aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/.gitignore (unfollow)
Commit message (Collapse)AuthorFilesLines
2019-03-25peerlookup: rename from hashtablesJason A. Donenfeld7-9/+9
2019-03-23tools: avoid unneccessary next_peer assignments in sort_peers()Luis Ressel1-2/+1
Signed-off-by: Luis Ressel <aranea@aixah.de>
2019-03-23wg-quick: add 'strip' subcommandLuis Ressel5-5/+50
`wg-quick strip` prints the config file to stdout after stripping it of all wg-quick-specific options. This enables tricks such as `wg addconf $DEV <(wg-quick strip $DEV)`. Signed-off-by: Luis Ressel <aranea@aixah.de>
2019-03-23tools: warn if an AllowedIP has a nonzero host partLuis Ressel1-0/+34
Signed-off-by: Luis Ressel <aranea@aixah.de>
2019-03-18wg-quick: freebsd: export TMPDIR when restoring and don't make emptyJason A. Donenfeld1-1/+2
Otherwise mktemp doesn't see it, and if it's empty we wind up in /.
2019-03-17global: the _bh variety of rcu helpers have been unifiedJason A. Donenfeld7-12/+57
2019-03-14compat: nf_nat_core.h was removed upstreamBruno Wolff III1-0/+2
In d2c5c103b133 ("netfilter: nat: remove nf_nat_l3proto.h and nf_nat_core.h"). Signed-off-by: Bruno Wolff III <bruno@wolff.to>
2019-02-28tools: add support for HaikuAlexander von Gluck IV1-0/+3
Signed-off-by: Alexander von Gluck IV <kallisti5@unixzen.com>
2019-02-28tools: genkey: account for short reads of /dev/urandomJason A. Donenfeld2-18/+35
Apparently Haiku has a misbehaving /dev/urandom. While we're at it, simplify the function signature to completely succeed or completely fail and make sure the caller checks the result. Reported-by: Alexander von Gluck IV <kallisti5@unixzen.com> Nitpicked-by: Aaron Jones <aaronmdjones@gmail.com>
2019-02-28wg-quick: freebsd: rebreak interface loopback, while fixing localhostJason A. Donenfeld1-1/+1
The commit 7c833642 ("wg-quick: freebsd: allow loopback to work") was supposed to make things better, but actually it just started sending legitimate localhost traffic over the WireGuard interface, which is really quite bad. This reverts commit 7c833642dfa342218602ab18e7091e86408d2982. Reported-by: Matt Smith <matt.xtaz@gmail.com>
2019-02-27version: bump snapshot0.0.20190227Jason A. Donenfeld2-2/+2
2019-02-27queueing: net-next has changed signature of skb_probe_transport_headerJason A. Donenfeld2-1/+7
2019-02-26allowedips: maintain per-peer list of allowedipsJason A. Donenfeld6-160/+129
This makes `wg show` and `wg showconf` and the like significantly faster, since we don't have to iterate through every node of the trie for every single peer. It also makes netlink cursor resumption much less problematic, since we're just iterating through a list, rather than having to save a traversal stack.
2019-02-25peer: only synchronize_rcu_bh and traverse trie once when removing all peersJason A. Donenfeld2-20/+42
2019-02-25netlink: don't remove allowed ips for new peersJason A. Donenfeld1-0/+3
This causes needless traversal of the trie.
2019-02-17Makefile: make the depmod path configurableLuis Ressel1-1/+2
Signed-off-by: Luis Ressel <aranea@aixah.de>
2019-02-17Makefile: don't duplicate code in install and modules-installLuis Ressel1-5/+5
Signed-off-by: Luis Ressel <aranea@aixah.de>
2019-02-17compat: backport ALIGN_DOWNJason A. Donenfeld1-0/+7
2019-02-17compat: ipv6_stub is sometimes nullJason A. Donenfeld1-1/+1
On ancient kernels, ipv6_stub is sometimes null in cases where IPv6 has been disabled with a command line flag or other failures. Reported-by: Anatoli <me@anatoli.ws>
2019-02-08tools: c_acc doesn't need to be initializedJason A. Donenfeld1-1/+1
2019-02-05tools: fight compiler slightly harderJason A. Donenfeld2-2/+2
2019-02-04chacha20: name enumsJason A. Donenfeld1-2/+2
2019-02-03noise: store clamped key instead of raw keyJason A. Donenfeld9-18/+18
2019-02-03chacha20poly1305: permit unaligned strides on certain platformsJason A. Donenfeld1-18/+14
The map allocations required to fix this are mostly slower than unaligned paths. Reported-by: Louis Sautier <sbraz@gentoo.org>
2019-02-03hashtables: decouple hashtable allocations from the main device allocationSultan Alsawaf9-25/+49
The hashtable allocations are quite large, and cause the device allocation in the net framework to stall sometimes while it tries to find a contiguous region that can fit the device struct: [<0000000000000000>] __switch_to+0x94/0xb8 [<0000000000000000>] __alloc_pages_nodemask+0x764/0x7e8 [<0000000000000000>] kmalloc_order+0x20/0x40 [<0000000000000000>] __kmalloc+0x144/0x1a0 [<0000000000000000>] alloc_netdev_mqs+0x5c/0x368 [<0000000000000000>] rtnl_create_link+0x48/0x180 [<0000000000000000>] rtnl_newlink+0x410/0x708 [<0000000000000000>] rtnetlink_rcv_msg+0x190/0x1f8 [<0000000000000000>] netlink_rcv_skb+0x4c/0xf8 [<0000000000000000>] rtnetlink_rcv+0x30/0x40 [<0000000000000000>] netlink_unicast+0x18c/0x208 [<0000000000000000>] netlink_sendmsg+0x19c/0x348 [<0000000000000000>] sock_sendmsg+0x3c/0x58 [<0000000000000000>] ___sys_sendmsg+0x290/0x2b0 [<0000000000000000>] __sys_sendmsg+0x58/0xa0 [<0000000000000000>] SyS_sendmsg+0x10/0x20 [<0000000000000000>] el0_svc_naked+0x34/0x38 [<0000000000000000>] 0xffffffffffffffff To fix the allocation stalls, decouple the hashtable allocations from the device allocation and allocate the hashtables with kvmalloc's implicit __GFP_NORETRY so that the allocations fall back to vmalloc with little resistance. Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com>
2019-02-03queueing: more reasonable allocator function conventionJason A. Donenfeld3-4/+4
2019-02-03noise: whiten the nanoseconds portion of the timestampJason A. Donenfeld1-0/+9
This mitigates unrelated sidechannel attacks that think they can turn WireGuard into a useful time oracle.
