VPN improvements

cmd/apps/vpn-client/vpn-client.go

@@ -37,25 +37,10 @@ var (
 	r   = netutil.NewRetrier(log, serverDialInitBO, serverDialMaxBO, 0, 1)
 )
 
-var serverPKStr = flag.String("srv", "", "PubKey of the server to connect to")
-
-func dialServer(appCl *app.Client, pk cipher.PubKey) (net.Conn, error) {
-	var conn net.Conn
-	err := r.Do(context.Background(), func() error {
-		var err error
-		conn, err = appCl.Dial(appnet.Addr{
-			Net:    netType,
-			PubKey: pk,
-			Port:   vpnPort,
-		})
-		return err
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	return conn, nil
-}
+var (
+	serverPKStr = flag.String("srv", "", "PubKey of the server to connect to")
+	passcode    = flag.String("passcode", "", "Passcode to authenticate connection")
+)
 
 func main() {
 	flag.Parse()
@@ -96,7 +81,10 @@ func main() {
 
 	log.Infof("Dialed %s", appConn.RemoteAddr())
 
-	vpnClient, err := vpn.NewClient(log, appConn)
+	vpnClientCfg := vpn.ClientConfig{
+		Passcode: *passcode,
+	}
+	vpnClient, err := vpn.NewClient(vpnClientCfg, log, appConn)
 	if err != nil {
 		log.WithError(err).Fatalln("Error creating VPN client")
 	}
@@ -116,3 +104,21 @@ func main() {
 		log.WithError(err).Fatalln("Error serving VPN")
 	}
 }
+
+func dialServer(appCl *app.Client, pk cipher.PubKey) (net.Conn, error) {
+	var conn net.Conn
+	err := r.Do(context.Background(), func() error {
+		var err error
+		conn, err = appCl.Dial(appnet.Addr{
+			Net:    netType,
+			PubKey: pk,
+			Port:   vpnPort,
+		})
+		return err
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return conn, nil
+}

cmd/apps/vpn-server/vpn-server.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"flag"
 	"fmt"
 	"os"
 	"os/signal"
@@ -25,7 +26,13 @@ var (
 	log = app.NewLogger(appName)
 )
 
+var (
+	passcode = flag.String("passcode", "", "Passcode to authenticate connecting users")
+)
+
 func main() {
+	flag.Parse()
+
 	appCfg, err := app.ClientConfigFromEnv()
 	if err != nil {
 		log.WithError(err).Errorln("Error getting app client config")
@@ -56,7 +63,10 @@ func main() {
 
 	log.Infof("Got app listener, bound to %d", vpnPort)
 
-	srv, err := vpn.NewServer(log)
+	srvCfg := vpn.ServerConfig{
+		Passcode: *passcode,
+	}
+	srv, err := vpn.NewServer(srvCfg, log)
 	if err != nil {
 		log.WithError(err).Fatalln("Error creating VPN server")
 	}

cmd/skywire-cli/commands/visor/gen-config.go

@@ -132,8 +132,8 @@ func defaultConfig() *visor.Config {
 		defaultSkychatConfig(),
 		defaultSkysocksConfig(""),
 		defaultSkysocksClientConfig(),
-		defaultVPNServerConfig(),
-		defaultVPNClientConfig(),
+		defaultVPNServerConfig(""),
+		defaultVPNClientConfig(""),
 	}
 
 	conf.TrustedVisors = []cipher.PubKey{}
@@ -210,18 +210,30 @@ func defaultSkysocksClientConfig() visor.AppConfig {
 	}
 }
 
-func defaultVPNServerConfig() visor.AppConfig {
+func defaultVPNServerConfig(passcode string) visor.AppConfig {
+	var args []string
+	if passcode != "" {
+		args = []string{"-passcode", passcode}
+	}
+
 	return visor.AppConfig{
 		App:       skyenv.VPNServerName,
 		AutoStart: true,
 		Port:      routing.Port(skyenv.VPNServerPort),
+		Args:      args,
 	}
 }
 
