[PATCH 1/2] peer: add wg_peer_reset_keys

[PATCH 1/2] peer: add wg_peer_reset_keys

[Derrick Pallas]

This function will clear the key state for the peer and reset its handshake
timer.  This is useful, for instance, if it is known that the current key
material is bad.  Currently, this happens when the private key is changed.

Signed-off-by: Derrick Pallas <derrick@pallas.us>
---
 src/peer.c | 14 ++++++++++++++
 src/peer.h |  1 +
 2 files changed, 15 insertions(+)

diff --git a/src/peer.c b/src/peer.c
index 020a97b..49af31f 100644
--- a/src/peer.c
+++ b/src/peer.c
@@ -87,6 +87,20 @@ struct wg_peer *wg_peer_get_maybe_zero(struct wg_peer *peer)
 	return peer;
 }
 
+void wg_peer_reset_keys(struct wg_peer *peer)
+{
+	if (unlikely(!peer))
+		return;
+	lockdep_assert_held(&peer->device->device_update_lock);
+
+	wg_noise_handshake_clear(&peer->handshake);
+	wg_noise_keypairs_clear(&peer->keypairs);
+	wg_cookie_checker_precompute_peer_keys(peer);
+	atomic64_set(&peer->last_sent_handshake,
+		ktime_get_boot_fast_ns() -
+			(u64)(REKEY_TIMEOUT + 1) * NSEC_PER_SEC);
+}
+
 /* We have a separate "remove" function make sure that all active places where
  * a peer is currently operating will eventually come to an end and not pass
  * their reference onto another context.
diff --git a/src/peer.h b/src/peer.h
index 2e04262..3800e6f 100644
--- a/src/peer.h
+++ b/src/peer.h
@@ -78,5 +78,6 @@ static inline struct wg_peer *wg_peer_get(struct wg_peer *peer)
 void wg_peer_put(struct wg_peer *peer);
 void wg_peer_remove(struct wg_peer *peer);
 void wg_peer_remove_all(struct wg_device *wg);
+void wg_peer_reset_keys(struct wg_peer *peer);
 
 #endif /* _WG_PEER_H */
-- 
2.19.2

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

[PATCH 2/2] netdev: reset peer keys when changing private key

[Derrick Pallas]

Without this change, it can take until the handshake timeout period to
reestablish with the peer.  After this change, the handshake occurs as soon
as possible and the link is reestablished much more quickly.

Signed-off-by: Derrick Pallas <derrick@pallas.us>
---
 src/netlink.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/netlink.c b/src/netlink.c
index 3458c81..f6b10ad 100644
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -539,6 +539,8 @@ static int wg_set_device(struct sk_buff *skb, struct genl_info *info)
 					 peer_list) {
 			if (!wg_noise_precompute_static_static(peer))
 				wg_peer_remove(peer);
+			else
+				wg_peer_reset_keys(peer);
 		}
 		wg_cookie_checker_precompute_device_keys(&wg->cookie_checker);
 		up_write(&wg->static_identity.lock);
-- 
2.19.2

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: [PATCH 2/2] netdev: reset peer keys when changing private key

[Jason A. Donenfeld]

Can you let me know if these work for you?

https://git.zx2c4.com/WireGuard/commit/?id=fffe613427d70a7470d34b6dedcab9ffb8b6b667
https://git.zx2c4.com/wireguard-go/commit/?id=a961aacc9f4dff9e617197c6433f8c9628928132
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: [PATCH 2/2] netdev: reset peer keys when changing private key

[Derrick Lyndon Pallas]

On 7/11/19 8:37 AM, Jason A. Donenfeld wrote:

> Can you let me know if these work for you?
>
> https://git.zx2c4.com/WireGuard/commit/?id=fffe613427d70a7470d34b6dedcab9ffb8b6b667
> https://git.zx2c4.com/wireguard-go/commit/?id=a961aacc9f4dff9e617197c6433f8c9628928132

I don't have a Go setup and so didn't test that patch but the kernel 
patch fixed the issue. Thanks, ~Derrick


_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Re: [PATCH 2/2] netdev: reset peer keys when changing private key

[Jason A. Donenfeld]

On Mon, Jul 15, 2019 at 7:17 PM Derrick Lyndon Pallas <derrick@pallas.us> wrote:
>
> On 7/11/19 8:37 AM, Jason A. Donenfeld wrote:
>
> > Can you let me know if these work for you?
> >
> > https://git.zx2c4.com/WireGuard/commit/?id=fffe613427d70a7470d34b6dedcab9ffb8b6b667
> > https://git.zx2c4.com/wireguard-go/commit/?id=a961aacc9f4dff9e617197c6433f8c9628928132
>
> I don't have a Go setup and so didn't test that patch but the kernel
> patch fixed the issue. Thanks, ~Derrick


Super, thanks.
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

[PATCH 2/2] netdev: reset peer keys when changing private key

[derrick]

From: Derrick Pallas <derrick@pallas.us>

Without this change, it can take until the handshake timeout period to
reestablish with the peer.  After this change, the handshake occurs as soon
as possible and the link is reestablished much more quickly.

Signed-off-by: Derrick Pallas <derrick@pallas.us>
---
 src/netlink.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/netlink.c b/src/netlink.c
index b179b31..43e1e05 100644
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -551,6 +551,8 @@ static int wg_set_device(struct sk_buff *skb, struct genl_info *info)
 					 peer_list) {
 			if (!wg_noise_precompute_static_static(peer))
 				wg_peer_remove(peer);
+			else
+				wg_peer_reset_keys(peer);
 		}
 		wg_cookie_checker_precompute_device_keys(&wg->cookie_checker);
 		up_write(&wg->static_identity.lock);
-- 
2.19.2

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard