Mon Aug 31 20:20:22 2020 UTC ()
wg: Remove IFF_POINTOPOINT.

Unclear why this was set; setting it seems to have required a kludge
in netinet/in.c that broke ipsec tunnels.  Clearing it makes wg work
again after that kludge was reverted.


(riastradh)
diff -r1.5 -r1.6 src/share/man/man4/wg.4
diff -r1.32 -r1.33 src/sys/net/if_wg.c
cvs diff -r1.5 -r1.6 src/share/man/man4/wg.4 (expand / switch to unified diff)

--- src/share/man/man4/wg.4 2020/08/26 16:03:41 1.5
+++ src/share/man/man4/wg.4 2020/08/31 20:20:22 1.6
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1.\" $NetBSD: wg.4,v 1.5 2020/08/26 16:03:41 riastradh Exp $ 1.\" $NetBSD: wg.4,v 1.6 2020/08/31 20:20:22 riastradh Exp $
2.\" 2.\"
3.\" Copyright (c) 2020 The NetBSD Foundation, Inc. 3.\" Copyright (c) 2020 The NetBSD Foundation, Inc.
4.\" All rights reserved. 4.\" All rights reserved.
5.\" 5.\"
6.\" Redistribution and use in source and binary forms, with or without 6.\" Redistribution and use in source and binary forms, with or without
7.\" modification, are permitted provided that the following conditions 7.\" modification, are permitted provided that the following conditions
8.\" are met: 8.\" are met:
9.\" 1. Redistributions of source code must retain the above copyright 9.\" 1. Redistributions of source code must retain the above copyright
10.\" notice, this list of conditions and the following disclaimer. 10.\" notice, this list of conditions and the following disclaimer.
11.\" 2. Redistributions in binary form must reproduce the above copyright 11.\" 2. Redistributions in binary form must reproduce the above copyright
12.\" notice, this list of conditions and the following disclaimer in the 12.\" notice, this list of conditions and the following disclaimer in the
13.\" documentation and/or other materials provided with the distribution. 13.\" documentation and/or other materials provided with the distribution.
14.\" 14.\"
@@ -28,28 +28,28 @@ @@ -28,28 +28,28 @@
28.Dt WG 4 28.Dt WG 4
29.Os 29.Os
30.\""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" 30.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
31.Sh NAME 31.Sh NAME
32.Nm wg 32.Nm wg
33.Nd virtual private network tunnel (EXPERIMENTAL) 33.Nd virtual private network tunnel (EXPERIMENTAL)
34.\""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" 34.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
35.Sh SYNOPSIS 35.Sh SYNOPSIS
36.Cd pseudo-device wg 36.Cd pseudo-device wg
37.\""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" 37.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
38.Sh DESCRIPTION 38.Sh DESCRIPTION
39The 39The
40.Nm 40.Nm
41interface implements a point-to-point roaming-capable virtual private 41interface implements a roaming-capable virtual private network tunnel,
42network tunnel, configured with 42configured with
43.Xr ifconfig 8 43.Xr ifconfig 8
44and 44and
45.Xr wgconfig 8 . 45.Xr wgconfig 8 .
46.Pp 46.Pp
47.Sy WARNING: 47.Sy WARNING:
48.Nm 48.Nm
49is experimental. 49is experimental.
50.Pp 50.Pp
51Packets exchanged on a 51Packets exchanged on a
52.Nm 52.Nm
53interface are authenticated and encrypted with a secret key negotiated 53interface are authenticated and encrypted with a secret key negotiated
54with the peer, and the encapsulation is exchanged over IP or IPv6 using 54with the peer, and the encapsulation is exchanged over IP or IPv6 using
55UDP. 55UDP.