-func defaultVPNClientConfig() visor.AppConfig {
+func defaultVPNClientConfig(passcode string) visor.AppConfig {
+	var args []string
+	if passcode != "" {
+		args = []string{"-passcode", passcode}
+	}
+
 	return visor.AppConfig{
 		App:       skyenv.VPNClientName,
 		AutoStart: false,
 		Port:      routing.Port(skyenv.VPNClientPort),
+		Args:      args,
 	}
 }

internal/vpn/client.go

@@ -21,6 +21,7 @@ const (
 
 // Client is a VPN client.
 type Client struct {
+	cfg            ClientConfig
 	log            *logging.MasterLogger
 	conn           net.Conn
 	directIPs      []net.IP
@@ -30,7 +31,7 @@ type Client struct {
 }
 
 // NewClient creates VPN client instance.
-func NewClient(l *logging.MasterLogger, conn net.Conn) (*Client, error) {
+func NewClient(cfg ClientConfig, l *logging.MasterLogger, conn net.Conn) (*Client, error) {
 	dmsgDiscIP, err := dmsgDiscIPFromEnv()
 	if err != nil {
 		return nil, fmt.Errorf("error getting Dmsg discovery IP: %w", err)
@@ -69,6 +70,7 @@ func NewClient(l *logging.MasterLogger, conn net.Conn) (*Client, error) {
 	l.Infof("Got default network gateway IP: %s", defaultGateway)
 
 	return &Client{
+		cfg:            cfg,
 		log:            l,
 		conn:           conn,
 		directIPs:      directIPs,
@@ -92,7 +94,7 @@ func (c *Client) Serve() error {
 		DeviceType: water.TUN,
 	})
 	if err != nil {
-		return fmt.Errorf("error allocating TUN interace: %w", err)
+		return fmt.Errorf("error allocating TUN interface: %w", err)
 	}
 	defer func() {
 		tunName := tun.Name()
@@ -275,6 +277,7 @@ func (c *Client) shakeHands() (TUNIP, TUNGateway net.IP, err error) {
 
 	cHello := ClientHello{
 		UnavailablePrivateIPs: unavailableIPs,
+		Passcode:              c.cfg.Passcode,
 	}
 
 	c.log.Debugf("Sending client hello: %v", cHello)

internal/vpn/client_config.go

@@ -0,0 +1,6 @@
+package vpn
+
+// ClientConfig is a configuration for VPN client.
+type ClientConfig struct {
+	Passcode string
+}

internal/vpn/client_hello.go

@@ -5,4 +5,5 @@ import "net"
 // ClientHello is a message sent by client during the Client/Server handshake.
 type ClientHello struct {
 	UnavailablePrivateIPs []net.IP `json:"unavailable_private_ips"`
+	Passcode              string   `json:"passcode"`
 }

internal/vpn/handshake_status.go

@@ -12,6 +12,8 @@ const (
 	HandshakeNoFreeIPs
 	// HandshakeStatusInternalError is returned in all other cases when some server error occurred.
 	HandshakeStatusInternalError
+	// HandshakeStatusForbidden is returned if client had sent the wrong passcode.
+	HandshakeStatusForbidden
 )
 
 func (hs HandshakeStatus) String() string {
@@ -24,6 +26,8 @@ func (hs HandshakeStatus) String() string {
 		return "No free IPs left to serve"
 	case HandshakeStatusInternalError:
 		return "Internal server error"
+	case HandshakeStatusForbidden:
+		return "Forbidden"
 	default:
 		return "Unknown code"
 	}

internal/vpn/server.go

@@ -13,6 +13,7 @@ import (
 
 // Server is a VPN server.
 type Server struct {
+	cfg                     ServerConfig
 	lisMx                   sync.Mutex
 	lis                     net.Listener
 	log                     *logging.MasterLogger
@@ -24,7 +25,7 @@ type Server struct {
 }
 
