(t *testing.T, a *App) wgtypes.Key {
|
||||
return mustKey(t)
|
||||
},
|
||||
check: func(t *testing.T, a *App, dev *fakeWGDevice) {
|
||||
dev.AssertNoCalls(t)
|
||||
if len(a.peersByKey) != 0 {
|
||||
t.Errorf("peersByKey should be empty")
|
||||
}
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "StateRelayed peer removed from maps with RemovePeer",
|
||||
setup: func(t *testing.T, a *App) wgtypes.Key {
|
||||
key := mustKey(t)
|
||||
a.onAddPeer(m.Peer{WGPubKey: key, PeerIP: 2})
|
||||
return key
|
||||
},
|
||||
check: func(t *testing.T, a *App, dev *fakeWGDevice) {
|
||||
if len(dev.Calls) != 1 {
|
||||
t.Fatalf("dev calls = %v, want [RemovePeer]", dev.Calls)
|
||||
}
|
||||
dev.AssertRemovePeer(t, 0, dev.Calls[0].PubKey)
|
||||
if len(a.peersByKey) != 0 || len(a.peersByIP) != 0 {
|
||||
t.Errorf("maps should be empty after remove")
|
||||
}
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "StateDirect peer removed from maps with RemovePeer",
|
||||
setup: func(t *testing.T, a *App) wgtypes.Key {
|
||||
key := mustKey(t)
|
||||
a.onAddPeer(m.Peer{WGPubKey: key, PeerIP: 2, Addr4: ep1.Addr(), Port: ep1.Port()})
|
||||
return key
|
||||
},
|
||||
check: func(t *testing.T, a *App, dev *fakeWGDevice) {
|
||||
if len(dev.Calls) != 1 {
|
||||
t.Fatalf("dev calls = %v, want [RemovePeer]", dev.Calls)
|
||||
}
|
||||
dev.AssertRemovePeer(t, 0, dev.Calls[0].PubKey)
|
||||
if len(a.peersByKey) != 0 || len(a.peersByIP) != 0 {
|
||||
t.Errorf("maps should be empty after remove")
|
||||
}
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "removing active relay with no backup clears relay field",
|
||||
setup: func(t *testing.T, a *App) wgtypes.Key {
|
||||
relay := addRelayPeer(t, a, "10.0.0.10", ep1)
|
||||
a.relay = relay
|
||||
return relay.PubKey()
|
||||
},
|
||||
check: func(t *testing.T, a *App, dev *fakeWGDevice) {
|
||||
if len(dev.Calls) != 1 {
|
||||
t.Fatalf("dev calls = %v, want [RemovePeer]", dev.Calls)
|
||||
}
|
||||
dev.AssertRemovePeer(t, 0, dev.Calls[0].PubKey)
|
||||
if a.relay != nil {
|
||||
t.Errorf("relay should be nil after removing only relay")
|
||||
}
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "removing active relay elects backup via SetRelay",
|
||||
setup: func(t *testing.T, a *App) wgtypes.Key {
|
||||
relay1 := addRelayPeer(t, a, "10.0.0.10", ep1)
|
||||
addRelayPeer(t, a, "10.0.0.11", ep2)
|
||||
a.relay = relay1
|
||||
return relay1.PubKey()
|
||||
},
|
||||
check: func(t *testing.T, a *App, dev *fakeWGDevice) {
|
||||
if len(dev.Calls) != 2 {
|
||||
t.Fatalf("dev calls = %v, want [RemovePeer, SetRelay]", dev.Calls)
|
||||
}
|
||||
dev.AssertRemovePeer(t, 0, dev.Calls[0].PubKey)
|
||||
dev.AssertSetRelay(t, 1, dev.Calls[1].PubKey, ep2, a.vpnNet)
|
||||
if a.relay == nil {
|
||||
t.Errorf("relay should be set to backup after failover")
|
||||
}
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
for _, tc := range testCases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
a, dev, _ := newTestApp(t, "10.0.0.1", false)
|
||||
key := tc.setup(t, a)
|
||||
dev.Calls = nil
|
||||
a.onRemovePeer(key)
|
||||
tc.check(t, a, dev)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestSwitchActiveRelay(t *testing.T) {
|
||||
ep1 := netip.MustParseAddrPort("1.2.3.4:51820")
|
||||
ep2 := netip.MustParseAddrPort("5.6.7.8:51820")
|
||||
|
||||
testCases := []struct {
|
||||
name string
|
||||
setup func(t *testing.T, a *App)
|
||||
