aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/src/compat/compat.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
* compat: drop CentOS 8 Stream supportHEADmasterJason A. Donenfeld2022-06-291-4/+1
| | | | | | | | | | | | Nobody uses this and it's impossible to maintain given the current CI situation. RHEL 7 and 8 release remain for now, though that might not always be the case. See the link for details. Link: https://lists.zx2c4.com/pipermail/wireguard/2022-June/007664.html Suggested-by: Philip J. Perry <phil@elrepo.org> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: do not backport ktime_get_coarse_boottime_ns to c8sJason A. Donenfeld2022-06-281-2/+2
| | | | | | | Also bump the c8s version stamp. Reported-by: Vladimír Beneš <vbenes@redhat.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: handle backported rng and blake2sJason A. Donenfeld2022-06-221-5/+7
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: drop Ubuntu 14.04Jason A. Donenfeld2021-12-131-6/+4
| | | | | | | It's been over a year since we announced sunsetting this. Link: https://lore.kernel.org/wireguard/CAHmME9rckipsdZYW+LA=x6wCMybdFFA+VqoogFXnR=kHYiCteg@mail.gmail.com/T Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ratelimiter: use kvcalloc() instead of kvzalloc()Gustavo A. R. Silva2021-12-031-0/+22
| | | | | | | Use 2-factor argument form kvcalloc() instead of kvzalloc(). Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* device: reset peer src endpoint when netns exitsJason A. Donenfeld2021-12-031-0/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Each peer's endpoint contains a dst_cache entry that takes a reference to another netdev. When the containing namespace exits, we take down the socket and prevent future sockets from being created (by setting creating_net to NULL), which removes that potential reference on the netns. However, it doesn't release references to the netns that a netdev cached in dst_cache might be taking, so the netns still might fail to exit. Since the socket is gimped anyway, we can simply clear all the dst_caches (by way of clearing the endpoint src), which will release all references. However, the current dst_cache_reset function only releases those references lazily. But it turns out that all of our usages of wg_socket_clear_peer_endpoint_src are called from contexts that are not exactly high-speed or bottle-necked. For example, when there's connection difficulty, or when userspace is reconfiguring the interface. And in particular for this patch, when the netns is exiting. So for those cases, it makes more sense to call dst_release immediately. For that, we add a small helper function to dst_cache. This patch also adds a test to netns.sh from Hangbin Liu to ensure this doesn't regress. Test-by: Hangbin Liu <liuhangbin@gmail.com> Reported-by: Xiumei Mu <xmu@redhat.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: update for RHEL 8.5Peter Georg2021-12-031-2/+2
| | | | | | | | RHEL 8.5 has been released. Replace all ISCENTOS8S checks with ISRHEL8. Increase RHEL_MINOR for CentOS 8 Stream detection to 6. Signed-off-by: Peter Georg <peter.georg@physik.uni-regensburg.de> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: account for grsecurity backports and changesMathias Krause2021-08-081-1/+7
| | | | | | | | | | | | | | | | | | | | | | grsecurity kernels tend to carry additional backports and changes, like commit b60b87fc2996 ("netlink: add ethernet address policy types") or the SYM_FUNC_* changes. RAP nowadays hooks the latter, therefore no diversion to RAP_ENTRY is needed any more. Instead of relying on the kernel version test, also test for the macros we're about to define to not already be defined to account for these additional changes in the grsecurity patch without breaking compatibility to the older public ones. Also test for CONFIG_PAX instead of RAP_PLUGIN for the timer API related changes as these don't depend on the RAP plugin to be enabled but just a PaX/grsecurity patch to be applied. While there is no preprocessor knob for the latter, use CONFIG_PAX as this will likely be enabled in every kernel that uses the patch. Signed-off-by: Mathias Krause <minipli@grsecurity.net> [zx2c4: small changes to include a header nearby a macro def test] Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: account for latest c8s backportsJason A. Donenfeld2021-06-151-3/+3
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* Revert "compat: skb_mark_not_on_list will be backported to Ubuntu 18.04"Thadeu Lima de Souza Cascardo2021-04-231-1/+1
| | | | | | | | | | | | | | | | This reverts commit cad80597c7947f0def83caf8cb56aff0149c83a8. Because this commit has not been backported so far, due to the implications of building Ubuntu's backport of wireguard in a timely manner. For now, reverting this fix would allow wireguard-linux-compat CI to work on Ubuntu 18.04. A different fix or the same one can be applied again when the time is right. Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: update and improve detection of CentOS Stream 8Peter Georg2021-04-221-1/+1
| | | | | | | | | | CentOS Stream 8 by now (4.18.0-301.1.el8) reports RHEL_MINOR=5. The current RHEL 8 minor release is still 3. RHEL 8.4 is in beta. Replace equal comparison by greater equal to (hopefully) be a little bit more future proof. Signed-off-by: Peter Georg <peter.georg@physik.uni-regensburg.de> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: icmp_ndo_send functions were backported extensivelyJason A. Donenfeld2021-03-071-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: zero out skb->cb before icmpJason A. Donenfeld2021-02-191-4/+16