 // NewServer creates VPN server instance.
-func NewServer(l *logging.MasterLogger) (*Server, error) {
+func NewServer(cfg ServerConfig, l *logging.MasterLogger) (*Server, error) {
 	defaultNetworkIfc, err := DefaultNetworkInterface()
 	if err != nil {
 		return nil, fmt.Errorf("error getting default network interface: %w", err)
@@ -45,6 +46,7 @@ func NewServer(l *logging.MasterLogger) (*Server, error) {
 	l.Infof("IPv4: %s, IPv6: %s", ipv4ForwardingVal, ipv6ForwardingVal)
 
 	return &Server{
+		cfg:                     cfg,
 		log:                     l,
 		ipGen:                   NewIPGenerator(),
 		defaultNetworkInterface: defaultNetworkIfc,
@@ -199,6 +201,15 @@ func (s *Server) shakeHands(conn net.Conn) (tunIP, tunGateway net.IP, err error)
 
 	var sHello ServerHello
 
+	if s.cfg.Passcode != "" && cHello.Passcode != s.cfg.Passcode {
+		sHello.Status = HandshakeStatusForbidden
+		if err := WriteJSON(conn, &sHello); err != nil {
+			s.log.WithError(err).Errorln("Error sending server hello")
+		}
+
+		return nil, nil, errors.New("got wrong passcode from client")
+	}
+
 	for _, ip := range cHello.UnavailablePrivateIPs {
 		if err := s.ipGen.Reserve(ip); err != nil {
 			// this happens only on malformed IP

internal/vpn/server_config.go

@@ -0,0 +1,6 @@
+package vpn
+
+// ServerConfig is a configuration for VPN server.
+type ServerConfig struct {
+	Passcode string
+}

pkg/hypervisor/hypervisor.go

@@ -395,22 +395,15 @@ func (hv *Hypervisor) putApp() http.HandlerFunc {
 			}
 		}
 
-		const (
-			skysocksName       = "skysocks"
-			skysocksClientName = "skysocks-client"
-		)
-
-		if reqBody.Passcode != nil && ctx.App.App == skysocksName {
-			if err := ctx.RPC.SetSocksPassword(*reqBody.Passcode); err != nil {
+		if reqBody.Passcode != nil {
+			if err := ctx.RPC.SetAppPassword(ctx.App.App, *reqBody.Passcode); err != nil {
 				httputil.WriteJSON(w, r, http.StatusInternalServerError, err)
 				return
 			}
 		}
 
-		if reqBody.PK != nil && ctx.App.App == skysocksClientName {
-			log.Errorf("SETTING PK: %s", *reqBody.PK)
-			if err := ctx.RPC.SetSocksClientPK(*reqBody.PK); err != nil {
-				log.Errorf("ERROR SETTING PK")
+		if reqBody.PK != nil {
+			if err := ctx.RPC.SetAppPK(ctx.App.App, *reqBody.PK); err != nil {
 				httputil.WriteJSON(w, r, http.StatusInternalServerError, err)
 				return
 			}
@@ -425,7 +418,6 @@ func (hv *Hypervisor) putApp() http.HandlerFunc {
 				}
 			case statusStart:
 				if err := ctx.RPC.StartApp(ctx.App.App); err != nil {
-					log.Errorf("ERROR STARTING APP")
 					httputil.WriteJSON(w, r, http.StatusInternalServerError, err)
 					return
 				}

pkg/visor/rpc.go

@@ -234,18 +234,30 @@ func (r *RPC) SetAutoStart(in *SetAutoStartIn, _ *struct{}) (err error) {
 	return r.visor.setAutoStart(in.AppName, in.AutoStart)
 }
 