check func(t *testing.T, a *App, dev *fakeWGDevice)
|
||||
}{
|
||||
{
|
||||
name: "no candidates leaves relay nil",
|
||||
setup: func(t *testing.T, a *App) {},
|
||||
check: func(t *testing.T, a *App, dev *fakeWGDevice) {
|
||||
dev.AssertNoCalls(t)
|
||||
if a.relay != nil {
|
||||
t.Error("relay should be nil")
|
||||
}
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "single candidate elected via SetRelay",
|
||||
setup: func(t *testing.T, a *App) {
|
||||
addRelayPeer(t, a, "10.0.0.10", ep1)
|
||||
},
|
||||
check: func(t *testing.T, a *App, dev *fakeWGDevice) {
|
||||
if len(dev.Calls) != 1 {
|
||||
t.Fatalf("dev calls = %v, want [SetRelay]", dev.Calls)
|
||||
}
|
||||
dev.AssertSetRelay(t, 0, dev.Calls[0].PubKey, ep1, a.vpnNet)
|
||||
if a.relay == nil {
|
||||
t.Error("relay should be set")
|
||||
}
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "measured RTT beats zero RTT",
|
||||
setup: func(t *testing.T, a *App) {
|
||||
r1 := addRelayPeer(t, a, "10.0.0.10", ep1)
|
||||
r1.RTT = 10 * time.Millisecond
|
||||
addRelayPeer(t, a, "10.0.0.11", ep2) // RTT stays MaxInt64 (unmeaured)
|
||||
},
|
||||
check: func(t *testing.T, a *App, dev *fakeWGDevice) {
|
||||
if len(dev.Calls) != 1 {
|
||||
t.Fatalf("dev calls = %v, want [SetRelay]", dev.Calls)
|
||||
}
|
||||
dev.AssertSetRelay(t, 0, dev.Calls[0].PubKey, ep1, a.vpnNet)
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "lower RTT wins",
|
||||
setup: func(t *testing.T, a *App) {
|
||||
r1 := addRelayPeer(t, a, "10.0.0.10", ep1)
|
||||
r1.RTT = 5 * time.Millisecond
|
||||
r2 := addRelayPeer(t, a, "10.0.0.11", ep2)
|
||||
r2.RTT = 20 * time.Millisecond
|
||||
},
|
||||
check: func(t *testing.T, a *App, dev *fakeWGDevice) {
|
||||
if len(dev.Calls) != 1 {
|
||||
t.Fatalf("dev calls = %v, want [SetRelay]", dev.Calls)
|
||||
}
|
||||
dev.AssertSetRelay(t, 0, dev.Calls[0].PubKey, ep1, a.vpnNet)
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "stale relay demoted to direct before backup elected",
|
||||
setup: func(t *testing.T, a *App) {
|
||||
old := addRelayPeer(t, a, "10.0.0.10", ep1)
|
||||
old.LastPing = time.Time{} // stale — Up() checks LastPing; triggers switch — triggers switch from onTick
|
||||
a.relay = old
|
||||
addRelayPeer(t, a, "10.0.0.11", ep2)
|
||||
},
|
||||
check: func(t *testing.T, a *App, dev *fakeWGDevice) {
|
||||
if len(dev.Calls) != 2 {
|
||||
t.Fatalf("dev calls = %v, want [AddDirect, SetRelay]", dev.Calls)
|
||||
}
|
||||
if dev.Calls[0].Method != "AddDirect" || dev.Calls[0].Endpoint != ep1 {
|
||||
t.Errorf("call[0]: got %v, want AddDirect with ep1", dev.Calls[0])
|
||||
}
|
||||
dev.AssertSetRelay(t, 1, dev.Calls[1].PubKey, ep2, a.vpnNet)
|
||||
if a.relay == nil || a.relay.EndpointV4 != ep2 {
|
||||
t.Error("relay should be the backup peer")
|
||||
}
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
for _, tc := range testCases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
a, dev, _ := newTestApp(t, "10.0.0.1", false)
|
||||
tc.setup(t, a)
|
||||
dev.Calls = nil
|
||||
a.switchActiveRelay()
|
||||
tc.check(t, a, dev)
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -1,40 +0,0 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"net/netip"
|
||||
|
||||
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||
|
||||
"vppn/peer/multicast"
|
||||
)
|
||||
|
||||
func (a *App) onMulticastDiscovery(pkt multicast.Packet) {
|
||||
// Locate the sender peer by its VPN IP (final octet carried in the beacon).
