rixxc/wireguard-rs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixed unit tests

Browse Source
This commit is contained in:
Mathias Hall-Andersen
2020-02-21 00:31:00 +01:00
parent db02609334
commit 8de2305cc7
9 changed files with 107 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/platform/linux/udp.rs
View File

@@ -216,11 +216,11 @@ impl LinuxUDPReader {
let mut control: ControlHeaderV6 = unsafe { mem::MaybeUninit::uninit().assume_init() };
let mut hdr = libc::msghdr {
msg_name: safe_cast(&mut src),
msg_namelen: mem::size_of::<libc::sockaddr_in6>() as u32,
msg_namelen: mem::size_of_val(&src) as u32,
msg_iov: iovs.as_mut_ptr(),
msg_iovlen: iovs.len(),
msg_control: safe_cast(&mut control),
msg_controllen: mem::size_of::<ControlHeaderV6>(),
msg_controllen: mem::size_of_val(&control),
msg_flags: 0,
};
@@ -270,11 +270,11 @@ impl LinuxUDPReader {
let mut control: ControlHeaderV4 = unsafe { mem::MaybeUninit::uninit().assume_init() };
let mut hdr = libc::msghdr {
msg_name: safe_cast(&mut src),
msg_namelen: mem::size_of::<libc::sockaddr_in>() as u32,
msg_namelen: mem::size_of_val(&src) as u32,
msg_iov: iovs.as_mut_ptr(),
msg_iovlen: iovs.len(),
msg_control: safe_cast(&mut control),
msg_controllen: mem::size_of::<ControlHeaderV4>(),
msg_controllen: mem::size_of_val(&control),
msg_flags: 0,
};
@@ -350,7 +350,7 @@ impl LinuxUDPWriter {
let mut hdr = libc::msghdr {
msg_name: safe_cast(&mut dst.dst),
msg_namelen: mem::size_of_val(&dst.dst).try_into().unwrap(),
msg_namelen: mem::size_of_val(&dst.dst) as u32,
msg_iov: iovs.as_mut_ptr(),
msg_iovlen: iovs.len(),
msg_control: safe_cast(&mut control),
@@ -415,7 +415,7 @@ impl LinuxUDPWriter {
let mut hdr = libc::msghdr {
msg_name: safe_cast(&mut dst.dst),
msg_namelen: mem::size_of_val(&dst.dst).try_into().unwrap(),
msg_namelen: mem::size_of_val(&dst.dst) as u32,
msg_iov: iovs.as_mut_ptr(),
msg_iovlen: iovs.len(),
msg_control: safe_cast(&mut control),

12
src/wireguard/router/device.rs
View File

@@ -121,14 +121,14 @@ impl<E: Endpoint, C: Callbacks, T: tun::Writer, B: udp::Writer<E>> DeviceHandle<
// start worker threads
let mut threads = Vec::with_capacity(num_workers);
while let Some(rx) = consumers.pop() {
println!("spawn");
threads.push(thread::spawn(move || {
println!("spawned");
worker(rx);
}));
threads.push(thread::spawn(move || worker(rx)));
}
debug_assert!(num_workers > 0, "zero worker threads");
debug_assert_eq!(threads.len(), num_workers);
debug_assert_eq!(
threads.len(),
num_workers,
"workers does not match consumers"
);
// return exported device handle
DeviceHandle {

1
src/wireguard/router/mod.rs
View File

@@ -24,7 +24,6 @@ use super::types::*;
pub const SIZE_TAG: usize = 16;
pub const SIZE_MESSAGE_PREFIX: usize = mem::size_of::<TransportHeader>();
pub const SIZE_KEEPALIVE: usize = mem::size_of::<TransportHeader>() + SIZE_TAG;
pub const CAPACITY_MESSAGE_POSTFIX: usize = SIZE_TAG;
pub const fn message_data_len(payload: usize) -> usize {

7
src/wireguard/router/receive.rs
View File

@@ -3,7 +3,7 @@ use super::ip::inner_length;
use super::messages::TransportHeader;
use super::queue::{ParallelJob, Queue, SequentialJob};
use super::types::Callbacks;
use super::{REJECT_AFTER_MESSAGES, SIZE_KEEPALIVE};
use super::{REJECT_AFTER_MESSAGES, SIZE_TAG};
use super::super::{tun, udp, Endpoint};
@@ -93,7 +93,6 @@ impl<E: Endpoint, C: Callbacks, T: tun::Writer, B: udp::Writer<E>> ParallelJob
debug_assert_eq!(nonce.len(), CHACHA20_POLY1305.nonce_len());
nonce[4..].copy_from_slice(header.f_counter.as_bytes());
let nonce = Nonce::assume_unique_for_key(nonce);
// do the weird ring AEAD dance
let key = LessSafeKey::new(
UnboundKey::new(&CHACHA20_POLY1305, &job.state.keypair.recv.key[..]).unwrap(),
@@ -111,7 +110,7 @@ impl<E: Endpoint, C: Callbacks, T: tun::Writer, B: udp::Writer<E>> ParallelJob
}
// check crypto-key router
packet.len() == SIZE_KEEPALIVE || peer.device.table.check_route(&peer, &packet)
packet.len() == SIZE_TAG || peer.device.table.check_route(&peer, &packet)
})();
// remove message in case of failure:
@@ -174,7 +173,7 @@ impl<E: Endpoint, C: Callbacks, T: tun::Writer, B: udp::Writer<E>> SequentialJob
// check if should be written to TUN
// (keep-alive and malformed packets will have no inner length)
if let Some(inner) = inner_length(packet) {
if inner >= packet.len() {
if inner + SIZE_TAG <= packet.len() {
let _ = peer.device.inbound.write(&packet[..inner]).map_err(|e| {
log::debug!("failed to write inbound packet to TUN: {:?}", e);
});

10
src/wireguard/router/send.rs
View File

@@ -91,19 +91,17 @@ impl<E: Endpoint, C: Callbacks, T: tun::Writer, B: udp::Writer<E>> ParallelJob
nonce[4..].copy_from_slice(header.f_counter.as_bytes());
let nonce = Nonce::assume_unique_for_key(nonce);
// do the weird ring AEAD dance
// encrypt contents of transport message in-place
let tag_offset = packet.len() - SIZE_TAG;
let key = LessSafeKey::new(
UnboundKey::new(&CHACHA20_POLY1305, &job.keypair.send.key[..]).unwrap(),
);
// encrypt contents of transport message in-place
let end = packet.len() - SIZE_TAG;
let tag = key
.seal_in_place_separate_tag(nonce, Aad::empty(), &mut packet[..end])
.seal_in_place_separate_tag(nonce, Aad::empty(), &mut packet[..tag_offset])
.unwrap();
// append tag
packet[end..].copy_from_slice(tag.as_ref());
packet[tag_offset..].copy_from_slice(tag.as_ref());
}
// mark ready

