void/amneziawg-go
2
0
Fork 0
mirror of https://github.com/amnezia-vpn/amneziawg-go.git synced 2025-06-05 04:43:44 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

rename vars and complete testing

Browse source
This commit is contained in:
Mark Puha 2025-02-10 10:05:42 +01:00
parent 068e146538
commit 0dcd528694
8 changed files with 121 additions and 68 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

55
adapter/lua.go
View file

@ -8,9 +8,9 @@ import (
"github.com/aarzilli/golua/lua" "github.com/aarzilli/golua/lua"
) )
// TODO: aSec sync is enough?
type Lua struct { type Lua struct {
state *lua.State generateState *lua.State
parseState *lua.State
packetCounter atomic.Int64 packetCounter atomic.Int64
base64LuaCode string base64LuaCode string
} }
@ -24,51 +24,72 @@ func NewLua(params LuaParams) (*Lua, error) {
if err != nil { if err != nil {
return nil, err return nil, err
} }
fmt.Println(string(luaCode))
strLuaCode := string(luaCode)
generateState, err := initState(strLuaCode)
if err != nil {
return nil, err
}
parseState, err := initState(strLuaCode)
if err != nil {
return nil, err
}
return &Lua{
generateState: generateState,
parseState: parseState,
base64LuaCode: params.Base64LuaCode,
}, nil
}
func initState(luaCode string) (*lua.State, error) {
state := lua.NewState() state := lua.NewState()
state.OpenLibs() state.OpenLibs()
if err := state.DoString(string(luaCode)); err != nil { if err := state.DoString(string(luaCode)); err != nil {
return nil, fmt.Errorf("Error loading Lua code: %v\n", err) return nil, fmt.Errorf("Error loading Lua code: %v\n", err)
} }
return &Lua{state: state, base64LuaCode: params.Base64LuaCode}, nil return state, nil
} }
func (l *Lua) Close() { func (l *Lua) Close() {
l.state.Close() l.generateState.Close()
l.parseState.Close()
} }
// Only thread safe if used by wg packet creation which happens independably
func (l *Lua) Generate( func (l *Lua) Generate(
msgType int64, msgType int64,
data []byte, data []byte,
) ([]byte, error) { ) ([]byte, error) {
l.state.GetGlobal("d_gen") l.generateState.GetGlobal("d_gen")
l.state.PushInteger(msgType) l.generateState.PushInteger(msgType)
l.state.PushBytes(data) l.generateState.PushBytes(data)
l.state.PushInteger(l.packetCounter.Add(1)) l.generateState.PushInteger(l.packetCounter.Add(1))
if err := l.state.Call(3, 1); err != nil { if err := l.generateState.Call(3, 1); err != nil {
return nil, fmt.Errorf("Error calling Lua function: %v\n", err) return nil, fmt.Errorf("Error calling Lua function: %v\n", err)
} }
result := l.state.ToBytes(-1) result := l.generateState.ToBytes(-1)
l.state.Pop(1) l.generateState.Pop(1)
return result, nil return result, nil
} }
// Only thread safe if used by wg packet receive which happens independably
func (l *Lua) Parse(data []byte) ([]byte, error) { func (l *Lua) Parse(data []byte) ([]byte, error) {
l.state.GetGlobal("d_parse") l.parseState.GetGlobal("d_parse")
l.state.PushBytes(data) l.parseState.PushBytes(data)
if err := l.state.Call(1, 1); err != nil { if err := l.parseState.Call(1, 1); err != nil {
return nil, fmt.Errorf("Error calling Lua function: %v\n", err) return nil, fmt.Errorf("Error calling Lua function: %v\n", err)
} }
result := l.state.ToBytes(-1) result := l.parseState.ToBytes(-1)
l.state.Pop(1) l.parseState.Pop(1)
return result, nil return result, nil
} }

22
adapter/lua_test.go
View file

@ -58,3 +58,25 @@ func TestLua_Parse(t *testing.T) {
} }
}) })
} }
var R []byte
var l = newLua()
func BenchmarkLuaGenerate(b *testing.B) {
for i := 0; i < b.N; i++ { var err error
R, err = l.Generate(1, []byte("test"))
if err != nil {
return
}
}
}
func BenchmarkLuaParse(b *testing.B) {
for i := 0; i < b.N; i++ {
var err error
R, err = l.Parse([]byte("1headertest"))
if err != nil {
return
}
}
}