-// SetSocksPassword sets password for skysocks.
-func (r *RPC) SetSocksPassword(in *string, _ *struct{}) (err error) {
-	defer rpcutil.LogCall(r.log, "SetSocksPassword", in)(nil, &err)
+// SetAppPasswordIn is input for SetAppPassword.
+type SetAppPasswordIn struct {
+	AppName  string
+	Password string
+}
+
+// SetAppPassword sets password for the app.
+func (r *RPC) SetAppPassword(in *SetAppPasswordIn, _ *struct{}) (err error) {
+	defer rpcutil.LogCall(r.log, "SetAppPassword", in)(nil, &err)
+
+	return r.visor.setAppPassword(in.AppName, in.Password)
+}
 
-	return r.visor.setSocksPassword(*in)
+// SetAppPKIn is input for SetAppPK.
+type SetAppPKIn struct {
+	AppName string
+	PK      cipher.PubKey
 }
 
-// SetSocksClientPK sets PK for skysocks-client.
-func (r *RPC) SetSocksClientPK(in *cipher.PubKey, _ *struct{}) (err error) {
-	defer rpcutil.LogCall(r.log, "SetSocksClientPK", in)(nil, &err)
+// SetAppPK sets PK for the app.
+func (r *RPC) SetAppPK(in *SetAppPKIn, _ *struct{}) (err error) {
+	defer rpcutil.LogCall(r.log, "SetAppPK", in)(nil, &err)
 
-	return r.visor.setSocksClientPK(*in)
+	return r.visor.setAppPK(in.AppName, in.PK)
 }
 
 /*

pkg/visor/rpc_client.go

@@ -45,8 +45,8 @@ type RPCClient interface {
 	StartApp(appName string) error
 	StopApp(appName string) error
 	SetAutoStart(appName string, autostart bool) error
-	SetSocksPassword(password string) error
-	SetSocksClientPK(pk cipher.PubKey) error
+	SetAppPassword(appName, password string) error
+	SetAppPK(appName string, pk cipher.PubKey) error
 	LogsSince(timestamp time.Time, appName string) ([]string, error)
 
 	TransportTypes() ([]string, error)
@@ -157,14 +157,20 @@ func (rc *rpcClient) SetAutoStart(appName string, autostart bool) error {
 	}, &struct{}{})
 }
 
-// SetSocksPassword calls SetSocksPassword.
-func (rc *rpcClient) SetSocksPassword(password string) error {
-	return rc.Call("SetSocksPassword", &password, &struct{}{})
+// SetAppPassword calls SetAppPassword.
+func (rc *rpcClient) SetAppPassword(appName, password string) error {
+	return rc.Call("SetAppPassword", &SetAppPasswordIn{
+		AppName:  appName,
+		Password: password,
+	}, &struct{}{})
 }
 
-// SetSocksClientPK calls SetSocksClientPK.
-func (rc *rpcClient) SetSocksClientPK(pk cipher.PubKey) error {
-	return rc.Call("SetSocksClientPK", &pk, &struct{}{})
+// SetAppPK calls SetAppPK.
+func (rc *rpcClient) SetAppPK(appName string, pk cipher.PubKey) error {
+	return rc.Call("SetSocksClientPK", &SetAppPKIn{
+		AppName: appName,
+		PK:      pk,
+	}, &struct{}{})
 }
 
 // LogsSince calls LogsSince
@@ -481,8 +487,8 @@ func (mc *mockRPCClient) SetAutoStart(appName string, autostart bool) error {
 	})
 }
 
-// SetSocksPassword implements RPCClient.
-func (mc *mockRPCClient) SetSocksPassword(string) error {
+// SetAppPassword implements RPCClient.
+func (mc *mockRPCClient) SetAppPassword(string, string) error {
 	return mc.do(true, func() error {
 		const socksName = "skysocks"
 
@@ -496,8 +502,8 @@ func (mc *mockRPCClient) SetSocksPassword(string) error {
 	})
 }
 
-// SetSocksClientPK implements RPCClient.
-func (mc *mockRPCClient) SetSocksClientPK(cipher.PubKey) error {
+// SetAppPK implements RPCClient.
+func (mc *mockRPCClient) SetAppPK(string, cipher.PubKey) error {
 	return mc.do(true, func() error {
 		const socksName = "skysocks-client"