![Eric Dumazet](/assets/img/avatar_default.png)
In the unlikely case a new node could not be allocated, we need to
remove @newnode from @peer->allowedips_list before freeing it.
syzbot reported:
BUG: KASAN: use-after-free in __list_del_entry_valid+0xdc/0xf5 lib/list_debug.c:54
Read of size 8 at addr ffff88809881a538 by task syz-executor.4/30133
CPU: 0 PID: 30133 Comm: syz-executor.4 Not tainted 5.5.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374
__kasan_report.cold+0x1b/0x32 mm/kasan/report.c:506
kasan_report+0x12/0x20 mm/kasan/common.c:639
__asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135
__list_del_entry_valid+0xdc/0xf5 lib/list_debug.c:54
__list_del_entry include/linux/list.h:132 [inline]
list_del include/linux/list.h:146 [inline]
root_remove_peer_lists+0x24f/0x4b0 drivers/net/wireguard/allowedips.c:65
wg_allowedips_free+0x232/0x390 drivers/net/wireguard/allowedips.c:300
wg_peer_remove_all+0xd5/0x620 drivers/net/wireguard/peer.c:187
wg_set_device+0xd01/0x1350 drivers/net/wireguard/netlink.c:542
genl_family_rcv_msg_doit net/netlink/genetlink.c:672 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:717 [inline]
genl_rcv_msg+0x67d/0xea0 net/netlink/genetlink.c:734
netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477
genl_rcv+0x29/0x40 net/netlink/genetlink.c:745
netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
netlink_unicast+0x59e/0x7e0 net/netlink/af_netlink.c:1328
netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1917
sock_sendmsg_nosec net/socket.c:652 [inline]
sock_sendmsg+0xd7/0x130 net/socket.c:672
____sys_sendmsg+0x753/0x880 net/socket.c:2343
___sys_sendmsg+0x100/0x170 net/socket.c:2397
__sys_sendmsg+0x105/0x1d0 net/socket.c:2430
__do_sys_sendmsg net/socket.c:2439 [inline]
__se_sys_sendmsg net/socket.c:2437 [inline]
__x64_sys_sendmsg+0x78/0xb0 net/socket.c:2437
do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x45b399
Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f99a9bcdc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f99a9bce6d4 RCX: 000000000045b399
RDX: 0000000000000000 RSI: 0000000020001340 RDI: 0000000000000003
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004
R13: 00000000000009ba R14: 00000000004cb2b8 R15: 0000000000000009
Allocated by task 30103:
save_stack+0x23/0x90 mm/kasan/common.c:72
set_track mm/kasan/common.c:80 [inline]
__kasan_kmalloc mm/kasan/common.c:513 [inline]
__kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:486
kasan_kmalloc+0x9/0x10 mm/kasan/common.c:527
kmem_cache_alloc_trace+0x158/0x790 mm/slab.c:3551
kmalloc include/linux/slab.h:556 [inline]
kzalloc include/linux/slab.h:670 [inline]
add+0x70a/0x1970 drivers/net/wireguard/allowedips.c:236
wg_allowedips_insert_v4+0xf6/0x160 drivers/net/wireguard/allowedips.c:320
set_allowedip drivers/net/wireguard/netlink.c:343 [inline]
set_peer+0xfb9/0x1150 drivers/net/wireguard/netlink.c:468
wg_set_device+0xbd4/0x1350 drivers/net/wireguard/netlink.c:591