26
device/device.go
View file

@ -98,11 +98,11 @@ type Device struct {
type awgType struct { type awgType struct {
isASecOn abool.AtomicBool isASecOn abool.AtomicBool
aSecMux sync.RWMutex mutex sync.RWMutex
aSecCfg aSecCfgType aSecCfg aSecCfgType
junkCreator junkCreator junkCreator junkCreator
luaAdapter *adapter.Lua codec *adapter.Lua
} }
type aSecCfgType struct { type aSecCfgType struct {
@ -434,9 +434,9 @@ func (device *Device) Close() {
device.resetProtocol() device.resetProtocol()
if device.awg.luaAdapter != nil { if device.awg.codec != nil {
device.awg.luaAdapter.Close() device.awg.codec.Close()
device.awg.luaAdapter = nil device.awg.codec = nil
} }
device.log.Verbosef("Device closed") device.log.Verbosef("Device closed")
close(device.closed) close(device.closed)
@ -601,7 +601,7 @@ func (device *Device) handlePostConfig(tempAwgType *awgType) (err error) {
} }
isASecOn := false isASecOn := false
device.awg.aSecMux.Lock() device.awg.mutex.Lock()
if tempAwgType.aSecCfg.junkPacketCount < 0 { if tempAwgType.aSecCfg.junkPacketCount < 0 {
err = ipcErrorf( err = ipcErrorf(
ipc.IpcErrorInvalid, ipc.IpcErrorInvalid,
@ -828,16 +828,20 @@ func (device *Device) handlePostConfig(tempAwgType *awgType) (err error) {
if device.awg.isASecOn.IsSet() { if device.awg.isASecOn.IsSet() {
device.awg.junkCreator, err = NewJunkCreator(device) device.awg.junkCreator, err = NewJunkCreator(device)
} }
device.awg.luaAdapter = tempAwgType.luaAdapter device.awg.codec = tempAwgType.codec
device.awg.aSecMux.Unlock() device.awg.mutex.Unlock()
return err return err
} }
func (device *Device) codecPacket(msgType uint32, packet []byte) ([]byte, error) { func (device *Device) isCodecActive() bool {
if device.awg.luaAdapter != nil { return device.awg.codec != nil
}
func (device *Device) codecPacketIfActive(msgType uint32, packet []byte) ([]byte, error) {
if device.isCodecActive() {
var err error var err error
packet, err = device.awg.luaAdapter.Generate(int64(msgType),packet) packet, err = device.awg.codec.Generate(int64(msgType),packet)
if err != nil { if err != nil {
device.log.Errorf("%v - Failed to run codec generate: %v", device, err) device.log.Errorf("%v - Failed to run codec generate: %v", device, err)
return nil, err return nil, err

