log wireguard client connection

[vincentmli]

someone posted question asking how to log wireguard client connection events, ebpf fentry/fexit might be able to achieve that without running wireguard in debug mode
https://www.procustodibus.com/blog/2021/03/wireguard-logs/

[vincentmli]

static void wg_receive_handshake_packet(struct wg_device *wg,
                                        struct sk_buff *skb)
{
…

        case cpu_to_le32(MESSAGE_HANDSHAKE_INITIATION): {
                struct message_handshake_initiation *message =
                        (struct message_handshake_initiation *)skb->data;

                if (packet_needs_cookie) {
                        wg_packet_send_handshake_cookie(wg, skb,
                                                        message->sender_index);
                        return;
                }
                peer = wg_noise_handshake_consume_initiation(message, wg);
                if (unlikely(!peer)) {
                        net_dbg_skb_ratelimited("%s: Invalid handshake initiation from %pISpfsc\n",
                                                wg->dev->name, skb);
                        return;
                }
                wg_socket_set_peer_endpoint_from_skb(peer, skb); <====HERE SET PEER
                net_dbg_ratelimited("%s: Receiving handshake initiation from peer %llu (%pISpfsc)\n",
                                    wg->dev->name, peer->internal_id,
                                    &peer->endpoint.addr);
                wg_packet_send_handshake_response(peer);
…
}

And wg_socket_set_peer_endpoint_from_skb is in available_filter_functions

[root@loongfire ~]# grep 'wg_socket_set_peer_endpoint' /sys/kernel/debug/tracing/available_filter_functions
wg_socket_set_peer_endpoint [wireguard]
wg_socket_set_peer_endpoint_from_skb [wireguard]

void wg_socket_set_peer_endpoint(struct wg_peer *peer,
                                 const struct endpoint *endpoint)
{
        /* First we check unlocked, in order to optimize, since it's pretty rare
         * that an endpoint will change. If we happen to be mid-write, and two
         * CPUs wind up writing the same thing or something slightly different,
         * it doesn't really matter much either.
         */
        if (endpoint_eq(endpoint, &peer->endpoint))
                return;
        write_lock_bh(&peer->endpoint_lock);
        if (endpoint->addr.sa_family == AF_INET) {
                peer->endpoint.addr4 = endpoint->addr4;
                peer->endpoint.src4 = endpoint->src4;
                peer->endpoint.src_if4 = endpoint->src_if4;
        } else if (IS_ENABLED(CONFIG_IPV6) && endpoint->addr.sa_family == AF_INET6) {
                peer->endpoint.addr6 = endpoint->addr6;
                peer->endpoint.src6 = endpoint->src6;
        } else {
                goto out;
        }
        dst_cache_reset(&peer->endpoint_cache);
out:
        write_unlock_bh(&peer->endpoint_lock);
}

void wg_socket_set_peer_endpoint_from_skb(struct wg_peer *peer,
                                          const struct sk_buff *skb)
{
        struct endpoint endpoint;

        if (!wg_socket_endpoint_from_skb(&endpoint, skb))
                wg_socket_set_peer_endpoint(peer, &endpoint);
}

So probably fentry on wg_socket_set_peer_endpoint would get the peer info in handshake