|
||||
octets := a.vpnNet.Addr().As4()
|
||||
octets[3] = pkt.PeerIP
|
||||
vpnIP := netip.AddrFrom4(octets)
|
||||
|
||||
peer, ok := a.peersByIP[vpnIP]
|
||||
if !ok || peer.IsPublic {
|
||||
return
|
||||
}
|
||||
|
||||
// Authenticate the beacon against the peer's known sign key. scratch[:0]
|
||||
// gives sign.Open an empty-but-capacity buffer to decode into.
|
||||
if !pkt.Verify(a.scratch[:0], &peer.SignPubKey) {
|
||||
return
|
||||
}
|
||||
|
||||
// The beacon is authentic but must also advertise the WG key the hub gave
|
||||
// us for this peer; otherwise it's inconsistent — drop it.
|
||||
if wgtypes.Key(pkt.WGPubKey) != peer.PubKey() {
|
||||
return
|
||||
}
|
||||
|
||||
endpoint := netip.AddrPortFrom(pkt.Src, pkt.WGPort)
|
||||
if !endpoint.IsValid() || endpoint.Port() == 0 {
|
||||
return
|
||||
}
|
||||
|
||||
peer.EndpointLAN = endpoint
|
||||
}
|
||||
@@ -1,71 +0,0 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"log"
|
||||
"net/netip"
|
||||
"time"
|
||||
|
||||
"vppn/peer/control"
|
||||
)
|
||||
|
||||
func (a *App) onPing(e PingEvent) {
|
||||
peer, ok := a.peersByIP[e.srcVPNIP]
|
||||
if !ok {
|
||||
// TODO: Log here.
|
||||
return
|
||||
}
|
||||
|
||||
now := time.Now()
|
||||
|
||||
peer.LastPing = now
|
||||
|
||||
// If we're the server, respond - this is always necessary as it's used to
|
||||
// know if peers are up or down.
|
||||
if peer.Role == control.Server {
|
||||
a.sendPing(peer, e.ping.PingTS)
|
||||
}
|
||||
|
||||
// Compute RTT from server echo.
|
||||
if peer.Role == control.Client {
|
||||
peer.RTT = now.Sub(time.Unix(0, e.ping.PingTS))
|
||||
}
|
||||
|
||||
// If we're public, nothing more to do.
|
||||
if a.isPublic {
|
||||
return
|
||||
}
|
||||
|
||||
// We can only learn our own endpoint from directly-connected peers — Dst is
|
||||
// the sender's observation of our WG handshake source.
|
||||
//
|
||||
// We make sure we don't set a private address as our public address since we
|
||||
// may be connected via LAN to some peers.
|
||||
if peer.State == StateDirect {
|
||||
if dst := e.ping.Dst; addrIsRoutable(dst) {
|
||||
if dst.Addr().Is4() {
|
||||
if dst != a.selfV4 {
|
||||
log.Printf("Local IPv4 updated: %s -> %s", a.selfV4, dst)
|
||||
a.selfV4 = dst
|
||||
}
|
||||
} else {
|
||||
if dst != a.selfV6 {
|
||||
log.Printf("Local IPv6 updated: %s -> %s", a.selfV6, dst)
|
||||
a.selfV6 = dst
|
||||
}
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
peer.UpdateEndpoints(e.ping.SrcV4, e.ping.SrcV6)
|
||||
}
|
||||
|
||||
var cgnatPrefix = netip.MustParsePrefix("100.64.0.0/10")
|
||||
|
||||
func addrIsRoutable(addrPort netip.AddrPort) bool {
|
||||
if addrPort.Port() == 0 {
|
||||
return false
|
||||
}
|
||||
addr := addrPort.Addr()
|
||||
return addr.IsGlobalUnicast() && !addr.IsPrivate() && !cgnatPrefix.Contains(addr)
|
||||
}
|
||||
@@ -1,15 +0,0 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"time"
|
||||
"vppn/peer/control"
|
||||
)
|
||||
|
||||
func (a *App) onPingTick() {
|
||||
now := time.Now().UnixNano()
|
||||
for _, p := range a.peersByIP {
|
||||
if p.Role == control.Client {
|
||||
a.sendPing(p, now)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,70 +0,0 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"log"
|
||||
"time"
|
||||
|
||||
"vppn/peer/wginterface"
|
||||
)
|
||||
|
||||
func (a *App) onStateTick() {
|
||||
wgPeers := a.devPeers()
|
||||
|
||||
for _, wgPeer := range wgPeers {
|
||||
p, ok := a.peersByKey[wgPeer.PublicKey]
|
||||
if !ok {
|
||||
log.Printf("Wireguard peer not known. Removing: %v", wgPeer.PublicKey)
|
||||
a.devRemove(&Peer{wgPeer: wgPeer})
|
||||
continue
|
||||
}
|
||||
|
||||
p.wgPeer = wgPeer
|
||||
|
||||
// Log endpoint changes.