15
device/device_test.go
View file

@ -103,11 +103,22 @@ func genASecurityConfigs(tb testing.TB) (cfgs, endpointCfgs [2]string) {
} }
pub1, pub2 := key1.publicKey(), key2.publicKey() pub1, pub2 := key1.publicKey(), key2.publicKey()
/*
head = "headheadhead"
tail = "tailtailtail"
function d_gen(msg_type, data, counter)
return head .. data .. tail
end
function d_parse(data)
return string.match(data, head.. "(.-)".. tail)
end
*/
cfgs[0] = uapiCfg( cfgs[0] = uapiCfg(
"private_key", hex.EncodeToString(key1[:]), "private_key", hex.EncodeToString(key1[:]),
"listen_port", "0", "listen_port", "0",
"replace_peers", "true", "replace_peers", "true",
"lua_codec", "CQkJZnVuY3Rpb24gZF9nZW4obXNnX3R5cGUsIGRhdGEsIGNvdW50ZXIpCgkJCQlsb2NhbCBoZWFkZXIgPSAiaGVhZGVyIgoJCQkJcmV0dXJuIGhlYWRlciAuLiBkYXRhCgkJCWVuZAoKCQkJZnVuY3Rpb24gZF9wYXJzZShkYXRhKQoJCQkJbG9jYWwgaGVhZGVyID0gImhlYWRlciIKCQkJCXJldHVybiBzdHJpbmcuc3ViKGRhdGEsICNoZWFkZXIrMSkKCQkJZW5kCg==", "lua_codec", "aGVhZCA9ICJoZWFkaGVhZGhlYWQiCnRhaWwgPSAidGFpbHRhaWx0YWlsIgpmdW5jdGlvbiBkX2dlbihtc2dfdHlwZSwgZGF0YSwgY291bnRlcikKCXJldHVybiBoZWFkIC4uIGRhdGEgLi4gdGFpbAplbmQKCmZ1bmN0aW9uIGRfcGFyc2UoZGF0YSkKICAgICAgICByZXR1cm4gc3RyaW5nLm1hdGNoKGRhdGEsIGhlYWQuLiAiKC4tKSIuLiB0YWlsKQplbmQK",
"jc", "5", "jc", "5",
"jmin", "500", "jmin", "500",
"jmax", "1000", "jmax", "1000",
@ -130,7 +141,7 @@ func genASecurityConfigs(tb testing.TB) (cfgs, endpointCfgs [2]string) {
"private_key", hex.EncodeToString(key2[:]), "private_key", hex.EncodeToString(key2[:]),
"listen_port", "0", "listen_port", "0",
"replace_peers", "true", "replace_peers", "true",
"lua_codec", "CQkJZnVuY3Rpb24gZF9nZW4obXNnX3R5cGUsIGRhdGEsIGNvdW50ZXIpCgkJCQlsb2NhbCBoZWFkZXIgPSAiaGVhZGVyIgoJCQkJcmV0dXJuIGhlYWRlciAuLiBkYXRhCgkJCWVuZAoKCQkJZnVuY3Rpb24gZF9wYXJzZShkYXRhKQoJCQkJbG9jYWwgaGVhZGVyID0gImhlYWRlciIKCQkJCXJldHVybiBzdHJpbmcuc3ViKGRhdGEsICNoZWFkZXIrMSkKCQkJZW5kCg==", "lua_codec", "aGVhZCA9ICJoZWFkaGVhZGhlYWQiCnRhaWwgPSAidGFpbHRhaWx0YWlsIgpmdW5jdGlvbiBkX2dlbihtc2dfdHlwZSwgZGF0YSwgY291bnRlcikKCXJldHVybiBoZWFkIC4uIGRhdGEgLi4gdGFpbAplbmQKCmZ1bmN0aW9uIGRfcGFyc2UoZGF0YSkKICAgICAgICByZXR1cm4gc3RyaW5nLm1hdGNoKGRhdGEsIGhlYWQuLiAiKC4tKSIuLiB0YWlsKQplbmQK",
"jc", "5", "jc", "5",
"jmin", "500", "jmin", "500",
"jmax", "1000", "jmax", "1000",