genl_family_rcv_msg_doit net/netlink/genetlink.c:672 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:717 [inline]
genl_rcv_msg+0x67d/0xea0 net/netlink/genetlink.c:734
netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477
genl_rcv+0x29/0x40 net/netlink/genetlink.c:745
netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
netlink_unicast+0x59e/0x7e0 net/netlink/af_netlink.c:1328
netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1917
sock_sendmsg_nosec net/socket.c:652 [inline]
sock_sendmsg+0xd7/0x130 net/socket.c:672
____sys_sendmsg+0x753/0x880 net/socket.c:2343
___sys_sendmsg+0x100/0x170 net/socket.c:2397
__sys_sendmsg+0x105/0x1d0 net/socket.c:2430
__do_sys_sendmsg net/socket.c:2439 [inline]
__se_sys_sendmsg net/socket.c:2437 [inline]
__x64_sys_sendmsg+0x78/0xb0 net/socket.c:2437
do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 30103:
save_stack+0x23/0x90 mm/kasan/common.c:72
set_track mm/kasan/common.c:80 [inline]
kasan_set_free_info mm/kasan/common.c:335 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/common.c:474
kasan_slab_free+0xe/0x10 mm/kasan/common.c:483
__cache_free mm/slab.c:3426 [inline]
kfree+0x10a/0x2c0 mm/slab.c:3757
add+0x12d2/0x1970 drivers/net/wireguard/allowedips.c:266
wg_allowedips_insert_v4+0xf6/0x160 drivers/net/wireguard/allowedips.c:320
set_allowedip drivers/net/wireguard/netlink.c:343 [inline]
set_peer+0xfb9/0x1150 drivers/net/wireguard/netlink.c:468
wg_set_device+0xbd4/0x1350 drivers/net/wireguard/netlink.c:591
genl_family_rcv_msg_doit net/netlink/genetlink.c:672 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:717 [inline]
genl_rcv_msg+0x67d/0xea0 net/netlink/genetlink.c:734
netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477
genl_rcv+0x29/0x40 net/netlink/genetlink.c:745
netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
netlink_unicast+0x59e/0x7e0 net/netlink/af_netlink.c:1328
netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1917
sock_sendmsg_nosec net/socket.c:652 [inline]
sock_sendmsg+0xd7/0x130 net/socket.c:672
____sys_sendmsg+0x753/0x880 net/socket.c:2343
___sys_sendmsg+0x100/0x170 net/socket.c:2397
__sys_sendmsg+0x105/0x1d0 net/socket.c:2430
__do_sys_sendmsg net/socket.c:2439 [inline]
__se_sys_sendmsg net/socket.c:2437 [inline]
__x64_sys_sendmsg+0x78/0xb0 net/socket.c:2437
do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff88809881a500
which belongs to the cache kmalloc-64 of size 64
The buggy address is located 56 bytes inside of
64-byte region [ffff88809881a500, ffff88809881a540)
The buggy address belongs to the page:
page:ffffea0002620680 refcount:1 mapcount:0 mapping:ffff8880aa400380 index:0x0
raw: 00fffe0000000200 ffffea000250b748 ffffea000254bac8 ffff8880aa400380
raw: 0000000000000000 ffff88809881a000 0000000100000020 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88809881a400: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88809881a480: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