|
||||
if ep := p.WGEndpoint(); ep != p.EndpointWG {
|
||||
log.Printf("Client %s %s endpoint: %s -> %s", p.Name, p.VPNIP, p.EndpointWG, ep)
|
||||
p.EndpointWG = ep
|
||||
}
|
||||
|
||||
switch p.State {
|
||||
case StateRelayed:
|
||||
if p.DirectAlive() {
|
||||
// We may already have a valid direct endpoint due to wireguard
|
||||
// roaming.
|
||||
a.devPromote(p)
|
||||
} else if ep := p.PreferredEndpoint(); ep.IsValid() {
|
||||
// If we have an ep to probe, add it.
|
||||
a.devAddProbe(p, ep)
|
||||
}
|
||||
|
||||
case StateProbing:
|
||||
if time.Since(p.LastHandshakeTime()) < 2*wginterface.ProbeKeepalive {
|
||||
// Promote probing peers to direct once alive (direct path confirmed
|
||||
// working).
|
||||
a.devPromote(p)
|
||||
} else if ep := p.PreferredEndpoint(); ep.IsValid() && ep != p.ProbeEndpoint {
|
||||
// Re-start probing if we see a new endpoint.
|
||||
a.devAddProbe(p, ep)
|
||||
} else if time.Since(p.ProbeStart) > 8*wginterface.ProbeKeepalive {
|
||||
// Give up probing if we haven't been able to handshake.
|
||||
a.devAddRelayed(p)
|
||||
}
|
||||
|
||||
case StateDirect:
|
||||
if p.IsPublic || a.isPublic || p.Up() {
|
||||
break
|
||||
}
|
||||
|
||||
// Stale non-public direct peer: demote to relayed and wait for new IP
|
||||
// information.
|
||||
a.devAddRelayed(p)
|
||||
}
|
||||
}
|
||||
|
||||
// Keep the active relay pinned to the lowest-IP live relay (if we're not
|
||||
// public). switchActiveRelay is idempotent and handles failover when the
|
||||
// current relay dies as well as failback when a lower-IP relay recovers.
|
||||
if !a.isPublic {
|
||||
a.switchActiveRelay()
|
||||
}
|
||||
}
|
||||
220
peer/peer.go
Normal file
220
peer/peer.go
Normal file
@@ -0,0 +1,220 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"io"
|
||||
"log"
|
||||
"net/http"
|
||||
"net/netip"
|
||||
"net/url"
|
||||
"os"
|
||||
"vppn/m"
|
||||
|
||||
"git.crumpington.com/lib/go/flock"
|
||||
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||
)
|
||||
|
||||
type peerMain struct {
|
||||
Globals
|
||||
netName string
|
||||
holePunch *HolePunch
|
||||
controlServer *ControlServer
|
||||
endpointReporter *EndpointReporter // non-nil on relay peers only
|
||||
hubPoller *HubPoller
|
||||
lockFile *os.File
|
||||
}
|
||||
|
||||
func newPeerMain(args mainArgs) *peerMain {
|
||||
logf := func(s string, args ...any) {
|
||||
log.Printf("[Main] "+s, args...)
|
||||
}
|
||||
|
||||
if err := os.MkdirAll(configDir(args.NetName), 0700); err != nil {
|
||||
log.Fatalf("Failed to create config directory: %v", err)
|
||||
}
|
||||
|
||||
lockFile, err := flock.TryLock(lockFilePath(args.NetName))
|
||||
if err != nil {
|
||||
log.Fatalf("Failed to open lock file: %v", err)
|
||||
}
|
||||
if lockFile == nil {
|
||||
log.Fatalf("Failed to obtain file lock.")
|
||||
}
|
||||
|
||||
config, err := loadPeerConfig(args.NetName)
|
||||
if err != nil {
|
||||
logf("Failed to load configuration: %v", err)
|
||||
logf("Initializing...")