20
device/noise-protocol.go
View file

@ -204,12 +204,12 @@ func (device *Device) CreateMessageInitiation(peer *Peer) (*MessageInitiation, e
handshake.mixHash(handshake.remoteStatic[:]) handshake.mixHash(handshake.remoteStatic[:])
device.awg.aSecMux.RLock() device.awg.mutex.RLock()
msg := MessageInitiation{ msg := MessageInitiation{
Type: MessageInitiationType, Type: MessageInitiationType,
Ephemeral: handshake.localEphemeral.publicKey(), Ephemeral: handshake.localEphemeral.publicKey(),
} }
device.awg.aSecMux.RUnlock() device.awg.mutex.RUnlock()
handshake.mixKey(msg.Ephemeral[:]) handshake.mixKey(msg.Ephemeral[:])
handshake.mixHash(msg.Ephemeral[:]) handshake.mixHash(msg.Ephemeral[:])
@ -263,12 +263,12 @@ func (device *Device) ConsumeMessageInitiation(msg *MessageInitiation) *Peer {
chainKey [blake2s.Size]byte chainKey [blake2s.Size]byte
) )
device.awg.aSecMux.RLock() device.awg.mutex.RLock()
if msg.Type != MessageInitiationType { if msg.Type != MessageInitiationType {
device.awg.aSecMux.RUnlock() device.awg.mutex.RUnlock()
return nil return nil
} }
device.awg.aSecMux.RUnlock() device.awg.mutex.RUnlock()
device.staticIdentity.RLock() device.staticIdentity.RLock()
defer device.staticIdentity.RUnlock() defer device.staticIdentity.RUnlock()
@ -383,9 +383,9 @@ func (device *Device) CreateMessageResponse(peer *Peer) (*MessageResponse, error
} }
var msg MessageResponse var msg MessageResponse
device.awg.aSecMux.RLock() device.awg.mutex.RLock()
msg.Type = MessageResponseType msg.Type = MessageResponseType
device.awg.aSecMux.RUnlock() device.awg.mutex.RUnlock()
msg.Sender = handshake.localIndex msg.Sender = handshake.localIndex
msg.Receiver = handshake.remoteIndex msg.Receiver = handshake.remoteIndex
@ -435,12 +435,12 @@ func (device *Device) CreateMessageResponse(peer *Peer) (*MessageResponse, error
} }
func (device *Device) ConsumeMessageResponse(msg *MessageResponse) *Peer { func (device *Device) ConsumeMessageResponse(msg *MessageResponse) *Peer {
device.awg.aSecMux.RLock() device.awg.mutex.RLock()
if msg.Type != MessageResponseType { if msg.Type != MessageResponseType {
device.awg.aSecMux.RUnlock() device.awg.mutex.RUnlock()
return nil return nil
} }
device.awg.aSecMux.RUnlock() device.awg.mutex.RUnlock()
// lookup handshake by receiver // lookup handshake by receiver

20
device/receive.go
View file

@ -12,7 +12,6 @@ import (
"net" "net"
"sync" "sync"
"time" "time"
"unsafe"
"github.com/amnezia-vpn/amneziawg-go/conn" "github.com/amnezia-vpn/amneziawg-go/conn"
"golang.org/x/crypto/chacha20poly1305" "golang.org/x/crypto/chacha20poly1305"
@ -130,7 +129,7 @@ func (device *Device) RoutineReceiveIncoming(
} }
deathSpiral = 0 deathSpiral = 0
device.awg.aSecMux.RLock() device.awg.mutex.RLock()
// handle each packet in the batch // handle each packet in the batch
for i, size := range sizes[:count] { for i, size := range sizes[:count] {
if size < MinMessageSize { if size < MinMessageSize {
@ -138,15 +137,10 @@ func (device *Device) RoutineReceiveIncoming(
} }
packet := bufsArrs[i][:size] packet := bufsArrs[i][:size]
if device.awg.luaAdapter != nil { if device.isCodecActive() {
realPacket, err := device.awg.luaAdapter.Parse(packet) realPacket, err := device.awg.codec.Parse(packet)
copy(packet, realPacket)
packetPtr := (*byte)(unsafe.Pointer(bufsArrs[i])) // Get pointer to the array
// Copy data from realPacket to the memory pointed to by bufsArrs[i]
size = len(realPacket) size = len(realPacket)
for j := 0; j < size; j++ {
*(*byte)(unsafe.Pointer(uintptr(unsafe.Pointer(packetPtr)) + uintptr(j))) = realPacket[j]
}
packet = bufsArrs[i][:size] packet = bufsArrs[i][:size]
if err != nil { if err != nil {
device.log.Verbosef( device.log.Verbosef(
@ -262,7 +256,7 @@ func (device *Device) RoutineReceiveIncoming(
default: default:
} }
} }
device.awg.aSecMux.RUnlock() device.awg.mutex.RUnlock()
for peer, elemsContainer := range elemsByPeer { for peer, elemsContainer := range elemsByPeer {
if peer.isRunning.Load() { if peer.isRunning.Load() {
peer.queue.inbound.c <- elemsContainer peer.queue.inbound.c <- elemsContainer
@ -322,7 +316,7 @@ func (device *Device) RoutineHandshake(id int) {
for elem := range device.queue.handshake.c { for elem := range device.queue.handshake.c {
device.awg.aSecMux.RLock() device.awg.mutex.RLock()
// handle cookie fields and ratelimiting // handle cookie fields and ratelimiting
@ -474,7 +468,7 @@ func (device *Device) RoutineHandshake(id int) {
peer.SendKeepalive() peer.SendKeepalive()
} }
skip: skip:
device.awg.aSecMux.RUnlock() device.awg.mutex.RUnlock()
device.PutMessageBuffer(elem.buffer) device.PutMessageBuffer(elem.buffer)
} }
} }