78
src/wireguard/router/tests.rs
View File

@@ -2,7 +2,7 @@ use super::KeyPair;
use super::SIZE_MESSAGE_PREFIX;
use super::{Callbacks, Device};
use super::SIZE_KEEPALIVE;
use super::message_data_len;
use super::super::dummy;
use super::super::dummy_keypair;
@@ -21,12 +21,13 @@ use std::time::Duration;
use env_logger;
use num_cpus;
use rand::Rng;
use test::Bencher;
extern crate test;
const SIZE_MSG: usize = 1024;
const SIZE_KEEPALIVE: usize = message_data_len(0);
const TIMEOUT: Duration = Duration::from_millis(1000);
struct EventTracker<E> {
@@ -133,10 +134,9 @@ fn init() {
let _ = env_logger::builder().is_test(true).try_init();
}
fn make_packet_padded(size: usize, src: IpAddr, dst: IpAddr, id: u64) -> Vec<u8> {
let p = make_packet(size, src, dst, id);
let mut o = vec![0; p.len() + SIZE_MESSAGE_PREFIX];
o[SIZE_MESSAGE_PREFIX..SIZE_MESSAGE_PREFIX + p.len()].copy_from_slice(&p[..]);
fn pad(msg: &[u8]) -> Vec<u8> {
let mut o = vec![0; msg.len() + SIZE_MESSAGE_PREFIX];
o[SIZE_MESSAGE_PREFIX..SIZE_MESSAGE_PREFIX + msg.len()].copy_from_slice(msg);
o
}
@@ -180,7 +180,7 @@ fn bench_outbound(b: &mut Bencher) {
IpAddr::V4(_) => "127.0.0.1".parse().unwrap(),
IpAddr::V6(_) => "::1".parse().unwrap(),
};
let msg = make_packet_padded(1024, src, dst, 0);
let msg = pad(&make_packet(1024, src, dst, 0));
// every iteration sends 10 GB
b.iter(|| {
@@ -266,10 +266,10 @@ fn test_outbound() {
IpAddr::V4(_) => "127.0.0.1".parse().unwrap(),
IpAddr::V6(_) => "::1".parse().unwrap(),
};
let msg = make_packet_padded(SIZE_MSG, src, dst, 0);
let msg = make_packet(SIZE_MSG, src, dst, 0);
// crypto-key route the IP packet
let res = router.send(msg);
let res = router.send(pad(&msg));
assert_eq!(
res.is_ok(),
okay,
@@ -303,7 +303,7 @@ fn test_outbound() {
if send_payload {
assert_eq!(
opaque.send.wait(TIMEOUT),
Some((SIZE_KEEPALIVE + SIZE_MSG, false)),
Some((SIZE_KEEPALIVE + msg.len(), false)),
"message buffer should be encrypted"
)
}
@@ -319,6 +319,8 @@ fn test_outbound() {
fn test_bidirectional() {
init();
const MAX_SIZE_BODY: usize = 1 << 15;
let tests = [
(
("192.168.1.0", 24, "192.168.1.20", true),
@@ -358,6 +360,8 @@ fn test_bidirectional() {
),
];
let mut rng = rand::thread_rng();
for (p1, p2) in tests.iter() {
for confirm_with_staged_packet in vec![true, false] {
println!(
@@ -368,11 +372,7 @@ fn test_bidirectional() {
let ((bind_reader1, bind_writer1), (bind_reader2, bind_writer2)) =
dummy::PairBind::pair();
let confirm_packet_size = if confirm_with_staged_packet {
SIZE_KEEPALIVE + SIZE_MSG
} else {
SIZE_KEEPALIVE
};
let mut confirm_packet_size = SIZE_KEEPALIVE;
// create matching device
let (_fake, _, tun_writer1, _) = dummy::TunTest::create(false);
@@ -412,15 +412,21 @@ fn test_bidirectional() {
// create IP packet
let (_mask, _len, ip1, _okay) = p1;
let (_mask, _len, ip2, _okay) = p2;
let msg = make_packet_padded(
let msg = make_packet(
SIZE_MSG,
ip1.parse().unwrap(), // src
ip2.parse().unwrap(), // dst
0,
);
// calculate size of encapsulated IP packet
confirm_packet_size = msg.len() + SIZE_KEEPALIVE;
// stage packet for sending
router2.send(msg).expect("failed to sent staged packet");
router2
.send(pad(&msg))
.expect("failed to sent staged packet");
// a new key should have been requested from the handshake machine
assert_eq!(
@@ -429,6 +435,7 @@ fn test_bidirectional() {
"a new key should be requested since a packet was attempted transmitted"
);
// no other events should fire
no_events!(opaque1);
no_events!(opaque2);
}
@@ -454,12 +461,7 @@ fn test_bidirectional() {
buf.truncate(len);
assert_eq!(
len,
if confirm_with_staged_packet {
SIZE_MSG + SIZE_KEEPALIVE
} else {
SIZE_KEEPALIVE
},
len, confirm_packet_size,
"unexpected size of confirmation message"
);
@@ -491,31 +493,39 @@ fn test_bidirectional() {
// no other events should fire
no_events!(opaque1);
no_events!(opaque2);
// now that peer1 has an endpoint
// route packets in the other direction: peer1 -> peer2
for id in 1..11 {
println!("packet: {}", id);
let message_size = 1024;
let mut sizes = vec![0, 1, 1500, MAX_SIZE_BODY];
for _ in 0..100 {
let body_size: usize = rng.gen();
let body_size = body_size % MAX_SIZE_BODY;
sizes.push(body_size);
}
for (id, body_size) in sizes.iter().enumerate() {
println!("packet: id = {}, body_size = {}", id, body_size);
// pass IP packet to router
let (_mask, _len, ip1, _okay) = p1;
let (_mask, _len, ip2, _okay) = p2;
let msg = make_packet_padded(
message_size,
let msg = make_packet(
*body_size,
ip2.parse().unwrap(), // src
ip1.parse().unwrap(), // dst
id,
id as u64,
);
// calculate encrypted size
let encrypted_size = msg.len() + SIZE_KEEPALIVE;
router1
.send(msg)
.send(pad(&msg))
.expect("we expect routing to be successful");
// encryption succeeds and the correct size is logged
assert_eq!(
opaque1.send.wait(TIMEOUT),
Some((message_size + SIZE_KEEPALIVE, true)),
Some((encrypted_size, true)),
"expected send event for peer1 -> peer2 payload"
);
@@ -524,7 +534,7 @@ fn test_bidirectional() {
no_events!(opaque2);
// receive ("across the internet") on the other end
let mut buf = vec![0u8; 2048];
let mut buf = vec![0u8; MAX_SIZE_BODY + 512];
let (len, from) = bind_reader2.read(&mut buf).unwrap();
buf.truncate(len);
router2.recv(from, buf).unwrap();
@@ -532,7 +542,7 @@ fn test_bidirectional() {
// check that decryption succeeds
assert_eq!(
opaque2.recv.wait(TIMEOUT),
Some((message_size + SIZE_KEEPALIVE, true)),
Some((msg.len() + SIZE_KEEPALIVE, true)),
"decryption and routing should succeed"
);

