noise: immediately rekey all peers after changing device private key

Reported-by: Derrick Pallas <[email protected]>

Author: zx2c4

src/device.c

@@ -112,9 +112,7 @@ static int wg_stop(struct net_device *dev)
 		wg_timers_stop(peer);
 		wg_noise_handshake_clear(&peer->handshake);
 		wg_noise_keypairs_clear(&peer->keypairs);
-		atomic64_set(&peer->last_sent_handshake,
-			     ktime_get_coarse_boottime_ns() -
-				     (u64)(REKEY_TIMEOUT + 1) * NSEC_PER_SEC);
+		wg_noise_reset_last_sent_handshake(&peer->last_sent_handshake);
 	}
 	mutex_unlock(&wg->device_update_lock);
 	skb_queue_purge(&wg->incoming_handshakes);

src/netlink.c

@@ -13,6 +13,7 @@
 #include <linux/if.h>
 #include <net/genetlink.h>
 #include <net/sock.h>
+#include <crypto/algapi.h>
 
 static struct genl_family genl_family;
 
@@ -546,6 +547,10 @@ static int wg_set_device(struct sk_buff *skb, struct genl_info *info)
 		u8 public_key[NOISE_PUBLIC_KEY_LEN];
 		struct wg_peer *peer, *temp;
 
+		if (!crypto_memneq(wg->static_identity.static_private,
+				   private_key, NOISE_PUBLIC_KEY_LEN))
+			goto skip_set_private_key;
+
 		/* We remove before setting, to prevent race, which means doing
 		 * two 25519-genpub ops.
 		 */
@@ -563,12 +568,15 @@ static int wg_set_device(struct sk_buff *skb, struct genl_info *info)
 							 private_key);
 		list_for_each_entry_safe(peer, temp, &wg->peer_list,
 					 peer_list) {
-			if (!wg_noise_precompute_static_static(peer))
+			if (wg_noise_precompute_static_static(peer))
+				wg_noise_expire_current_peer_keypairs(peer);
+			else
 				wg_peer_remove(peer);
 		}
 		wg_cookie_checker_precompute_device_keys(&wg->cookie_checker);
 		up_write(&wg->static_identity.lock);
 	}
+skip_set_private_key:
 
 	if (info->attrs[WGDEVICE_A_PEERS]) {
 		struct nlattr *attr, *peer[WGPEER_A_MAX + 1];

src/noise.c

@@ -183,6 +183,29 @@ void wg_noise_keypairs_clear(struct noise_keypairs *keypairs)
 	spin_unlock_bh(&keypairs->keypair_update_lock);
 }
 
+static void rekey_sending_keypair(struct noise_keypair *keypair)
+{
+	u64 rekey_ns = ktime_get_coarse_boottime_ns() -
+			(u64)(REKEY_AFTER_TIME + 1) * NSEC_PER_SEC;
+	if ((s64)rekey_ns < (s64)keypair->sending.birthdate)
+		keypair->sending.birthdate = rekey_ns;
+}
+
+void wg_noise_expire_current_peer_keypairs(struct wg_peer *peer)
+{
+	wg_noise_handshake_clear(&peer->handshake);
+	wg_noise_reset_last_sent_handshake(&peer->last_sent_handshake);
+
+	spin_lock_bh(&peer->keypairs.keypair_update_lock);
+	rekey_sending_keypair(
+		rcu_dereference_protected(peer->keypairs.next_keypair,
+			lockdep_is_held(&peer->keypairs.keypair_update_lock)));
+	rekey_sending_keypair(
+		rcu_dereference_protected(peer->keypairs.current_keypair,
+			lockdep_is_held(&peer->keypairs.keypair_update_lock)));
+	spin_unlock_bh(&peer->keypairs.keypair_update_lock);
+}
+
 static void add_new_keypair(struct noise_keypairs *keypairs,
 			    struct noise_keypair *new_keypair)
 {

src/noise.h

@@ -100,11 +100,18 @@ bool wg_noise_handshake_init(struct noise_handshake *handshake,
 			   const u8 peer_preshared_key[NOISE_SYMMETRIC_KEY_LEN],
 			   struct wg_peer *peer);
 void wg_noise_handshake_clear(struct noise_handshake *handshake);
+static inline void wg_noise_reset_last_sent_handshake(atomic64_t *handshake_ns)
+{
+	atomic64_set(handshake_ns, ktime_get_coarse_boottime_ns() -
+				       (u64)(REKEY_TIMEOUT + 1) * NSEC_PER_SEC);
+}
+
 void wg_noise_keypair_put(struct noise_keypair *keypair, bool unreference_now);
 struct noise_keypair *wg_noise_keypair_get(struct noise_keypair *keypair);
 void wg_noise_keypairs_clear(struct noise_keypairs *keypairs);
 bool wg_noise_received_with_keypair(struct noise_keypairs *keypairs,
 				    struct noise_keypair *received_keypair);
+void wg_noise_expire_current_peer_keypairs(struct wg_peer *peer);
 
 void wg_noise_set_static_identity_private_key(
 	struct noise_static_identity *static_identity,

src/peer.c

@@ -56,9 +56,7 @@ struct wg_peer *wg_peer_create(struct wg_device *wg,
 	rwlock_init(&peer->endpoint_lock);
 	kref_init(&peer->refcount);
 	skb_queue_head_init(&peer->staged_packet_queue);
-	atomic64_set(&peer->last_sent_handshake,
-		     ktime_get_coarse_boottime_ns() -
-			     (u64)(REKEY_TIMEOUT + 1) * NSEC_PER_SEC);
+	wg_noise_reset_last_sent_handshake(&peer->last_sent_handshake);
 	set_bit(NAPI_STATE_NO_BUSY_POLL, &peer->napi.state);
 	netif_napi_add(wg->dev, &peer->napi, wg_packet_rx_poll,
 		       NAPI_POLL_WEIGHT);