25
device/send.go
View file

@ -127,13 +127,14 @@ func (peer *Peer) SendHandshakeInitiation(isRetry bool) error {
) )
return err return err
} }
var sendBuffer [][]byte var sendBuffer [][]byte
// so only packet processed for cookie generation // so only packet processed for cookie generation
var junkedHeader []byte var junkedHeader []byte
if peer.device.isAdvancedSecurityOn() { if peer.device.isAdvancedSecurityOn() {
peer.device.awg.aSecMux.RLock() peer.device.awg.mutex.RLock()
junks, err := peer.device.awg.junkCreator.createJunkPackets(peer) junks, err := peer.device.awg.junkCreator.createJunkPackets(peer)
peer.device.awg.aSecMux.RUnlock() peer.device.awg.mutex.RUnlock()
if err != nil { if err != nil {
peer.device.log.Errorf("%v - %v", peer, err) peer.device.log.Errorf("%v - %v", peer, err)
@ -153,19 +154,19 @@ func (peer *Peer) SendHandshakeInitiation(isRetry bool) error {
} }
} }
peer.device.awg.aSecMux.RLock() peer.device.awg.mutex.RLock()
if peer.device.awg.aSecCfg.initPacketJunkSize != 0 { if peer.device.awg.aSecCfg.initPacketJunkSize != 0 {
buf := make([]byte, 0, peer.device.awg.aSecCfg.initPacketJunkSize) buf := make([]byte, 0, peer.device.awg.aSecCfg.initPacketJunkSize)
writer := bytes.NewBuffer(buf[:0]) writer := bytes.NewBuffer(buf[:0])
err = peer.device.awg.junkCreator.appendJunk(writer, peer.device.awg.aSecCfg.initPacketJunkSize) err = peer.device.awg.junkCreator.appendJunk(writer, peer.device.awg.aSecCfg.initPacketJunkSize)
if err != nil { if err != nil {
peer.device.log.Errorf("%v - %v", peer, err) peer.device.log.Errorf("%v - %v", peer, err)
peer.device.awg.aSecMux.RUnlock() peer.device.awg.mutex.RUnlock()
return err return err
} }
junkedHeader = writer.Bytes() junkedHeader = writer.Bytes()
} }
peer.device.awg.aSecMux.RUnlock() peer.device.awg.mutex.RUnlock()
} }
var buf [MessageInitiationSize]byte var buf [MessageInitiationSize]byte
@ -175,7 +176,7 @@ func (peer *Peer) SendHandshakeInitiation(isRetry bool) error {
peer.cookieGenerator.AddMacs(packet) peer.cookieGenerator.AddMacs(packet)
junkedHeader = append(junkedHeader, packet...) junkedHeader = append(junkedHeader, packet...)
if junkedHeader, err = peer.device.codecPacket(DefaultMessageInitiationType, junkedHeader); err != nil { if junkedHeader, err = peer.device.codecPacketIfActive(DefaultMessageInitiationType, junkedHeader); err != nil {
return err return err
} }
@ -215,19 +216,19 @@ func (peer *Peer) SendHandshakeResponse() error {
} }
var junkedHeader []byte var junkedHeader []byte
if peer.device.isAdvancedSecurityOn() { if peer.device.isAdvancedSecurityOn() {
peer.device.awg.aSecMux.RLock() peer.device.awg.mutex.RLock()
if peer.device.awg.aSecCfg.responsePacketJunkSize != 0 { if peer.device.awg.aSecCfg.responsePacketJunkSize != 0 {
buf := make([]byte, 0, peer.device.awg.aSecCfg.responsePacketJunkSize) buf := make([]byte, 0, peer.device.awg.aSecCfg.responsePacketJunkSize)
writer := bytes.NewBuffer(buf[:0]) writer := bytes.NewBuffer(buf[:0])
err = peer.device.awg.junkCreator.appendJunk(writer, peer.device.awg.aSecCfg.responsePacketJunkSize) err = peer.device.awg.junkCreator.appendJunk(writer, peer.device.awg.aSecCfg.responsePacketJunkSize)
if err != nil { if err != nil {
peer.device.awg.aSecMux.RUnlock() peer.device.awg.mutex.RUnlock()
peer.device.log.Errorf("%v - %v", peer, err) peer.device.log.Errorf("%v - %v", peer, err)
return err return err
} }
junkedHeader = writer.Bytes() junkedHeader = writer.Bytes()
} }
peer.device.awg.aSecMux.RUnlock() peer.device.awg.mutex.RUnlock()
} }
var buf [MessageResponseSize]byte var buf [MessageResponseSize]byte
writer := bytes.NewBuffer(buf[:0]) writer := bytes.NewBuffer(buf[:0])
@ -237,7 +238,7 @@ func (peer *Peer) SendHandshakeResponse() error {
peer.cookieGenerator.AddMacs(packet) peer.cookieGenerator.AddMacs(packet)
junkedHeader = append(junkedHeader, packet...) junkedHeader = append(junkedHeader, packet...)
if junkedHeader, err = peer.device.codecPacket(DefaultMessageResponseType, junkedHeader); err != nil { if junkedHeader, err = peer.device.codecPacketIfActive(DefaultMessageResponseType, junkedHeader); err != nil {
return err return err
} }
@ -286,7 +287,7 @@ func (device *Device) SendHandshakeCookie(
writer := bytes.NewBuffer(buf[:0]) writer := bytes.NewBuffer(buf[:0])
binary.Write(writer, binary.LittleEndian, reply) binary.Write(writer, binary.LittleEndian, reply)
packet := writer.Bytes() packet := writer.Bytes()
if packet, err = device.codecPacket(DefaultMessageCookieReplyType, packet); err != nil { if packet, err = device.codecPacketIfActive(DefaultMessageCookieReplyType, packet); err != nil {
return err return err
} }
@ -592,7 +593,7 @@ func (device *Device) RoutineEncryption(id int) {
nil, nil,
) )
var err error var err error
if elem.packet, err = device.codecPacket(DefaultMessageTransportType, elem.packet); err != nil { if elem.packet, err = device.codecPacketIfActive(DefaultMessageTransportType, elem.packet); err != nil {
continue continue
} }
} }