>ffff88809881a500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff88809881a580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88809881a600: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
Fixes: e7096c131e
("net: WireGuard secure network tunnel")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Jason A. Donenfeld <Jason@zx2c4.com>
Cc: wireguard@lists.zx2c4.com
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
378 lines
10 KiB
C
378 lines
10 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
|
|
*/
|
|
|
|
#include "allowedips.h"
|
|
#include "peer.h"
|
|
|
|
static void swap_endian(u8 *dst, const u8 *src, u8 bits)
|
|
{
|
|
if (bits == 32) {
|
|
*(u32 *)dst = be32_to_cpu(*(const __be32 *)src);
|
|
} else if (bits == 128) {
|
|
((u64 *)dst)[0] = be64_to_cpu(((const __be64 *)src)[0]);
|
|
((u64 *)dst)[1] = be64_to_cpu(((const __be64 *)src)[1]);
|
|
}
|
|
}
|
|
|
|
static void copy_and_assign_cidr(struct allowedips_node *node, const u8 *src,
|
|
u8 cidr, u8 bits)
|
|
{
|
|
node->cidr = cidr;
|
|
node->bit_at_a = cidr / 8U;
|
|
#ifdef __LITTLE_ENDIAN
|
|
node->bit_at_a ^= (bits / 8U - 1U) % 8U;
|
|
#endif
|
|
node->bit_at_b = 7U - (cidr % 8U);
|
|
node->bitlen = bits;
|
|
memcpy(node->bits, src, bits / 8U);
|
|
}
|
|
#define CHOOSE_NODE(parent, key) \
|
|
parent->bit[(key[parent->bit_at_a] >> parent->bit_at_b) & 1]
|
|
|
|
static void push_rcu(struct allowedips_node **stack,
|
|
struct allowedips_node __rcu *p, unsigned int *len)
|
|
{
|
|
if (rcu_access_pointer(p)) {
|
|
WARN_ON(IS_ENABLED(DEBUG) && *len >= 128);
|
|
stack[(*len)++] = rcu_dereference_raw(p);
|
|
}
|
|
}
|
|
|
|
static void root_free_rcu(struct rcu_head *rcu)
|
|
{
|
|
struct allowedips_node *node, *stack[128] = {
|
|
container_of(rcu, struct allowedips_node, rcu) };
|
|
unsigned int len = 1;
|
|
|
|
while (len > 0 && (node = stack[--len])) {
|
|
push_rcu(stack, node->bit[0], &len);
|
|
push_rcu(stack, node->bit[1], &len);
|
|
kfree(node);
|
|
}
|
|
}
|
|
|
|
static void root_remove_peer_lists(struct allowedips_node *root)
|
|
{
|
|
struct allowedips_node *node, *stack[128] = { root };
|
|
unsigned int len = 1;
|
|
|
|
while (len > 0 && (node = stack[--len])) {
|
|
push_rcu(stack, node->bit[0], &len);
|
|
push_rcu(stack, node->bit[1], &len);
|
|
if (rcu_access_pointer(node->peer))
|
|
list_del(&node->peer_list);
|
|
}
|
|
}
|
|
|
|
static void walk_remove_by_peer(struct allowedips_node __rcu **top,
|
|
struct wg_peer *peer, struct mutex *lock)
|
|
{
|
|
#define REF(p) rcu_access_pointer(p)
|
|
#define DEREF(p) rcu_dereference_protected(*(p), lockdep_is_held(lock))
|
|
#define PUSH(p) ({ \
|
|
WARN_ON(IS_ENABLED(DEBUG) && len >= 128); \
|
|
stack[len++] = p; \
|
|
})
|
|
|
|
struct allowedips_node __rcu **stack[128], **nptr;
|
|
struct allowedips_node *node, *prev;
|
|
unsigned int len;
|
|
|
|
if (unlikely(!peer || !REF(*top)))
|
|
return;
|
|
|
|
