2021-11-11 15:37:29 -07:00
|
|
|
package overlay
|
2021-11-08 11:36:31 -07:00
|
|
|
|
|
|
|
import (
|
|
|
|
"crypto"
|
|
|
|
"fmt"
|
|
|
|
"io"
|
|
|
|
"net"
|
2022-04-18 10:12:25 -06:00
|
|
|
"net/netip"
|
2021-11-08 11:36:31 -07:00
|
|
|
"unsafe"
|
|
|
|
|
2021-12-14 09:52:28 -07:00
|
|
|
"github.com/sirupsen/logrus"
|
2021-11-12 10:19:28 -07:00
|
|
|
"github.com/slackhq/nebula/cidr"
|
|
|
|
"github.com/slackhq/nebula/iputil"
|
2021-11-08 11:36:31 -07:00
|
|
|
"github.com/slackhq/nebula/wintun"
|
|
|
|
"golang.org/x/sys/windows"
|
|
|
|
"golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
|
|
|
|
)
|
|
|
|
|
|
|
|
const tunGUIDLabel = "Fixed Nebula Windows GUID v1"
|
|
|
|
|
2021-11-12 09:47:36 -07:00
|
|
|
type winTun struct {
|
2021-11-12 11:47:09 -07:00
|
|
|
Device string
|
|
|
|
cidr *net.IPNet
|
2022-04-18 10:12:25 -06:00
|
|
|
prefix netip.Prefix
|
2021-11-12 11:47:09 -07:00
|
|
|
MTU int
|
|
|
|
Routes []Route
|
|
|
|
routeTree *cidr.Tree4
|
2021-11-08 11:36:31 -07:00
|
|
|
|
|
|
|
tun *wintun.NativeTun
|
|
|
|
}
|
|
|
|
|
|
|
|
func generateGUIDByDeviceName(name string) (*windows.GUID, error) {
|
|
|
|
// GUID is 128 bit
|
|
|
|
hash := crypto.MD5.New()
|
|
|
|
|
|
|
|
_, err := hash.Write([]byte(tunGUIDLabel))
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
_, err = hash.Write([]byte(name))
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
sum := hash.Sum(nil)
|
|
|
|
|
|
|
|
return (*windows.GUID)(unsafe.Pointer(&sum[0])), nil
|
|
|
|
}
|
|
|
|
|
2021-12-14 09:52:28 -07:00
|
|
|
func newWinTun(l *logrus.Logger, deviceName string, cidr *net.IPNet, defaultMTU int, routes []Route) (*winTun, error) {
|
2021-11-08 11:36:31 -07:00
|
|
|
guid, err := generateGUIDByDeviceName(deviceName)
|
|
|
|
if err != nil {
|
2021-11-12 09:47:36 -07:00
|
|
|
return nil, fmt.Errorf("generate GUID failed: %w", err)
|
2021-11-08 11:36:31 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
tunDevice, err := wintun.CreateTUNWithRequestedGUID(deviceName, guid, defaultMTU)
|
|
|
|
if err != nil {
|
2021-11-12 09:47:36 -07:00
|
|
|
return nil, fmt.Errorf("create TUN device failed: %w", err)
|
2021-11-08 11:36:31 -07:00
|
|
|
}
|
|
|
|
|
2021-12-14 09:52:28 -07:00
|
|
|
routeTree, err := makeRouteTree(l, routes, false)
|
2021-11-12 10:19:28 -07:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2022-04-18 10:12:25 -06:00
|
|
|
prefix, err := iputil.ToNetIpPrefix(*cidr)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2021-11-12 09:47:36 -07:00
|
|
|
return &winTun{
|
2021-11-12 11:47:09 -07:00
|
|
|
Device: deviceName,
|
|
|
|
cidr: cidr,
|
2022-04-18 10:12:25 -06:00
|
|
|
prefix: prefix,
|
2021-11-12 11:47:09 -07:00
|
|
|
MTU: defaultMTU,
|
|
|
|
Routes: routes,
|
|
|
|
routeTree: routeTree,
|
2021-11-08 11:36:31 -07:00
|
|
|
|
|
|
|
tun: tunDevice.(*wintun.NativeTun),
|
2021-11-12 09:47:36 -07:00
|
|
|
}, nil
|
2021-11-08 11:36:31 -07:00
|
|
|
}
|
|
|
|
|
2021-11-12 09:47:36 -07:00
|
|
|
func (t *winTun) Activate() error {
|
|
|
|
luid := winipcfg.LUID(t.tun.LUID())
|
2021-11-08 11:36:31 -07:00
|
|
|
|
2022-04-18 10:12:25 -06:00
|
|
|
if err := luid.SetIPAddresses([]netip.Prefix{t.prefix}); err != nil {
|
2021-11-08 11:36:31 -07:00
|
|
|
return fmt.Errorf("failed to set address: %w", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
foundDefault4 := false
|
2021-11-12 10:19:28 -07:00
|
|
|
routes := make([]*winipcfg.RouteData, 0, len(t.Routes)+1)
|
|
|
|
|
|
|
|
for _, r := range t.Routes {
|
2023-04-10 11:32:37 -06:00
|