6
device/uapi.go
View file

@ -98,8 +98,8 @@ func (device *Device) IpcGetOperation(w io.Writer) error {
sendf("fwmark=%d", device.net.fwmark) sendf("fwmark=%d", device.net.fwmark)
} }
if device.awg.luaAdapter != nil { if device.awg.codec != nil {
sendf("lua_codec=%s", device.awg.luaAdapter.Base64LuaCode()) sendf("lua_codec=%s", device.awg.codec.Base64LuaCode())
} }
if device.isAdvancedSecurityOn() { if device.isAdvancedSecurityOn() {
if device.awg.aSecCfg.junkPacketCount != 0 { if device.awg.aSecCfg.junkPacketCount != 0 {
@ -290,7 +290,7 @@ func (device *Device) handleDeviceLine(key, value string, tempAwgTpe *awgType) e
case "lua_codec": case "lua_codec":
device.log.Verbosef("UAPI: Updating lua_codec") device.log.Verbosef("UAPI: Updating lua_codec")
var err error var err error
tempAwgTpe.luaAdapter, err = adapter.NewLua(adapter.LuaParams{ tempAwgTpe.codec, err = adapter.NewLua(adapter.LuaParams{
Base64LuaCode: value, Base64LuaCode: value,
}) })
if err != nil { if err != nil {