|
||||
initPeerWithHub(args)
|
||||
|
||||
config, err = loadPeerConfig(args.NetName)
|
||||
if err != nil {
|
||||
log.Fatalf("Failed to load configuration: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
state, err := loadNetworkState(args.NetName)
|
||||
if err != nil {
|
||||
log.Fatalf("Failed to load network state: %v", err)
|
||||
}
|
||||
|
||||
wgPrivKey, err := wgtypes.ParseKey(config.WGPrivKey)
|
||||
if err != nil {
|
||||
log.Fatalf("Failed to parse WireGuard private key: %v", err)
|
||||
}
|
||||
|
||||
localPeer := state.Peers[config.LocalPeerIP]
|
||||
var listenPort int
|
||||
if localPeer != nil {
|
||||
listenPort = int(localPeer.Port1)
|
||||
}
|
||||
|
||||
vpnIP := netip.AddrFrom4([4]byte{
|
||||
config.Network[0],
|
||||
config.Network[1],
|
||||
config.Network[2],
|
||||
config.LocalPeerIP,
|
||||
})
|
||||
|
||||
wgClient, err := createWGDevice(args.NetName, wgPrivKey, listenPort, vpnIP, config.Network)
|
||||
if err != nil {
|
||||
log.Fatalf("Failed to create WireGuard device: %v", err)
|
||||
}
|
||||
|
||||
for _, p := range state.Peers {
|
||||
if p == nil || !p.Relay || p.PeerIP == config.LocalPeerIP {
|
||||
continue
|
||||
}
|
||||
if len(p.WGPubKey) != wgtypes.KeyLen || len(p.PublicIP1) == 0 || p.Port1 == 0 {
|
||||
continue
|
||||
}
|
||||
relayPubKey, err := wgtypes.NewKey(p.WGPubKey)
|
||||
if err != nil {
|
||||
logf("Invalid relay WG key: %v", err)
|
||||
continue
|
||||
}
|
||||
relayIP, ok := netip.AddrFromSlice(p.PublicIP1)
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
relayEndpoint := netip.AddrPortFrom(relayIP.Unmap(), p.Port1)
|
||||
if err := applyBaseConfig(wgClient, args.NetName, relayPubKey, relayEndpoint, config.Network); err != nil {
|
||||
logf("Failed to apply relay base config: %v", err)
|
||||
}
|
||||
break
|
||||
}
|
||||
|
||||
g := NewGlobals(config, netip.AddrPort{})
|
||||
g.WGPrivKey = wgPrivKey
|
||||
g.WGClient = wgClient
|
||||
g.WGDevName = args.NetName
|
||||
|
||||
holePunch := NewHolePunch(g)
|
||||
|
||||
controlServer, err := NewControlServer(g, holePunch, args.NetName)
|
||||
if err != nil {
|
||||
log.Fatalf("Failed to create control server: %v", err)
|
||||
}
|
||||
|
||||
var endpointReporter *EndpointReporter
|
||||
if localPeer != nil && localPeer.Relay {
|
||||
if err := enableForwarding(args.NetName); err != nil {
|
||||
log.Fatalf("Failed to enable IP forwarding: %v", err)
|
||||
}
|
||||
endpointReporter = NewEndpointReporter(g, controlServer, args.NetName)
|
||||
}
|
||||
|
||||
hubPoller, err := NewHubPoller(g, holePunch, args.NetName, args.HubAddress, args.APIKey)
|
||||
if err != nil {
|
||||
log.Fatalf("Failed to create hub poller: %v", err)
|
||||
}
|
||||
|
||||
go runStatusServer(g, statusSocketPath(args.NetName))
|
||||
|
||||
return &peerMain{
|
||||
Globals: g,
|
||||
netName: args.NetName,
|
||||
holePunch: holePunch,
|
||||
controlServer: controlServer,
|
||||
endpointReporter: endpointReporter,
|
||||
hubPoller: hubPoller,
|
||||
lockFile: lockFile,
|
||||
}
|
||||
}
|
||||
|
||||
func (p *peerMain) Run() {
|
||||
go p.controlServer.Run()
|
||||
if p.endpointReporter != nil {
|
||||
go p.endpointReporter.Run()
|
||||
}
|
||||
go RunMCWriter(p.Globals)
|
||||
go RunMCReader(p.Globals, p.holePunch, p.netName)
|
||||
go p.hubPoller.Run()
|
||||
select {}
|
||||
}
|
||||
|
||||
func initPeerWithHub(args mainArgs) {
|
||||
privKey := generateWGKey()
|
||||
pubKey := privKey.PublicKey()
|
||||
|
||||
initURL, err := url.Parse(args.HubAddress)
|
||||
if err != nil {
|
||||
log.Fatalf("Failed to parse hub URL: %v", err)
|
||||
}
|
||||
initURL.Path = "/peer/init/"
|
||||
|
||||
initArgs := m.PeerInitArgs{
|
||||
WGPubKey: pubKey[:],
|
||||
}
|
||||
|
||||
buf := &bytes.Buffer{}
|
||||
if err := json.NewEncoder(buf).Encode(initArgs); err != nil {
|
||||
log.Fatalf("Failed to encode init args: %v", err)
|
||||
}
|
||||
|
||||
req, err := http.NewRequest(http.MethodPost, initURL.String(), buf)
|
||||
if err != nil {
|
||||
log.Fatalf("Failed to construct request: %v", err)
|
||||
}
|
||||
req.SetBasicAuth("", args.APIKey)
|
||||
|
||||
resp, err := http.DefaultClient.Do(req)
|
||||
if err != nil {
|
||||
log.Fatalf("Failed to init with hub: %v", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
data, err := io.ReadAll(resp.Body)
|
||||
if err != nil {
|
||||
log.Fatalf("Failed to read response body: %v", err)
|
||||
}
|
||||
|
||||
if resp.StatusCode == http.StatusConflict {
|
||||
log.Fatalf("WireGuard key already registered (HTTP 409). Delete and re-create the peer to re-register.")