| | | | | | | This corresponds to the fancier upstream commit that's still on lkml, which passes a zeroed ip_options struct to __icmp_send. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: skb_mark_not_on_list will be backported to Ubuntu 18.04Thadeu Lima de Souza Cascardo2021-02-181-1/+1
| | | | | | | | | linux commit 22f6bbb7bcfcef0b373b0502a7ff390275c575dd ("net: use skb_list_del_init() to remove from RX sublists") will be backported to Ubuntu 18.04 default kernel, which is based on linux 4.15. Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* queueing: get rid of per-peer ring buffersJason A. Donenfeld2021-02-181-0/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Having two ring buffers per-peer means that every peer results in two massive ring allocations. On an 8-core x86_64 machine, this commit reduces the per-peer allocation from 18,688 bytes to 1,856 bytes, which is an 90% reduction. Ninety percent! With some single-machine deployments approaching 500,000 peers, we're talking about a reduction from 7 gigs of memory down to 700 megs of memory. In order to get rid of these per-peer allocations, this commit switches to using a list-based queueing approach. Currently GSO fragments are chained together using the skb->next pointer (the skb_list_* singly linked list approach), so we form the per-peer queue around the unused skb->prev pointer (which sort of makes sense because the links are pointing backwards). Use of skb_queue_* is not possible here, because that is based on doubly linked lists and spinlocks. Multiple cores can write into the queue at any given time, because its writes occur in the start_xmit path or in the udp_recv path. But reads happen in a single workqueue item per-peer, amounting to a multi-producer, single-consumer paradigm. The MPSC queue is implemented locklessly and never blocks. However, it is not linearizable (though it is serializable), with a very tight and unlikely race on writes, which, when hit (some tiny fraction of the 0.15% of partial adds on a fully loaded 16-core x86_64 system), causes the queue reader to terminate early. However, because every packet sent queues up the same workqueue item after it is fully added, the worker resumes again, and stopping early isn't actually a problem, since at that point the packet wouldn't have yet been added to the encryption queue. These properties allow us to avoid disabling interrupts or spinning. The design is based on Dmitry Vyukov's algorithm [1]. Performance-wise, ordinarily list-based queues aren't preferable to ringbuffers, because of cache misses when following pointers around. However, we *already* have to follow the adjacent pointers when working through fragments, so there shouldn't actually be any change there. A potential downside is that dequeueing is a bit more complicated, but the ptr_ring structure used prior had a spinlock when dequeueing, so all and all the difference appears to be a wash. Actually, from profiling, the biggest performance hit, by far, of this commit winds up being atomic_add_unless(count, 1, max) and atomic_ dec(count), which account for the majority of CPU time, according to perf. In that sense, the previous ring buffer was superior in that it could check if it was full by head==tail, which the list-based approach cannot do. But all and all, this enables us to get massive memory savings, allowing WireGuard to scale for real world deployments, without taking much of a performance hit. [1] http://www.1024cores.net/home/lock-free-algorithms/queues/intrusive-mpsc-node-based-queue Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: skb_mark_not_on_list was backported to 4.14Jason A. Donenfeld2021-01-241-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: drop rhel 8.2, add rhel 8.4 supportJason A. Donenfeld2020-12-141-8/+5
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: backport NLA policy macrosJason A. Donenfeld2020-08-271-2/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: backport kfree_sensitive and switch to itJason A. Donenfeld2020-08-271-0/+4
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: drop support for SUSE 15.1Jason A. Donenfeld2020-07-291-10/+7
| | | | | | | | Now that WireGuard is properly supported by 15.2 and people have had sufficient time to upgrade, we can drop support for 15.1 in this compat module. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: add missing headers for ip_tunnel_parse_protocolJason A. Donenfeld2020-07-291-0/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: ipv6_dst_lookup_flow was ported to rhel 7.9 betaJason A. Donenfeld2020-07-291-1/+4
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: rhel 8.3 beta removed nf_nat_core.hJason A. Donenfeld2020-07-291-1/+1
| | | | | Reported-by: Vladimir Benes <vbenes@redhat.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: backport ip_tunnel_parse_protocol and ip_tunnel_header_opsJason A. Donenfeld2020-06-301-0/+22
| | | | | | | These are required for moving wg_examine_packet_protocol out of wireguard and into upstream. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: SUSE 15.1 is the final SUSE we need to supportJason A. Donenfeld2020-06-291-8/+8
| | | | | | >=15.2 is in SUSE's kernel now. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: rhel 8.3 backported skb_reset_redirectJason A. Donenfeld2020-06-291-1/+4
| | | | | Reported-by: Vladimir Benes <vbenes@redhat.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* device: avoid circular netns referencesJason A. Donenfeld2020-06-221-0/+4
