aboutsummaryrefslogtreecommitdiffstats
path: root/src (follow)
Commit message (Collapse)AuthorAgeFilesLines
* version: bumpv0.0.20210415Jason A. Donenfeld2021-04-151-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* if_wg: set multicast flagJason A. Donenfeld2021-04-151-1/+1
| | | | | | | In order to send to ff00::/8 addresses, even over unicast, the interface needs the multicast flag enabled. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* if_wg: do not allow ioctl to race with clone_destroyJason A. Donenfeld2021-04-151-10/+16
| | | | | | | | | | | | | | | | | | | | | This fixes the crash from: bash -c 'while true; do ifconfig wg0 create; ifconfig wg0 destroy; done& while true; do wg show wg0 > /dev/null 2>&1; done& wait' Since we're setting ifp to NULL here, we also have to account for multicast v6 packets being transmitted during destroy, which can be triggered by: ifconfig wg0 create ifconfig wg0 inet6 fe80::1234/120 ifconfig wg0 up route add -inet6 ff02::1:0/120 -iface wg0 ifconfig wg0 destroy These are unfixed upstream bug that we're working around. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* if_wg: don't check return value of WAITOKJason A. Donenfeld2021-04-151-4/+0
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* if_wg: allow debugging with `ifconfig wg0 debug`Jason A. Donenfeld2021-04-131-8/+2
| | | | | | This is better than a custom sysctl. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* if_wg: remove peer marshalling from get requestJason A. Donenfeld2021-04-131-307/+94
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* version: bumpv0.0.20210412Jason A. Donenfeld2021-04-121-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* if_wg: set user cookie and fib through proper sockoptsJason A. Donenfeld2021-04-121-20/+44
| | | | | | | By taking shortcuts we were circumventing important hooks. Reported-by: Frank Behrens <frank@harz.behrens.de> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* if_wg: allow getting tunnelfib to raceJason A. Donenfeld2021-03-241-2/+0
| | | | | | | It's word-sized, anyway, and taking the lock means crashes when moving around vnets. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* if_wg: simplify jail exit logicJason A. Donenfeld2021-03-241-30/+9
| | | | | | | | | We already handle vnet stuff on wg_reassign, and handling it here means that everytime we toggle any jail that shares the vnet, we render the link useless. Reported-by: Matt Smith <matt.r.smith@bt.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* if_wg: remove old link state checkJason A. Donenfeld2021-03-241-3/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* if_wg: set persistent keepalive even if interface is downJason A. Donenfeld2021-03-241-3/+4
| | | | | Reported-by: Raúl Munoz <raul.munoz@custos.es> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* version: bumpv0.0.20210323Jason A. Donenfeld2021-03-231-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* if_wg: disable llv6Jason A. Donenfeld2021-03-231-0/+5
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* if_wg: drop pointtopoint flagJason A. Donenfeld2021-03-231-1/+1
| | | | | | We'll try to work around this in wg-quick(8) and see what happens. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* if_wg: fix decryption failures on jumbo ingressJason A. Donenfeld2021-03-231-5/+27
| | | | | | | All of this allocation_order and copying garbage needs to go away by making the crypto take scatter gather lists. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* if_wg: implement selection of FIB (routing table) for tunneled packetsFrank Behrens2021-03-221-0/+37
| | | | | | | | | | | | | | The outgoing, encrypted packets can use a specified FIB and therefore utilize specific (default) routes. The implementation follows the existing convention for other tunnel interfaces and reuses some code from gre(4) implementation. The FIB for wg(4) interface is set by standard ifconfig(8) with parameter "tunnelfib", e.g. "ifconfig wg0 tunnelfib 1". Signed-off-by: Frank Behrens <frank@harz.behrens.de> [Jason: rewritten to avoid sosockopt and simplify] Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg_noise: ensure non-zero'd handshakes have a valid local indexMatt Dunwoodie2021-03-221-4/+3
| | | | | | | | | | | | | | | | As reported by: https://marc.info/?l=openbsd-bugs&m=161618496905444&w=2 In particular, when consuming an initiation, we don't generate the index until creating the response (which is incorrect). If we attempt to create an initiation between these processes, we drop any outstanding handshake which in this case has index 0 as set when consuming the initiation. The fix attached is to generate the index when consuming the initiation so that any spurious initiation creation can drop a valid index. The patch also consolidates setting fields on the handshake. Signed-off-by: Matt Dunwoodie <ncon@noconroy.net>
* compat: backport callout_func_t to 12.1Jason A. Donenfeld2021-03-191-0/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* if_wg: do not check for null M_NOWAIT returnJason A. Donenfeld2021-03-191-8/+0
| | | | | Reported-by: Kyle Evans <kevans@freebsd.org> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* version: bumpv0.0.20210319Jason A. Donenfeld2021-03-191-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: backport properly to 13Jason A. Donenfeld2021-03-191-30/+30
| | | | | | | Turns out that taskqgroup_drain_all is new in 14. Reported-by: Evilham <contact@evilham.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* if_wg: cleanup timeout_t usageJason A. Donenfeld2021-03-191-11/+7
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* if_wg: mark as point to pointJason A. Donenfeld2021-03-191-1/+1
| | | | | | | | | | It's technically point to multipoint. Also, clear the multicast and broadcast flags. This _could_ cause problems, but hopefully not. This should fix issues with receiving incoming connections. Reported-by: Ashish <ashish.is@lostca.se> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* if_wg: dispatch packets using netisrJason A. Donenfeld2021-03-191-13/+18
| | | | | | Nothing else uses ip_input directly. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* if_wg: fix malloc overflowsJason A. Donenfeld2021-03-191-19/+38
| | | | | | | | | | | These should have been fixed during our initial pass but somehow weren't. Good thing we have more time to work on this. Note that all the exporting and marshalling intermediate structs are going to have to be thrown out at some point, as this whole dance here still allocates tons of kernel memory needlessly. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: backport to FreeBSD 12.1Jason A. Donenfeld2021-03-181-0/+17
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: backport to FreeBSD 12.2Jason A. Donenfeld2021-03-186-25/+94
| | | | | | | | | | | | | | | This should allow us to get more testing coverage earlier. This port here is also a bit janky. I really don't like the taskqgroup business, having to copy and paste those structs. And this isn't well tested, either. But, it's a start. This distinguishes between compat.h and support.h, though both header files are intended to operate in more or less the same way. It's important to keep some discipline between things that we're backporting and things that aren't _yet_ upstream or are shims for OpenBSD. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* if_wg: use our own taskqgroupJason A. Donenfeld2021-03-171-18/+19
| | | | | | | | Rather than relying on the iflib one, which not everyone has available, define our own. Reported-by: Frank Behrens <frank@harz.behrens.de> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* version: bumpv0.0.20210317Jason A. Donenfeld2021-03-172-1/+3
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* support: prepare for out of tree buildsJason A. Donenfeld2021-03-173-3/+36
| | | | | | | This involves weird backporting things. Hopefully support.c here is not as bad as compat.h on Linux. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* Initial importJason A. Donenfeld2021-03-1710-0/+7025
There's still more to do with wiring this up properly. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.