33
src/wireguard/tests.rs
View File

@@ -1,3 +1,7 @@
use super::dummy;
use super::wireguard::WireGuard;
use std::convert::TryInto;
use std::net::IpAddr;
use hex;
@@ -8,43 +12,43 @@ use x25519_dalek::{PublicKey, StaticSecret};
use pnet::packet::ipv4::MutableIpv4Packet;
use pnet::packet::ipv6::MutableIpv6Packet;
use super::dummy;
use super::wireguard::WireGuard;
pub fn make_packet(size: usize, src: IpAddr, dst: IpAddr, id: u64) -> Vec<u8> {
// expand pseudo random payload
let mut rng: _ = ChaCha8Rng::seed_from_u64(id);
let mut p: Vec<u8> = vec![0; size];
rng.fill_bytes(&mut p[..]);
rng.fill_bytes(&mut p);
// create "IP packet"
let mut msg = Vec::with_capacity(size);
msg.resize(size, 0);
match dst {
IpAddr::V4(dst) => {
let length = size - MutableIpv4Packet::minimum_packet_size();
let length = size + MutableIpv4Packet::minimum_packet_size();
msg.resize(length, 0);
let mut packet = MutableIpv4Packet::new(&mut msg[..]).unwrap();
packet.set_destination(dst);
packet.set_total_length(size as u16);
packet.set_total_length(length.try_into().expect("length too great for IPv4 packet"));
packet.set_source(if let IpAddr::V4(src) = src {
src
} else {
panic!("src.version != dst.version")
});
packet.set_payload(&p[..length]);
packet.set_payload(&p);
packet.set_version(4);
}
IpAddr::V6(dst) => {
let length = size - MutableIpv6Packet::minimum_packet_size();
let length = size + MutableIpv6Packet::minimum_packet_size();
msg.resize(length, 0);
let mut packet = MutableIpv6Packet::new(&mut msg[..]).unwrap();
packet.set_destination(dst);
packet.set_payload_length(length as u16);
packet.set_payload_length(size.try_into().expect("length too great for IPv6 packet"));
packet.set_source(if let IpAddr::V6(src) = src {
src
} else {
panic!("src.version != dst.version")
});
packet.set_payload(&p[..length]);
packet.set_payload(&p);
packet.set_version(6);
}
}
@@ -83,7 +87,7 @@ fn test_pure_wireguard() {
wg1.add_udp_reader(bind_reader1);
wg2.add_udp_reader(bind_reader2);
// generate (public, private) key pairs
// configure (public, private) key pairs
let sk1 = StaticSecret::from([
0x3f, 0x69, 0x86, 0xd1, 0xc0, 0xec, 0x25, 0xa0, 0x9c, 0x8e, 0x56, 0xb5, 0x1d, 0xb7, 0x3c,
@@ -107,7 +111,7 @@ fn test_pure_wireguard() {
wg1.set_key(Some(sk1));
wg2.set_key(Some(sk2));
// configure cryptkey router
// configure crypto-key router
let peer2 = wg1.lookup_peer(&pk2).unwrap();
let peer1 = wg2.lookup_peer(&pk1).unwrap();
@@ -143,10 +147,13 @@ fn test_pure_wireguard() {
let mut backup = packets.clone();
while let Some(p) = packets.pop() {
println!("send");
fake1.write(p);
}
while let Some(p) = backup.pop() {
println!("read");
assert_eq!(
hex::encode(fake2.read()),
hex::encode(p),