From nobody Thu Jun 26 02:59:09 2025 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4bSNgd4Wnfz5yvWv; Thu, 26 Jun 2025 02:59:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4bSNgd2w2kz3Lkq; Thu, 26 Jun 2025 02:59:09 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1750906749; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=lUHcKoIJr95F2SifLtLVzNqZwqbf98AHB5l6UZUMB0k=; b=RUwTSTn6vk5ilW8LxEi7dbmGecx9++LzuK2JKaduZGLBWakVCQaeDrBNG+SmQ3VernyZnU 3X2N9Rll5B4EjHEKYCnwxTPyuX2J4whmvYcE/p6vIY8x7fwCfTXskNC/0OfXSte5R2miZk /0DTxD5AoNzRYloA8RGxKqWd3soxFj10kefrzQaLkcqOGrcMdJY61sMR+oUUWU9CNVuA/T A5NKhaaNnhekkc02iHF4pSjUjLknaFvoVxiMTiJbxTeSMbtJLs/6lv/nnRGLXk2p+kyf8x 5h0Bj19VkqRW01FQgBPSVbTb3nmmrh7Z2sJROunjBAPpd8WauuDduWcx5Yc77g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1750906749; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=lUHcKoIJr95F2SifLtLVzNqZwqbf98AHB5l6UZUMB0k=; b=gIRm95tY8NLfIvKSl5dcjfjjN5cL5xLzwjZSs5SI6PCoTXws1onWilM9v8MDRHhxUk5Nxj /eyaSbOYBIECicfOixRUsvdtMOmP06l06jZz4LLzUc46kUUw+EDeK1dXXv4rPgEpB2UCw1 mdWGIL60GsQqjfzCKMfruK5LgC2EtqoG27SuiwmtHY/9sVixi6R3uByrR3sOYtbTpEMGh2 Umfd/oqdB0DHCilWrhxdDim2QLVbNBIqDsi1Vzo3hujZs6m4rUT8Mn79kQJ2Ey0RG6DRwn c6MRI9YAJNGwXz+zlpWQoLNhardX912jvmO038BpdwnTcu7rmhSE+0V3X6fH8g== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1750906749; a=rsa-sha256; cv=none; b=yJdh34bcSOIw+6XDFemaKeNxEIszclPCBiqJTBt3j+HYJf3Vjp+NXfcoy0rjzuQCzXw4xa qcWVW/BkWYQ1HXEgQfkt35p5faS6VEdfOpCrqEoThySh6z6SM1K7KeCVJF0KcHEAibEPvs MUjrdhec5h5bEO8PRqjEQB4ZfmDS4EdzGpy49SaJOnDXjZ3L8wHLXHTiMRqOQzTAaURDh7 R2eZhKUflG+ZAZgOHpDhqNTw1Pj3V8ek1uxhLgE0A+ouCMHxwe9tEk+kAj9dTvn0tPCcX2 sitqYJlsLNlxyMTh5C2UPah9Yslgtkn0LkH8ylodl7b45GDLT47a9+GGvPC3Ag== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4bSNgd2NGyzlm4; Thu, 26 Jun 2025 02:59:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 55Q2x9Zo052985; Thu, 26 Jun 2025 02:59:09 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 55Q2x9Pc052982; Thu, 26 Jun 2025 02:59:09 GMT (envelope-from git) Date: Thu, 26 Jun 2025 02:59:09 GMT Message-Id: <202506260259.55Q2x9Pc052982@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kyle Evans Subject: git: d15d610fac97 - main - kern: wg: add support for removing Allowed-IPs List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kevans X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: d15d610fac97df4fefed3f14b31dcfbdcec65bf9 Auto-Submitted: auto-generated The branch main has been updated by kevans: URL: https://cgit.FreeBSD.org/src/commit/?id=d15d610fac97df4fefed3f14b31dcfbdcec65bf9 commit d15d610fac97df4fefed3f14b31dcfbdcec65bf9 Author: Kyle Evans AuthorDate: 2025-06-26 02:57:02 +0000 Commit: Kyle Evans CommitDate: 2025-06-26 02:58:22 +0000 kern: wg: add support for removing Allowed-IPs This was recently added to Linux to improve incremental update support, as you could previously add Allowed-IPs but not remove without replacing the whole set (and thus, potentially disrupting existing traffic). Removal is incredibly straightforward; we'll find it in p_aips first to ensure that it's actually valid for this peer, then we'll delete it from the radix tree before we remove the corresponding p_aips entry. Reviewed by: Jason A. Donenfeld, jhb Differential Revision: https://reviews.freebsd.org/D50448 --- sys/dev/wg/if_wg.c | 70 +++++++++++++++++++++++++++++++++++++++++++++++++++++- sys/dev/wg/if_wg.h | 6 +++++ 2 files changed, 75 insertions(+), 1 deletion(-) diff --git a/sys/dev/wg/if_wg.c b/sys/dev/wg/if_wg.c index 78e02da92333..6ad3c44dc8ff 100644 --- a/sys/dev/wg/if_wg.c +++ b/sys/dev/wg/if_wg.c @@ -314,6 +314,8 @@ static void wg_timers_run_zero_key_material(void *); static void wg_timers_run_persistent_keepalive(void *); static int wg_aip_add(struct wg_softc *, struct wg_peer *, sa_family_t, const void *, uint8_t); +static int wg_aip_del(struct wg_softc *, struct wg_peer *, sa_family_t, + const void *, uint8_t); static struct wg_peer *wg_aip_lookup(struct wg_softc *, sa_family_t, void *); static void wg_aip_remove_all(struct wg_softc *, struct wg_peer *); static struct wg_peer *wg_peer_create(struct wg_softc *, @@ -608,6 +610,58 @@ wg_aip_add(struct wg_softc *sc, struct wg_peer *peer, sa_family_t af, return (ret); } +static int +wg_aip_del(struct wg_softc *sc, struct wg_peer *peer, sa_family_t af, + const void *baddr, uint8_t cidr) +{ + struct radix_node_head *root = NULL; + struct radix_node *dnode __diagused, *node; + struct wg_aip *aip, addr; + int ret = 0; + + /* + * We need to be sure that all padding is cleared, as it is above when + * new AllowedIPs are added, since we want to do a direct comparison. + */ + memset(&addr, 0, sizeof(addr)); + addr.a_af = af; + + ret = wg_aip_addrinfo(&addr, baddr, cidr); + if (ret != 0) + return (ret); + + root = af == AF_INET ? sc->sc_aip4 : sc->sc_aip6; + + MPASS(root != NULL); + RADIX_NODE_HEAD_LOCK(root); + + node = root->rnh_lookup(&addr.a_addr, &addr.a_mask, &root->rh); + if (node == NULL) { + RADIX_NODE_HEAD_UNLOCK(root); + return (0); + } + + aip = (struct wg_aip *)node; + if (aip->a_peer != peer) { + /* + * They could have specified an allowed-ip that belonged to a + * different peer, in which case our job is done because the + * AllowedIP has been removed. + */ + RADIX_NODE_HEAD_UNLOCK(root); + return (0); + } + + dnode = root->rnh_deladdr(&aip->a_addr, &aip->a_mask, &root->rh); + MPASS(dnode == node); + RADIX_NODE_HEAD_UNLOCK(root); + + LIST_REMOVE(aip, a_entry); + peer->p_aips_num--; + free(aip, M_WG); + return (0); +} + static struct wg_peer * wg_aip_lookup(struct wg_softc *sc, sa_family_t af, void *a) { @@ -2479,11 +2533,19 @@ wg_peer_add(struct wg_softc *sc, const nvlist_t *nvl) aipl = nvlist_get_nvlist_array(nvl, "allowed-ips", &allowedip_count); for (size_t idx = 0; idx < allowedip_count; idx++) { sa_family_t ipaf; + int ipflags; if (!nvlist_exists_number(aipl[idx], "cidr")) continue; ipaf = AF_UNSPEC; + ipflags = 0; + if (nvlist_exists_number(aipl[idx], "flags")) + ipflags = nvlist_get_number(aipl[idx], "flags"); + if ((ipflags & ~WGALLOWEDIP_VALID_FLAGS) != 0) { + err = EOPNOTSUPP; + goto out; + } cidr = nvlist_get_number(aipl[idx], "cidr"); if (nvlist_exists_binary(aipl[idx], "ipv4")) { addr = nvlist_get_binary(aipl[idx], "ipv4", &size); @@ -2506,7 +2568,13 @@ wg_peer_add(struct wg_softc *sc, const nvlist_t *nvl) } MPASS(ipaf != AF_UNSPEC); - if ((err = wg_aip_add(sc, peer, ipaf, addr, cidr)) != 0) + if ((ipflags & WGALLOWEDIP_REMOVE_ME) != 0) { + err = wg_aip_del(sc, peer, ipaf, addr, cidr); + } else { + err = wg_aip_add(sc, peer, ipaf, addr, cidr); + } + + if (err != 0) goto out; } } diff --git a/sys/dev/wg/if_wg.h b/sys/dev/wg/if_wg.h index f00b7f676319..801eaf38141d 100644 --- a/sys/dev/wg/if_wg.h +++ b/sys/dev/wg/if_wg.h @@ -32,4 +32,10 @@ struct wg_data_io { #define SIOCSWG _IOWR('i', 210, struct wg_data_io) #define SIOCGWG _IOWR('i', 211, struct wg_data_io) + +/* Keep these in sync with wireguard-tools:containers.h */ +#define WGALLOWEDIP_REMOVE_ME 0x0001 + +#define WGALLOWEDIP_VALID_FLAGS WGALLOWEDIP_REMOVE_ME + #endif /* __IF_WG_H__ */