for (prev = NULL, len = 0, PUSH(top); len > 0; prev = node) {
|
|
nptr = stack[len - 1];
|
|
node = DEREF(nptr);
|
|
if (!node) {
|
|
--len;
|
|
continue;
|
|
}
|
|
if (!prev || REF(prev->bit[0]) == node ||
|
|
REF(prev->bit[1]) == node) {
|
|
if (REF(node->bit[0]))
|
|
PUSH(&node->bit[0]);
|
|
else if (REF(node->bit[1]))
|
|
PUSH(&node->bit[1]);
|
|
} else if (REF(node->bit[0]) == prev) {
|
|
if (REF(node->bit[1]))
|
|
PUSH(&node->bit[1]);
|
|
} else {
|
|
if (rcu_dereference_protected(node->peer,
|
|
lockdep_is_held(lock)) == peer) {
|
|
RCU_INIT_POINTER(node->peer, NULL);
|
|
list_del_init(&node->peer_list);
|
|
if (!node->bit[0] || !node->bit[1]) {
|
|
rcu_assign_pointer(*nptr, DEREF(
|
|
&node->bit[!REF(node->bit[0])]));
|
|
kfree_rcu(node, rcu);
|
|
node = DEREF(nptr);
|
|
}
|
|
}
|
|
--len;
|
|
}
|
|
}
|
|
|
|
#undef REF
|
|
#undef DEREF
|
|
#undef PUSH
|
|
}
|
|
|
|
static unsigned int fls128(u64 a, u64 b)
|
|
{
|
|
return a ? fls64(a) + 64U : fls64(b);
|
|
}
|
|
|
|
static u8 common_bits(const struct allowedips_node *node, const u8 *key,
|
|
u8 bits)
|
|
{
|
|
if (bits == 32)
|
|
return 32U - fls(*(const u32 *)node->bits ^ *(const u32 *)key);
|
|
else if (bits == 128)
|
|
return 128U - fls128(
|
|
*(const u64 *)&node->bits[0] ^ *(const u64 *)&key[0],
|
|
*(const u64 *)&node->bits[8] ^ *(const u64 *)&key[8]);
|
|
return 0;
|
|
}
|
|
|
|
static bool prefix_matches(const struct allowedips_node *node, const u8 *key,
|
|
u8 bits)
|
|
{
|
|
/* This could be much faster if it actually just compared the common
|
|
* bits properly, by precomputing a mask bswap(~0 << (32 - cidr)), and
|
|
* the rest, but it turns out that common_bits is already super fast on
|
|
* modern processors, even taking into account the unfortunate bswap.
|
|
* So, we just inline it like this instead.
|
|
*/
|
|
return common_bits(node, key, bits) >= node->cidr;
|
|
}
|
|
|
|
static struct allowedips_node *find_node(struct allowedips_node *trie, u8 bits,
|
|
const u8 *key)
|
|
{
|
|
struct allowedips_node *node = trie, *found = NULL;
|
|
|
|
while (node && prefix_matches(node, key, bits)) {
|
|
if (rcu_access_pointer(node->peer))
|
|
found = node;
|
|
if (node->cidr == bits)
|
|
break;
|
|
node = rcu_dereference_bh(CHOOSE_NODE(node, key));
|
|
}
|
|
return found;
|
|
}
|
|
|
|
/* Returns a strong reference to a peer */
|
|
static struct wg_peer *lookup(struct allowedips_node __rcu *root, u8 bits,
|
|
const void *be_ip)
|
|
{
|
|
/* Aligned so it can be passed to fls/fls64 */
|
|
u8 ip[16] __aligned(__alignof(u64));
|
|
struct allowedips_node *node;
|
|
struct wg_peer *peer = NULL;
|
|
|
|
swap_endian(ip, be_ip, bits);
|
|
|
|
rcu_read_lock_bh();
|
|
retry:
|
|
node = find_node(rcu_dereference_bh(root), bits, ip);
|
|
if (node) {
|
|
peer = wg_peer_get_maybe_zero(rcu_dereference_bh(node->peer));
|
|
if (!peer)
|
|
goto retry;
|
|
}
|
|
rcu_read_unlock_bh();
|
|
return peer;
|
|
}
|
|
|
|
static bool node_placement(struct allowedips_node __rcu *trie, const u8 *key,