|
||||
}
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
log.Fatalf("Hub returned unexpected status %d: %s", resp.StatusCode, data)
|
||||
}
|
||||
|
||||
initResp := m.PeerInitResp{}
|
||||
if err := json.Unmarshal(data, &initResp); err != nil {
|
||||
log.Fatalf("Failed to parse configuration: %v\n%s", err, data)
|
||||
}
|
||||
|
||||
config := LocalConfig{
|
||||
LocalPeerIP: initResp.PeerIP,
|
||||
Network: initResp.Network,
|
||||
WGPrivKey: privKey.String(),
|
||||
}
|
||||
|
||||
if err := storeNetworkState(args.NetName, initResp.NetworkState); err != nil {
|
||||
log.Fatalf("Failed to store network state: %v", err)
|
||||
}
|
||||
|
||||
if err := storePeerConfig(args.NetName, config); err != nil {
|
||||
log.Fatalf("Failed to store configuration: %v", err)
|
||||
}
|
||||
|
||||
log.Print("Initialization successful.")
|
||||
}
|
||||
21
peer/ping.go
21
peer/ping.go
@@ -1,21 +0,0 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"log"
|
||||
"net/netip"
|
||||
|
||||
"vppn/peer/control"
|
||||
)
|
||||
|
||||
func (a *App) sendPing(p *Peer, ts int64) {
|
||||
ping := control.Ping{
|
||||
PingTS: ts,
|
||||
SrcV4: a.selfV4,
|
||||
SrcV6: a.selfV6,
|
||||
Dst: p.WGEndpoint(),
|
||||
}
|
||||
dst := netip.AddrPortFrom(p.VPNIP, ControlPort)
|
||||
if err := a.controlConn.SendPing(dst, ping, a.scratch); err != nil {
|
||||
log.Printf("sendPing %v: %v", p.VPNIP, err)
|
||||
}
|
||||
}
|
||||
@@ -1,91 +0,0 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"net/netip"
|
||||
"time"
|
||||
|
||||
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
||||
|
||||
"vppn/peer/control"
|
||||
"vppn/peer/wginterface"
|
||||
)
|
||||
|
||||
type PeerState string
|
||||
|
||||
const (
|
||||
StateRelayed = PeerState("RELAY ")
|
||||
StateProbing = PeerState("PROBE ")
|
||||
StateDirect = PeerState("DIRECT")
|
||||
)
|
||||
|
||||
type Peer struct {
|
||||
wgPeer wgtypes.Peer
|
||||
VPNIP netip.Addr // VPN IP address.
|
||||
Name string // Human-readable DNS label.
|
||||
IsRelay bool // Peer is a relay.
|
||||
IsPublic bool // Peer has a public IP.
|
||||
EndpointV4 netip.AddrPort // Reported IPv4 endpoint.
|
||||
EndpointV6 netip.AddrPort // Reported IPv6 endpoint.
|
||||
EndpointLAN netip.AddrPort // Discovered via multicast.
|
||||
EndpointWG netip.AddrPort // Current wireguard endpoint.
|
||||
RTT time.Duration // Round-trip time.
|
||||
LastPing time.Time // Last time we had a ping.
|
||||
ProbeStart time.Time // When we started probing.
|
||||
ProbeEndpoint netip.AddrPort
|
||||
State PeerState // Current routing state; updated on each devXxx call.
|
||||
Role control.Role // Role in relation to the local application.
|
||||
SignPubKey [32]byte // nacl/sign public key for verifying multicast beacons.
|
||||
}
|
||||
|
||||
// PubKey is the wireguard public key.