@@ -107,43 +107,45 @@ X7EGm3T3IfodBcyilkaC89j0SH3XD6+/pwvp7Dgp @@ -107,43 +107,45 @@ X7EGm3T3IfodBcyilkaC89j0SH3XD6+/pwvp7Dgp
107.Ed 107.Ed
108.Pp 108.Pp
109Configure A to listen on port 1234 and allow connections from B to 109Configure A to listen on port 1234 and allow connections from B to
110appear in the 10.0.1.0/24 subnet: 110appear in the 10.0.1.0/24 subnet:
111.Bd -literal -offset abcd 111.Bd -literal -offset abcd
112A# ifconfig wg0 create 10.0.1.0/24 112A# ifconfig wg0 create 10.0.1.0/24
113A# wgconfig wg0 set private-key /etc/wg/wg0 113A# wgconfig wg0 set private-key /etc/wg/wg0
114A# wgconfig wg0 set listen-port 1234 114A# wgconfig wg0 set listen-port 1234
115A# wgconfig wg0 add peer B \e 115A# wgconfig wg0 add peer B \e
116 X7EGm3T3IfodBcyilkaC89j0SH3XD6+/pwvp7Dgp5SU= \e 116 X7EGm3T3IfodBcyilkaC89j0SH3XD6+/pwvp7Dgp5SU= \e
117 --allowed-ips=10.0.1.1/32 117 --allowed-ips=10.0.1.1/32
118A# ifconfig wg0 up 118A# ifconfig wg0 up
119A# ifconfig wg0 119A# ifconfig wg0
120wg0: flags=0x51<UP,POINTOPOINT,RUNNING> mtu 1420 120wg0: flags=0x8041<UP,RUNNING,MULTICAST> mtu 1420
121 inet 10.0.1.0/24 -> flags 0 121 inet 10.0.1.0/24 flags 0
 122 inet6 fe80::22f7:d6ff:fe3a:1e60%wg0/64 flags 0 scopeid 0x3
122.Ed 123.Ed
123.Pp 124.Pp
124Configure B to connect to A at 1.2.3.4 on port 1234 and the packets can 125Configure B to connect to A at 1.2.3.4 on port 1234 and the packets can
125begin to flow: 126begin to flow:
126.Bd -literal -offset abcd 127.Bd -literal -offset abcd
127B# ifconfig wg0 create 10.0.1.1/24 128B# ifconfig wg0 create 10.0.1.1/24
128B# wgconfig wg0 set private-key /etc/wg/wg0 129B# wgconfig wg0 set private-key /etc/wg/wg0
129B# wgconfig wg0 add peer A \e 130B# wgconfig wg0 add peer A \e
130 N+B4Nelg+4ysvbLW3qenxIwrJVE9MdjMyqrIisH7V0Y= \e 131 N+B4Nelg+4ysvbLW3qenxIwrJVE9MdjMyqrIisH7V0Y= \e
131 --allowed-ips=10.0.1.0/32 \e 132 --allowed-ips=10.0.1.0/32 \e
132 --endpoint=1.2.3.4:1234 133 --endpoint=1.2.3.4:1234
133B# ifconfig wg0 up 134B# ifconfig wg0 up
134B# ifconfig wg0 135B# ifconfig wg0
135wg0: flags=0x51<UP,POINTOPOINT,RUNNING> mtu 1420 136wg0: flags=0x8041<UP,RUNNING,MULTICAST> mtu 1420
136 inet 10.0.1.1/24 -> flags 0 137 inet 10.0.1.1/24 flags 0
 138 inet6 fe80::56eb:59ff:fe3d:d413%wg0/64 flags 0 scopeid 0x3
137B# ping -n 10.0.1.0 139B# ping -n 10.0.1.0
138PING 10.0.1.0 (10.0.1.0): 56 data bytes 140PING 10.0.1.0 (10.0.1.0): 56 data bytes
13964 bytes from 10.0.1.0: icmp_seq=0 ttl=255 time=2.721110 ms 14164 bytes from 10.0.1.0: icmp_seq=0 ttl=255 time=2.721110 ms
140\&... 142\&...
141.Ed 143.Ed
142.\""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" 144.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
143.Sh SEE ALSO 145.Sh SEE ALSO
144.Xr wg-keygen 8 , 146.Xr wg-keygen 8 ,
145.Xr wgconfig 8 147.Xr wgconfig 8
146.\""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" 148.\"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
147.Sh COMPATIBILITY 149.Sh COMPATIBILITY
148The 150The
149.Nm 151.Nm
cvs diff -r1.32 -r1.33 src/sys/net/if_wg.c (expand / switch to unified diff)

--- src/sys/net/if_wg.c 2020/08/28 07:03:08 1.32
+++ src/sys/net/if_wg.c 2020/08/31 20:20:22 1.33
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1/* $NetBSD: if_wg.c,v 1.32 2020/08/28 07:03:08 riastradh Exp $ */ 1/* $NetBSD: if_wg.c,v 1.33 2020/08/31 20:20:22 riastradh Exp $ */
2 2
3/* 3/*
4 * Copyright (C) Ryota Ozaki <ozaki.ryota@gmail.com> 4 * Copyright (C) Ryota Ozaki <ozaki.ryota@gmail.com>
5 * All rights reserved. 5 * All rights reserved.
6 * 6 *
7 * Redistribution and use in source and binary forms, with or without 7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions 8 * modification, are permitted provided that the following conditions
9 * are met: 9 * are met:
10 * 1. Redistributions of source code must retain the above copyright 10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer. 11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright 12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the 13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution. 14 * documentation and/or other materials provided with the distribution.