2019-01-31highlighter: when subtracting char, cast to unsignedJason A. Donenfeld1-2/+2
Windows.
2019-01-30systemd: wg-quick should depend on nss-lookup.targetJason A. Donenfeld1-2/+2
Since wg-quick(8) calls wg(8) which does hostname lookups, we should probably only run this after we're allowed to look up hostnames. Reported-by: Anton Castelli <anton.c42@gmail.com>
2019-01-24tools: remove unused check phony declarationJason A. Donenfeld1-1/+1
2019-01-24wg-quick: freebsd: allow loopback to workJason A. Donenfeld1-1/+1
FreeBSD adds a route for point-to-point destination addresses. We don't really want to specify any destination address, but unfortunately we have to. Before we tried to cheat by giving our own address as the destination, but this had the unfortunate effect of preventing loopback from working on our local ip address. We work around this with yet another kludge: we set the destination address to 127.0.0.1. Since 127.0.0.1 is already assigned to an interface, this has the same effect of not specifying a destination address, and therefore we accomplish the intended behavior.
2019-01-23version: bump snapshot0.0.20190123Jason A. Donenfeld2-2/+2
2019-01-23netlink: use __kernel_timespec for handshake timeJason A. Donenfeld10-13/+45
2019-01-23contrib: introduce simple highlighter libraryJason A. Donenfeld8-0/+904
2019-01-23global: normalize -> clampJason A. Donenfeld9-26/+19
2019-01-23keygen-html: bring back pure javascript implementationJason A. Donenfeld6-139/+186
This reverts commit 9d5baf7d1d14ca7eb0852b41566330259229d489. Benoît Viguier has proofs that values will stay well within 2^53. We also have an improved carry function that's much simpler.
2019-01-23qemu: enable FP on MIPSJason A. Donenfeld4-0/+4
This is a change for Linux 5.0.
2019-01-23qemu: version bump to bash 5.0Jason A. Donenfeld1-1/+1
2019-01-23Kconfig: IPsec isn't IPSecJason A. Donenfeld2-2/+2
Reported-by: Raf Czlonka <rczlonka@gmail.com>
2019-01-23ratelimiter: totalram_pages is now a functionJason A. Donenfeld2-2/+6
Reported-by: Alex Xu <alex@alxu.ca>
2019-01-23noise: replace getnstimeofday64 with ktime_get_real_ts64Jason A. Donenfeld2-2/+2
The former was just a wrapper around the latter, and so upstream is now removing it. Also adjust the compat kludge to deal with this. Reported-by: Alex Xu <alex@alxu.ca>
2019-01-23ratelimiter: build tests with !IPV6Jason A. Donenfeld1-5/+2
2019-01-23qemu: version bump kernelJason A. Donenfeld1-1/+1
2019-01-07global: update copyrightJason A. Donenfeld135-136/+136
2018-12-30netlink: auth socket changes against namespace of socketJason A. Donenfeld1-0/+7
In WireGuard, the underlying UDP socket lives in the namespace where the interface was created and doesn't move if the interface is moved. This allows one to create the interface in some privileged place that has Internet access, and then move it into a container namespace that only has the WireGuard interface for egress. Consider the following situation: 1. Interface created in namespace A. Socket therefore lives in namespace A. 2. Interface moved to namespace B. Socket remains in namespace A. 3. Namespace B now has access to the interface and changes the listen port and/or fwmark of socket. Change is reflected in namespace A. This behavior is arguably _fine_ and perhaps even expected or acceptable. But there's also an argument to be made that B should have A's cred to do so. So, this patch adds a simple ns_capable check.
2018-12-20tools: curve25519: handle unaligned loads/stores safelyJason A. Donenfeld2-5/+19
Reported-by: Chris Hewitt <chris@chrishewitt.net>
2018-12-18version: bump snapshot0.0.20181218Jason A. Donenfeld2-2/+2
2018-12-18makefile: use immediate expansion and use correct template patternsJason A. Donenfeld4-7/+9
2018-12-18netns: nmap != ncatJason A. Donenfeld1-4/+4
2018-12-18wg-quick: bring interface up while setting MTUAaron Jones1-9/+4
This avoids another ip(8) invocation for little benefit. Confirmed to work with iproute2 and busybox. Signed-off-by: Aaron Jones <aaronmdjones@gmail.com>
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.