|
|
u8 cidr, u8 bits, struct allowedips_node **rnode,
|
|
struct mutex *lock)
|
|
{
|
|
struct allowedips_node *node = rcu_dereference_protected(trie,
|
|
lockdep_is_held(lock));
|
|
struct allowedips_node *parent = NULL;
|
|
bool exact = false;
|
|
|
|
while (node && node->cidr <= cidr && prefix_matches(node, key, bits)) {
|
|
parent = node;
|
|
if (parent->cidr == cidr) {
|
|
exact = true;
|
|
break;
|
|
}
|
|
node = rcu_dereference_protected(CHOOSE_NODE(parent, key),
|
|
lockdep_is_held(lock));
|
|
}
|
|
*rnode = parent;
|
|
return exact;
|
|
}
|
|
|
|
static int add(struct allowedips_node __rcu **trie, u8 bits, const u8 *key,
|
|
u8 cidr, struct wg_peer *peer, struct mutex *lock)
|
|
{
|
|
struct allowedips_node *node, *parent, *down, *newnode;
|
|
|
|
if (unlikely(cidr > bits || !peer))
|
|
return -EINVAL;
|
|
|
|
if (!rcu_access_pointer(*trie)) {
|
|
node = kzalloc(sizeof(*node), GFP_KERNEL);
|
|
if (unlikely(!node))
|
|
return -ENOMEM;
|
|
RCU_INIT_POINTER(node->peer, peer);
|
|
list_add_tail(&node->peer_list, &peer->allowedips_list);
|
|
copy_and_assign_cidr(node, key, cidr, bits);
|
|
rcu_assign_pointer(*trie, node);
|
|
return 0;
|
|
}
|
|
if (node_placement(*trie, key, cidr, bits, &node, lock)) {
|
|
rcu_assign_pointer(node->peer, peer);
|
|
list_move_tail(&node->peer_list, &peer->allowedips_list);
|
|
return 0;
|
|
}
|
|
|
|
newnode = kzalloc(sizeof(*newnode), GFP_KERNEL);
|
|
if (unlikely(!newnode))
|
|
return -ENOMEM;
|
|
RCU_INIT_POINTER(newnode->peer, peer);
|
|
list_add_tail(&newnode->peer_list, &peer->allowedips_list);
|
|
copy_and_assign_cidr(newnode, key, cidr, bits);
|
|
|
|
if (!node) {
|
|
down = rcu_dereference_protected(*trie, lockdep_is_held(lock));
|
|
} else {
|
|
down = rcu_dereference_protected(CHOOSE_NODE(node, key),
|
|
lockdep_is_held(lock));
|
|
if (!down) {
|
|
rcu_assign_pointer(CHOOSE_NODE(node, key), newnode);
|
|
return 0;
|
|
}
|
|
}
|
|
cidr = min(cidr, common_bits(down, key, bits));
|
|
parent = node;
|
|
|
|
if (newnode->cidr == cidr) {
|
|
rcu_assign_pointer(CHOOSE_NODE(newnode, down->bits), down);
|
|
if (!parent)
|
|
rcu_assign_pointer(*trie, newnode);
|
|
else
|
|
rcu_assign_pointer(CHOOSE_NODE(parent, newnode->bits),
|
|
newnode);
|
|
} else {
|
|
node = kzalloc(sizeof(*node), GFP_KERNEL);
|
|
if (unlikely(!node)) {
|
|
list_del(&newnode->peer_list);
|
|
kfree(newnode);
|
|
return -ENOMEM;
|
|
}
|
|
INIT_LIST_HEAD(&node->peer_list);
|
|
copy_and_assign_cidr(node, newnode->bits, cidr, bits);
|
|
|
|
rcu_assign_pointer(CHOOSE_NODE(node, down->bits), down);
|
|
rcu_assign_pointer(CHOOSE_NODE(node, newnode->bits), newnode);
|
|
if (!parent)
|
|
rcu_assign_pointer(*trie, node);
|
|
else
|
|
rcu_assign_pointer(CHOOSE_NODE(parent, node->bits),
|
|
node);
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
void wg_allowedips_init(struct allowedips *table)
|
|
{
|
|
table->root4 = table->root6 = NULL;
|
|
table->seq = 1;
