105 lines
2.8 KiB
Go
105 lines
2.8 KiB
Go
package peer
|
|
|
|
import (
|
|
"encoding/binary"
|
|
"fmt"
|
|
"log"
|
|
"net"
|
|
"net/netip"
|
|
"time"
|
|
|
|
"golang.org/x/crypto/nacl/sign"
|
|
"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
|
|
)
|
|
|
|
const (
|
|
mcBeaconLen = 35 // 1 VPN IP byte + 32 WG pubkey + 2 WG listen port
|
|
mcSignedBeaconLen = sign.Overhead + mcBeaconLen // 64-byte nacl/sign prefix + payload
|
|
mcBroadcastInterval = 32 * time.Second
|
|
mcErrorRetryInterval = 16 * time.Second
|
|
)
|
|
|
|
var mcAddr = net.UDPAddrFromAddrPort(netip.AddrPortFrom(
|
|
netip.AddrFrom4([4]byte{224, 0, 0, 157}),
|
|
4560))
|
|
|
|
// RunMCWriter broadcasts a signed beacon on the local multicast group every
|
|
// mcBroadcastInterval so that LAN peers can discover our WireGuard endpoint.
|
|
func RunMCWriter(selfVPNIP netip.Addr, pubKey wgtypes.Key, wgPort uint16, signKey *[64]byte) {
|
|
conn, err := net.ListenMulticastUDP("udp", nil, mcAddr)
|
|
if err != nil {
|
|
log.Printf("[MCWriter] bind: %v", err)
|
|
return
|
|
}
|
|
|
|
payload := buildBeacon(selfVPNIP, pubKey, wgPort)
|
|
signed := sign.Sign(nil, payload, signKey)
|
|
|
|
if _, err := conn.WriteToUDP(signed, mcAddr); err != nil {
|
|
log.Printf("[MCWriter] write: %v", err)
|
|
}
|
|
for range time.Tick(mcBroadcastInterval) {
|
|
if _, err := conn.WriteToUDP(signed, mcAddr); err != nil {
|
|
log.Printf("[MCWriter] write: %v", err)
|
|
}
|
|
}
|
|
}
|
|
|
|
func buildBeacon(selfVPNIP netip.Addr, pubKey wgtypes.Key, wgPort uint16) []byte {
|
|
beacon := make([]byte, mcBeaconLen)
|
|
beacon[0] = selfVPNIP.As4()[3]
|
|
copy(beacon[1:33], pubKey[:])
|
|
binary.BigEndian.PutUint16(beacon[33:35], wgPort)
|
|
return beacon
|
|
}
|
|
|
|
// RunMCReader listens for multicast beacons from LAN peers and feeds
|
|
// MulticastEvents to ch.
|
|
func RunMCReader(vpnNet netip.Prefix, selfVPNIP netip.Addr, ch chan<- MulticastEvent) {
|
|
for {
|
|
if err := runMCReaderInner(vpnNet, selfVPNIP, ch); err != nil {
|
|
log.Printf("[MCReader] %v", err)
|
|
}
|
|
time.Sleep(mcErrorRetryInterval)
|
|
}
|
|
}
|
|
|
|
func runMCReaderInner(vpnNet netip.Prefix, selfVPNIP netip.Addr, ch chan<- MulticastEvent) error {
|
|
conn, err := net.ListenMulticastUDP("udp", nil, mcAddr)
|
|
if err != nil {
|
|
return fmt.Errorf("bind: %w", err)
|
|
}
|
|
defer conn.Close()
|
|
|
|
buf := make([]byte, mcSignedBeaconLen+1) // +1 to detect oversized packets
|
|
netAddr := vpnNet.Addr().As4()
|
|
|
|
for {
|
|
conn.SetReadDeadline(time.Now().Add(32 * time.Second))
|
|
n, src, err := conn.ReadFromUDPAddrPort(buf)
|
|
if err != nil {
|
|
return fmt.Errorf("read: %w", err)
|
|
}
|
|
if n != mcSignedBeaconLen {
|
|
continue
|
|
}
|
|
|
|
// Peek at VPN IP byte (first byte of payload after 64-byte sig prefix)
|
|
// to skip our own beacon before verifying.
|
|
octets := netAddr
|
|
octets[3] = buf[sign.Overhead]
|
|
vpnIP := netip.AddrFrom4(octets)
|
|
if vpnIP == selfVPNIP {
|
|
continue
|
|
}
|
|
|
|
signed := make([]byte, mcSignedBeaconLen)
|
|
copy(signed, buf[:mcSignedBeaconLen])
|
|
|
|
ch <- MulticastEvent{
|
|
signed: signed,
|
|
src: src.Addr().Unmap(),
|
|
}
|
|
}
|
|
}
|