|
||||
func (p *Peer) PubKey() wgtypes.Key {
|
||||
return p.wgPeer.PublicKey
|
||||
}
|
||||
|
||||
func (p *Peer) WGEndpoint() netip.AddrPort {
|
||||
ep := p.wgPeer.Endpoint
|
||||
if ep == nil {
|
||||
return netip.AddrPort{}
|
||||
}
|
||||
addr, ok := netip.AddrFromSlice(ep.IP)
|
||||
if !ok {
|
||||
return netip.AddrPort{}
|
||||
}
|
||||
return netip.AddrPortFrom(addr.Unmap(), uint16(ep.Port))
|
||||
}
|
||||
|
||||
func (p *Peer) LastHandshakeTime() time.Time {
|
||||
return p.wgPeer.LastHandshakeTime
|
||||
}
|
||||
|
||||
func (p *Peer) Up() bool {
|
||||
return time.Since(p.LastPing) < 3*PingInterval
|
||||
}
|
||||
|
||||
func (p *Peer) DirectAlive() bool {
|
||||
return p.WGEndpoint().IsValid() &&
|
||||
time.Since(p.LastHandshakeTime()) < 2*wginterface.ProbeKeepalive
|
||||
}
|
||||
|
||||
func (p *Peer) CanRelay() bool {
|
||||
return p.IsRelay && p.Up()
|
||||
}
|
||||
|
||||
func (p *Peer) PreferredEndpoint() netip.AddrPort {
|
||||
if p.EndpointLAN.IsValid() {
|
||||
return p.EndpointLAN
|
||||
} else if p.EndpointV4.IsValid() {
|
||||
return p.EndpointV4
|
||||
} else {
|
||||
return p.EndpointV6
|
||||
}
|
||||
}
|
||||
|
||||
func (p *Peer) UpdateEndpoints(v4, v6 netip.AddrPort) {
|
||||
if v4.IsValid() {
|
||||
p.EndpointV4 = v4
|
||||
}
|
||||
if v6.IsValid() {
|
||||
p.EndpointV6 = v6
|
||||
}
|
||||
}
|
||||
50
peer/statusserver.go
Normal file
50
peer/statusserver.go
Normal file
@@ -0,0 +1,50 @@
|
||||
package peer
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"log"
|
||||
"net"
|
||||
"net/http"
|
||||
"net/netip"
|
||||
"os"
|
||||
)
|
||||
|
||||
type StatusReport struct {
|
||||
LocalPeerIP byte
|
||||
Network []byte
|
||||
RelayPeerIP byte
|
||||
Remotes []RemoteStatus
|
||||
}
|
||||
|
||||
type RemoteStatus struct {
|
||||
PeerIP byte
|
||||
Up bool
|
||||
Name string
|
||||
PublicIP []byte
|
||||
Port uint16
|
||||
Relay bool
|
||||
Server bool
|
||||
Direct bool
|
||||
DirectAddr netip.AddrPort
|
||||
}
|
||||
|
||||
func runStatusServer(g Globals, socketPath string) {
|
||||
_ = os.RemoveAll(socketPath)
|
||||
|
||||
handler := func(w http.ResponseWriter, r *http.Request) {
|
||||
report := StatusReport{
|
||||
LocalPeerIP: g.LocalPeerIP,
|
||||
Network: g.Network,
|
||||
}
|
||||
json.NewEncoder(w).Encode(report)
|
||||
}
|
||||
|
||||
server := http.Server{Handler: http.HandlerFunc(handler)}
|
||||
unixListener, err := net.Listen("unix", socketPath)
|
||||
if err != nil {
|
||||
log.Fatalf("Failed to bind to unix socket: %v", err)
|
||||
}
|
||||
if err := server.Serve(unixListener); err != nil {
|
||||
log.Fatalf("Failed to serve on unix socket: %v", err)
|
||||
}
|
||||
}
|
||||
@@ -11,7 +11,6 @@ package wginterface
|
||||
|
||||
import (
|
||||
"encoding/binary"
|
||||
"errors"
|
||||
"fmt"
|
||||
"net"
|
||||
"slices"
|
||||
@@ -22,7 +21,6 @@ import (
|
||||
// Create creates a WireGuard interface named name, assigns vpnIP/prefixLen to
|
||||
// it, and brings it up.
|
||||
func Create(name string, vpnIP net.IP, prefixLen int) error {
|
||||
_ = Delete(name) // remove any stale interface left by a previous run
|
||||
if err := nlNewLink(name); err != nil {
|
||||
return fmt.Errorf("failed to create wireguard link: %w", err)
|
||||
}
|
||||
@@ -174,10 +172,6 @@ func nlAttr(attrType uint16, data []byte) []byte {
|
||||
// messages, but the AF_INET ioctl interface is simpler.