|
|
}
|
|
|
|
void wg_allowedips_free(struct allowedips *table, struct mutex *lock)
|
|
{
|
|
struct allowedips_node __rcu *old4 = table->root4, *old6 = table->root6;
|
|
|
|
++table->seq;
|
|
RCU_INIT_POINTER(table->root4, NULL);
|
|
RCU_INIT_POINTER(table->root6, NULL);
|
|
if (rcu_access_pointer(old4)) {
|
|
struct allowedips_node *node = rcu_dereference_protected(old4,
|
|
lockdep_is_held(lock));
|
|
|
|
root_remove_peer_lists(node);
|
|
call_rcu(&node->rcu, root_free_rcu);
|
|
}
|
|
if (rcu_access_pointer(old6)) {
|
|
struct allowedips_node *node = rcu_dereference_protected(old6,
|
|
lockdep_is_held(lock));
|
|
|
|
root_remove_peer_lists(node);
|
|
call_rcu(&node->rcu, root_free_rcu);
|
|
}
|
|
}
|
|
|
|
int wg_allowedips_insert_v4(struct allowedips *table, const struct in_addr *ip,
|
|
u8 cidr, struct wg_peer *peer, struct mutex *lock)
|
|
{
|
|
/* Aligned so it can be passed to fls */
|
|
u8 key[4] __aligned(__alignof(u32));
|
|
|
|
++table->seq;
|
|
swap_endian(key, (const u8 *)ip, 32);
|
|
return add(&table->root4, 32, key, cidr, peer, lock);
|
|
}
|
|
|
|
int wg_allowedips_insert_v6(struct allowedips *table, const struct in6_addr *ip,
|
|
u8 cidr, struct wg_peer *peer, struct mutex *lock)
|
|
{
|
|
/* Aligned so it can be passed to fls64 */
|
|
u8 key[16] __aligned(__alignof(u64));
|
|
|
|
++table->seq;
|
|
swap_endian(key, (const u8 *)ip, 128);
|
|
return add(&table->root6, 128, key, cidr, peer, lock);
|
|
}
|
|
|
|
void wg_allowedips_remove_by_peer(struct allowedips *table,
|
|
struct wg_peer *peer, struct mutex *lock)
|
|
{
|
|
++table->seq;
|
|
walk_remove_by_peer(&table->root4, peer, lock);
|
|
walk_remove_by_peer(&table->root6, peer, lock);
|
|
}
|
|
|
|
int wg_allowedips_read_node(struct allowedips_node *node, u8 ip[16], u8 *cidr)
|
|
{
|
|
const unsigned int cidr_bytes = DIV_ROUND_UP(node->cidr, 8U);
|
|
swap_endian(ip, node->bits, node->bitlen);
|
|
memset(ip + cidr_bytes, 0, node->bitlen / 8U - cidr_bytes);
|
|
if (node->cidr)
|
|
ip[cidr_bytes - 1U] &= ~0U << (-node->cidr % 8U);
|
|
|
|
*cidr = node->cidr;
|
|
return node->bitlen == 32 ? AF_INET : AF_INET6;
|
|
}
|
|
|
|
/* Returns a strong reference to a peer */
|
|
struct wg_peer *wg_allowedips_lookup_dst(struct allowedips *table,
|
|
struct sk_buff *skb)
|
|
{
|
|
if (skb->protocol == htons(ETH_P_IP))
|
|
return lookup(table->root4, 32, &ip_hdr(skb)->daddr);
|
|
else if (skb->protocol == htons(ETH_P_IPV6))
|
|
return lookup(table->root6, 128, &ipv6_hdr(skb)->daddr);
|
|
return NULL;
|
|
}
|
|
|
|
/* Returns a strong reference to a peer */
|
|
struct wg_peer *wg_allowedips_lookup_src(struct allowedips *table,
|
|
struct sk_buff *skb)
|
|
{
|
|
if (skb->protocol == htons(ETH_P_IP))
|
|
return lookup(table->root4, 32, &ip_hdr(skb)->saddr);
|
|
else if (skb->protocol == htons(ETH_P_IPV6))
|
|
return lookup(table->root6, 128, &ipv6_hdr(skb)->saddr);
|
|
return NULL;
|
|
}
|
|
|
|
#include "selftest/allowedips.c"
|