|
|
if r.Via == nil || !r.Install {
|
2021-11-12 10:19:28 -07:00
|
|
|
// We don't allow route MTUs so only install routes with a via
|
|
|
|
continue
|
|
|
|
}
|
2021-11-08 11:36:31 -07:00
|
|
|
|
|
|
|
if !foundDefault4 {
|
2021-11-12 10:19:28 -07:00
|
|
|
if ones, bits := r.Cidr.Mask.Size(); ones == 0 && bits != 0 {
|
2021-11-08 11:36:31 -07:00
|
|
|
foundDefault4 = true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-04-18 10:12:25 -06:00
|
|
|
prefix, err := iputil.ToNetIpPrefix(*r.Cidr)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2021-11-08 11:36:31 -07:00
|
|
|
// Add our unsafe route
|
|
|
|
routes = append(routes, &winipcfg.RouteData{
|
2022-04-18 10:12:25 -06:00
|
|
|
Destination: prefix,
|
|
|
|
NextHop: r.Via.ToNetIpAddr(),
|
2021-11-11 15:37:29 -07:00
|
|
|
Metric: uint32(r.Metric),
|
2021-11-08 11:36:31 -07:00
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
if err := luid.AddRoutes(routes); err != nil {
|
|
|
|
return fmt.Errorf("failed to add routes: %w", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
ipif, err := luid.IPInterface(windows.AF_INET)
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("failed to get ip interface: %w", err)
|
|
|
|
}
|
|
|
|
|
2021-11-12 09:47:36 -07:00
|
|
|
ipif.NLMTU = uint32(t.MTU)
|
2021-11-08 11:36:31 -07:00
|
|
|
if foundDefault4 {
|
|
|
|
ipif.UseAutomaticMetric = false
|
|
|
|
ipif.Metric = 0
|
|
|
|
}
|
|
|
|
|
|
|
|
if err := ipif.Set(); err != nil {
|
|
|
|
return fmt.Errorf("failed to set ip interface: %w", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2021-11-12 10:19:28 -07:00
|
|
|
func (t *winTun) RouteFor(ip iputil.VpnIp) iputil.VpnIp {
|
2021-11-12 11:47:09 -07:00
|
|
|
r := t.routeTree.MostSpecificContains(ip)
|
2021-11-12 10:19:28 -07:00
|
|
|
if r != nil {
|
|
|
|
return r.(iputil.VpnIp)
|
|
|
|
}
|
|
|
|
|
|
|
|
return 0
|
|
|
|
}
|
|
|
|
|
2021-11-12 11:47:09 -07:00
|
|
|
func (t *winTun) Cidr() *net.IPNet {
|
|
|
|
return t.cidr
|
2021-11-08 11:36:31 -07:00
|
|
|
}
|
|
|
|
|
2021-11-12 11:47:09 -07:00
|
|
|
func (t *winTun) Name() string {
|
2021-11-12 09:47:36 -07:00
|
|
|
return t.Device
|
2021-11-08 11:36:31 -07:00
|
|
|
}
|
|
|
|
|
2021-11-12 09:47:36 -07:00
|
|
|
func (t *winTun) Read(b []byte) (int, error) {
|
|
|
|
return t.tun.Read(b, 0)
|
2021-11-08 11:36:31 -07:00
|
|
|
}
|
|
|
|
|
2021-11-12 09:47:36 -07:00
|
|
|
func (t *winTun) Write(b []byte) (int, error) {
|
|
|
|
return t.tun.Write(b, 0)
|
2021-11-08 11:36:31 -07:00
|
|
|
}
|
|
|
|
|
2021-11-12 09:47:36 -07:00
|
|
|
func (t *winTun) NewMultiQueueReader() (io.ReadWriteCloser, error) {
|
2021-11-08 11:36:31 -07:00
|
|
|
return nil, fmt.Errorf("TODO: multiqueue not implemented for windows")
|
|
|
|
}
|
|
|
|
|
2021-11-12 09:47:36 -07:00
|
|
|
func (t *winTun) Close() error {
|
2021-11-08 11:36:31 -07:00
|
|
|
// It seems that the Windows networking stack doesn't like it when we destroy interfaces that have active routes,
|
|
|
|
// so to be certain, just remove everything before destroying.
|
2021-11-12 09:47:36 -07:00
|
|
|
luid := winipcfg.LUID(t.tun.LUID())
|
2021-11-08 11:36:31 -07:00
|
|
|
_ = luid.FlushRoutes(windows.AF_INET)
|
|
|
|
_ = luid.FlushIPAddresses(windows.AF_INET)
|
|
|
|
/* We don't support IPV6 yet
|
|
|
|
_ = luid.FlushRoutes(windows.AF_INET6)
|
|
|
|
_ = luid.FlushIPAddresses(windows.AF_INET6)
|
|
|
|
*/
|
|
|
|
_ = luid.FlushDNS(windows.AF_INET)
|
|
|
|
|
2021-11-12 09:47:36 -07:00
|
|
|
return t.tun.Close()
|
2021-11-08 11:36:31 -07:00
|
|
|
}
|