| | | | | | | | | | | | | | | | Before, we took a reference to the creating netns if the new netns was different. This caused issues with circular references, with two wireguard interfaces swapping namespaces. The solution is to rather not take any extra references at all, but instead simply invalidate the creating netns pointer when that netns is deleted. In order to prevent this from happening again, this commit improves the rough object leak tracking by allowing it to account for created and destroyed interfaces, aside from just peers and keys. That then makes it possible to check for the object leak when having two interfaces take a reference to each others' namespaces. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: drop centos 8.1 support as 8.2 is now outJason A. Donenfeld2020-06-151-7/+4
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: remove stale suse supportJason A. Donenfeld2020-06-041-11/+3
| | | | | | | | The 42.x series is no longer supported, and the 15.2 kernel is getting a proper backport, so at the moment, we only care about supporting 15.1. Eventually we'll drop that too. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: bionic-hwe-5.0/disco kernel backported skb_reset_redirect and ipv6 flowJason A. Donenfeld2020-05-281-2/+4
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: ubuntu appears to have backported ipv6_dst_lookup_flowJason A. Donenfeld2020-05-281-1/+3
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: widen breadth of prandom_u32_max backportJason A. Donenfeld2020-05-211-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: backport skb_scrub_packet to 3.11Jason A. Donenfeld2020-05-211-0/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: widen breadth of memzero_explicit backportJason A. Donenfeld2020-05-211-3/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: widen breadth of integer constantsJason A. Donenfeld2020-05-211-1/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: support CentOS 8 explicitlyJason A. Donenfeld2020-05-201-4/+7
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: RHEL7 backported the skb hash renamingsJason A. Donenfeld2020-05-201-3/+3
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: ip6_dst_lookup_flow was backported to 4.14, 4.9, and 4.4Jason A. Donenfeld2020-05-201-1/+1
| | | | | | | Also remove the confusing 119/118 distinction from the Debian clause, which is no longer as important. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: backport renamed/missing skb hash membersJason A. Donenfeld2020-05-201-0/+13
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: support RHEL 8 as 8.2, drop 8.1 supportJason A. Donenfeld2020-05-191-9/+4
| | | | | | | | This should help with 8.3 beta rolls being recognized as 8.1 instead of 8.2 quirks. Reported-by: Vladimir Benes <vbenes@redhat.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: Ubuntu 19.10 and 18.04-hwe backported skb_reset_redirectJason A. Donenfeld2020-05-041-2/+4
| | | | | Reported-by: Pascal Ernster <pascal.ernster@rub.de> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: detect Debian's backport of ip6_dst_lookup_flow into 4.19.118Jason A. Donenfeld2020-05-031-1/+1
| | | | | | Link: https://bugs.debian.org/959157 Reported-by: Luca Filipozzi <lfilipoz@debian.org> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: ip6_dst_lookup_flow was backported to 4.19.119Jason A. Donenfeld2020-04-291-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: ip6_dst_lookup_flow was backported to 3.16.83Jason A. Donenfeld2020-04-291-5/+6
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* receive: use tunnel helpers for decapsulating ECN markingsToke Høiland-Jørgensen2020-04-281-12/+0
| | | | | | | | | | | | | | | | | WireGuard currently only propagates ECN markings on tunnel decap according to the old RFC3168 specification. However, the spec has since been updated in RFC6040 to recommend slightly different decapsulation semantics. This was implemented in the kernel as a set of common helpers for ECN decapsulation, so let's just switch over WireGuard to using those, so it can benefit from this enhancement and any future tweaks. We do not drop packets with invalid ECN marking combinations, because WireGuard is frequently used to work around broken ISPs, which could be doing that. Reported-by: Olivier Tilmans <olivier.tilmans@nokia-bell-labs.com> Cc: Dave Taht <dave.taht@gmail.com> Cc: Rodney W. Grimes <ietf@gndrsh.dnsmgr.net> Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: prefix icmp[v6]_ndo_send with __compatJason A. Donenfeld2020-04-261-4/+6
| | | | | | | | Some distros that backported icmp[v6]_ndo_send still try to build the compat module in some corner case circumstances, resulting in errors. Work around this with the usual __compat games. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: include sch_generic.h header for skb_reset_tcJason A. Donenfeld2020-04-161-0/+1
| | | | | Reported-by: King DuckZ <dev00@gmx.it> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: backport hsiphash_1u32 for testsJason A. Donenfeld2020-04-141-0/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: support RHEL 7.8's faulty siphash backportJason A. Donenfeld2020-04-141-1/+1
| | | | | Reported-by: Christian Weiss <cwei@gmx.net> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* compat: support latest suse 15.1 and 15.2Jason A. Donenfeld2020-04-071-4/+7
| | | | | Contributed-by: Martin Hauke <mardnh@gmx.de> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.