| 232 | } |
| 233 | |
| 234 | func (device *Device) SetPrivateKey(sk NoisePrivateKey) error { |
| 235 | // lock required resources |
| 236 | |
| 237 | device.staticIdentity.Lock() |
| 238 | defer device.staticIdentity.Unlock() |
| 239 | |
| 240 | if sk.Equals(device.staticIdentity.privateKey) { |
| 241 | return nil |
| 242 | } |
| 243 | |
| 244 | device.peers.Lock() |
| 245 | defer device.peers.Unlock() |
| 246 | |
| 247 | lockedPeers := make([]*Peer, 0, len(device.peers.keyMap)) |
| 248 | for _, peer := range device.peers.keyMap { |
| 249 | peer.handshake.mutex.RLock() |
| 250 | lockedPeers = append(lockedPeers, peer) |
| 251 | } |
| 252 | |
| 253 | // remove peers with matching public keys |
| 254 | |
| 255 | publicKey := sk.publicKey() |
| 256 | for key, peer := range device.peers.keyMap { |
| 257 | if peer.handshake.remoteStatic.Equals(publicKey) { |
| 258 | peer.handshake.mutex.RUnlock() |
| 259 | removePeerLocked(device, peer, key) |
| 260 | peer.handshake.mutex.RLock() |
| 261 | } |
| 262 | } |
| 263 | |
| 264 | // update key material |
| 265 | |
| 266 | device.staticIdentity.privateKey = sk |
| 267 | device.staticIdentity.publicKey = publicKey |
| 268 | device.cookieChecker.Init(publicKey) |
| 269 | |
| 270 | // do static-static DH pre-computations |
| 271 | |
| 272 | expiredPeers := make([]*Peer, 0, len(device.peers.keyMap)) |
| 273 | for _, peer := range device.peers.keyMap { |
| 274 | handshake := &peer.handshake |
| 275 | handshake.precomputedStaticStatic, _ = device.staticIdentity.privateKey.sharedSecret(handshake.remoteStatic) |
| 276 | expiredPeers = append(expiredPeers, peer) |
| 277 | } |
| 278 | |
| 279 | for _, peer := range lockedPeers { |
| 280 | peer.handshake.mutex.RUnlock() |
| 281 | } |
| 282 | for _, peer := range expiredPeers { |
| 283 | peer.ExpireCurrentKeypairs() |
| 284 | } |
| 285 | |
| 286 | return nil |
| 287 | } |
| 288 | |
| 289 | func NewDevice(tunDevice tun.Device, bind conn.Bind, logger *Logger) *Device { |
| 290 | device := new(Device) |