@@ -31,27 +31,27 @@ @@ -31,27 +31,27 @@
31 31
32/* 32/*
33 * This network interface aims to implement the WireGuard protocol. 33 * This network interface aims to implement the WireGuard protocol.
34 * The implementation is based on the paper of WireGuard as of 34 * The implementation is based on the paper of WireGuard as of
35 * 2018-06-30 [1]. The paper is referred in the source code with label 35 * 2018-06-30 [1]. The paper is referred in the source code with label
36 * [W]. Also the specification of the Noise protocol framework as of 36 * [W]. Also the specification of the Noise protocol framework as of
37 * 2018-07-11 [2] is referred with label [N]. 37 * 2018-07-11 [2] is referred with label [N].
38 * 38 *
39 * [1] https://www.wireguard.com/papers/wireguard.pdf 39 * [1] https://www.wireguard.com/papers/wireguard.pdf
40 * [2] http://noiseprotocol.org/noise.pdf 40 * [2] http://noiseprotocol.org/noise.pdf
41 */ 41 */
42 42
43#include <sys/cdefs.h> 43#include <sys/cdefs.h>
44__KERNEL_RCSID(0, "$NetBSD: if_wg.c,v 1.32 2020/08/28 07:03:08 riastradh Exp $"); 44__KERNEL_RCSID(0, "$NetBSD: if_wg.c,v 1.33 2020/08/31 20:20:22 riastradh Exp $");
45 45
46#ifdef _KERNEL_OPT 46#ifdef _KERNEL_OPT
47#include "opt_inet.h" 47#include "opt_inet.h"
48#endif 48#endif
49 49
50#include <sys/param.h> 50#include <sys/param.h>
51#include <sys/types.h> 51#include <sys/types.h>
52 52
53#include <sys/atomic.h> 53#include <sys/atomic.h>
54#include <sys/callout.h> 54#include <sys/callout.h>
55#include <sys/cprng.h> 55#include <sys/cprng.h>
56#include <sys/cpu.h> 56#include <sys/cpu.h>
57#include <sys/device.h> 57#include <sys/device.h>
@@ -3372,27 +3372,27 @@ wg_destroy_peer_name(struct wg_softc *wg @@ -3372,27 +3372,27 @@ wg_destroy_peer_name(struct wg_softc *wg
3372 3372
3373 wg_destroy_peer(wgp); 3373 wg_destroy_peer(wgp);
3374 3374
3375 return 0; 3375 return 0;
3376} 3376}
3377 3377
3378static int 3378static int
3379wg_if_attach(struct wg_softc *wg) 3379wg_if_attach(struct wg_softc *wg)
3380{ 3380{
3381 int error; 3381 int error;
3382 3382
3383 wg->wg_if.if_addrlen = 0; 3383 wg->wg_if.if_addrlen = 0;
3384 wg->wg_if.if_mtu = WG_MTU; 3384 wg->wg_if.if_mtu = WG_MTU;
3385 wg->wg_if.if_flags = IFF_POINTOPOINT | IFF_MULTICAST; 3385 wg->wg_if.if_flags = IFF_MULTICAST;
3386 wg->wg_if.if_extflags = IFEF_NO_LINK_STATE_CHANGE; 3386 wg->wg_if.if_extflags = IFEF_NO_LINK_STATE_CHANGE;
3387 wg->wg_if.if_extflags |= IFEF_MPSAFE; 3387 wg->wg_if.if_extflags |= IFEF_MPSAFE;
3388 wg->wg_if.if_ioctl = wg_ioctl; 3388 wg->wg_if.if_ioctl = wg_ioctl;
3389 wg->wg_if.if_output = wg_output; 3389 wg->wg_if.if_output = wg_output;
3390 wg->wg_if.if_init = wg_init; 3390 wg->wg_if.if_init = wg_init;
3391 wg->wg_if.if_stop = wg_stop; 3391 wg->wg_if.if_stop = wg_stop;
3392 wg->wg_if.if_type = IFT_OTHER; 3392 wg->wg_if.if_type = IFT_OTHER;
3393 wg->wg_if.if_dlt = DLT_NULL; 3393 wg->wg_if.if_dlt = DLT_NULL;
3394 wg->wg_if.if_softc = wg; 3394 wg->wg_if.if_softc = wg;
3395 IFQ_SET_READY(&wg->wg_if.if_snd); 3395 IFQ_SET_READY(&wg->wg_if.if_snd);
3396 3396
3397 error = if_initialize(&wg->wg_if); 3397 error = if_initialize(&wg->wg_if);
3398 if (error != 0) 3398 if (error != 0)