|
||||
|
||||
func ioctlSetAddr(name string, ip net.IP, prefixLen int) error {
|
||||
if ip.To4() == nil {
|
||||
return errors.New("attempted to set non-IPv4 address on interface")
|
||||
}
|
||||
|
||||
fd, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, unix.IPPROTO_IP)
|
||||
if err != nil {
|
||||
return err
|
||||
|
||||
@@ -23,9 +23,10 @@ const (
|
||||
SessionTimeout = 180 * time.Second
|
||||
)
|
||||
|
||||
const ProbeKeepalive = 8 * time.Second
|
||||
|
||||
var zeroKeepalive = time.Duration(0)
|
||||
var (
|
||||
probeKeepalive = 5 * time.Second
|
||||
zeroKeepalive = time.Duration(0)
|
||||
)
|
||||
|
||||
// Device wraps a wgctrl client bound to a named WireGuard interface.
|
||||
type Device struct {
|
||||
@@ -47,11 +48,6 @@ func (d *Device) Close() error {
|
||||
return d.client.Close()
|
||||
}
|
||||
|
||||
// Name returns the interface name.
|
||||
func (d *Device) Name() string {
|
||||
return d.name
|
||||
}
|
||||
|
||||
// Configure sets the device's private key and UDP listen port.
|
||||
func (d *Device) Configure(privKey wgtypes.Key, listenPort int) error {
|
||||
return d.client.ConfigureDevice(d.name, wgtypes.Config{
|
||||
@@ -83,17 +79,6 @@ func (d *Device) Peer(pubKey wgtypes.Key) (wgtypes.Peer, error) {
|
||||
return wgtypes.Peer{}, fmt.Errorf("peer %v not found in %q", pubKey, d.name)
|
||||
}
|
||||
|
||||
// AddPeer registers a peer with no AllowedIPs and no endpoint. WireGuard will
|
||||
// accept handshakes from this peer but route no traffic to it yet.
|
||||
func (d *Device) AddPeer(pubKey wgtypes.Key) error {
|
||||
return d.client.ConfigureDevice(d.name, wgtypes.Config{
|
||||
Peers: []wgtypes.PeerConfig{{
|
||||
PublicKey: pubKey,
|
||||
ReplaceAllowedIPs: true,
|
||||
}},
|
||||
})
|
||||
}
|
||||
|
||||
// SetRelay configures the relay peer with AllowedIPs covering the entire VPN
|
||||
// network prefix. This is the fallback route for all VPN traffic.
|
||||
func (d *Device) SetRelay(pubKey wgtypes.Key, endpoint netip.AddrPort, network netip.Prefix) error {
|
||||
@@ -112,17 +97,16 @@ func (d *Device) SetRelay(pubKey wgtypes.Key, endpoint netip.AddrPort, network n
|
||||
})
|
||||
}
|
||||
|
||||
// AddProbe adds a peer with no AllowedIPs and an 8s keepalive. WireGuard will
|
||||
// AddProbe adds a peer with no AllowedIPs and a 5s keepalive. WireGuard will
|
||||
// attempt handshakes without routing any traffic through this peer yet.
|
||||
func (d *Device) AddProbe(pubKey wgtypes.Key, endpoint netip.AddrPort) error {
|
||||
keepalive := ProbeKeepalive
|
||||
return d.client.ConfigureDevice(d.name, wgtypes.Config{
|
||||
Peers: []wgtypes.PeerConfig{{
|
||||
PublicKey: pubKey,
|
||||
Endpoint: net.UDPAddrFromAddrPort(endpoint),
|
||||
AllowedIPs: []net.IPNet{},
|
||||
ReplaceAllowedIPs: true,
|
||||
PersistentKeepaliveInterval: &keepalive,
|
||||
PersistentKeepaliveInterval: &probeKeepalive,
|
||||
}},
|
||||
})
|
||||
}
|
||||
@@ -173,12 +157,9 @@ func (d *Device) RemovePeer(pubKey wgtypes.Key) error {
|
||||
})
|
||||
}
|
||||
|
||||
// EnableForwarding enables IPv4 forwarding globally and on the interface,
|
||||
// required for relay peers that forward traffic between VPN peers.
|
||||
// EnableForwarding enables IPv4 forwarding on the interface, required for
|
||||
// relay peers that forward traffic between VPN peers.
|
||||
func (d *Device) EnableForwarding() error {
|
||||
if err := os.WriteFile("/proc/sys/net/ipv4/ip_forward", []byte("1\n"), 0644); err != nil {
|
||||
return err
|
||||
}
|
||||
path := fmt.Sprintf("/proc/sys/net/ipv4/conf/%s/forwarding", d.name)
|
||||
return os.WriteFile(path, []byte("1\n"), 0644)
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user