aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/src/compat (follow)
Commit message (Collapse)AuthorAgeFilesLines
* compat: support 4.15's netlink and barrier changesJason A. Donenfeld2017-11-261-0/+6
|
* compat: fix typo and rangesJason A. Donenfeld2017-11-231-1/+1
|
* compat: support AVX512BW+VL by lyingJason A. Donenfeld2017-11-221-2/+15
|
* compat: support timespec64 on old kernelsJason A. Donenfeld2017-11-221-0/+5
|
* chacha20poly1305: import x86_64 primitives from OpenSSLSamuel Neves2017-11-222-4/+30
| | | | | | x86_64 only at the moment. SSSE3, AVX, AVX2, AVX512. Signed-off-by: Samuel Neves <sneves@dei.uc.pt>
* compat: new kernels have netlink fixesJason A. Donenfeld2017-11-221-12/+9
|
* compat: stable finally backported fixJason A. Donenfeld2017-11-221-1/+1
|
* compat: fix compilation with PaXJason A. Donenfeld2017-11-141-0/+12
| | | | | | Despite not having access to the latest grsecurity source, I still do very much want to keep supporting it, so this patch is my best guess at what will work.
* compat: 3.16.50 got proper rt6_get_cookieJason A. Donenfeld2017-11-141-1/+1
|
* netlink: make sure we reserve space for NLMSG_DONEJason A. Donenfeld2017-11-101-1/+16
| | | | | | | Otherwise, if messages pack really close together, we'll exceed the size of the sk_buff and return ENOBUFS. I suspect this has been the cause of a lot of weird bugs that people just worked around by increasing the receive buffer size. This actually addresses the root cause.
* compat: 4.4.0 has strange ECN functionJason A. Donenfeld2017-11-101-1/+2
|
* timers: switch to kees' new timer_list functionsJason A. Donenfeld2017-11-011-0/+5
|
* device: only take reference if netns is differentJason A. Donenfeld2017-10-311-0/+5
| | | | | | If we take two references, the namespace and the device are never freed in the usual manner. We should thus only take a reference to another namespace when it is a different namespace from our own.
* global: infuriating kernel iterator styleJason A. Donenfeld2017-10-311-1/+1
| | | | | | | | | | | | | | | | | One types: for (i = 0 ... So one should also type: for_each_obj (obj ... But the upstream kernel style guidelines are insane, and so we must instead do: for_each_obj(obj ... Ugly, but one must choose his battles wisely.
* compat: be sure to include header before testingJason A. Donenfeld2017-10-311-0/+1
| | | | Reported-by: Aaron M. D. Jones <aaronmdjones@gmail.com>
* crypto/avx: make sure we can actually use ymm registersJason A. Donenfeld2017-10-311-0/+20
|
* compat: fix up stat calculation for udp tunnelJason A. Donenfeld2017-10-312-5/+16
|
* compat: support READ_ONCEJason A. Donenfeld2017-10-171-0/+4
|
* compat: just make ro_after_init read_mostlyJason A. Donenfeld2017-10-171-0/+4
|
* compat: move version logic to compat.h and out of main .cJason A. Donenfeld2017-10-111-0/+14
|
* compat: macro rewrite netlink instead of clutteringJason A. Donenfeld2017-10-051-0/+13
|
* compat: RHEL backported netlink changesJason A. Donenfeld2017-10-051-1/+1
|
* compat: conditionally redefine GENL_UNS_ADMIN_PERMJason A. Donenfeld2017-10-051-0/+3
|
* compat: support ptr_ring for old kernelsJason A. Donenfeld2017-10-052-0/+644
|
* global: use _WG prefix for include guardsJason A. Donenfeld2017-10-034-12/+12
| | | | Suggested-by: Sultan Alsawaf <sultanxda@gmail.com>
* netlink: switch from ioctl to netlink for configurationJason A. Donenfeld2017-10-021-0/+37
|
* compat: support RHEL 7.4Jason A. Donenfeld2017-09-181-1/+1
|
* queue: entirely rework parallel systemJason A. Donenfeld2017-09-182-911/+0
| | | | | | | | | | This removes our dependency on padata and moves to a different mode of multiprocessing that is more efficient. This began as Samuel Holland's GSoC project and was gradually reworked/redesigned/rebased into this present commit, which is a combination of his initial contribution and my subsequent rewriting and redesigning.
* compat: fix padata to work with 4.13Jason A. Donenfeld2017-09-071-12/+12
|
* socket: improve reply-to-src algorithmJason A. Donenfeld2017-08-231-1/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We store the destination IP of incoming packets as the source IP of outgoing packets. When we send outgoing packets, we then ask the routing table for which interface to use and which source address, given our inputs of the destination address and a suggested source address. This all is good and fine, since it means we'll successfully reply using the correct source address, correlating with the destination address for incoming packets. However, what happens when default routes change? Or when interface IP addresses change? Prior to this commit, after getting the response from the routing table of the source address, destination address, and interface, we would then make sure that the source address actually belonged to the outbound interface. If it didn't, we'd reset our source address to zero and re-ask the routing table, in which case the routing table would then give us the default IP address for sending that packet. This worked mostly fine for most purposes, but there was a problem: what if WireGuard legitimately accepted an inbound packet on a default interface using an IP of another interface? In this case, falling back to asking for the default source IP was not a good strategy, since it'd nearly always mean we'd fail to reply using the right source. So, this commit changes the algorithm slightly. Rather than falling back to using the default IP if the preferred source IP doesn't belong to the outbound interface, we have two checks: we make sure that the source IP address belongs to _some_ interface on the system, no matter which one (so long as it's within the network namespace), and we check whether or not the interface of an incoming packet matches the returned interface for the outbound traffic. If both these conditions are true, then we proceed with using this source IP address. If not, we fall back to the default IP address.
* compat: support grsecurity with our compat padata implementationJason A. Donenfeld2017-08-061-0/+8
| | | | | | | | | | | | | | | | | | | | | | Some SMP kernels don't have PADATA enabled, which means we actually ship our own copy of it, lifted right out of the kernel. This is completely insane and stupid, but so it goes with really grotesque "compat/" layers such as this one. What this amounts to is having to make this upstream file compile on all kernels back to 3.10. Ouch. It also means making it compile with whatever other kernels people are using, such as Grsecurity. This patch _should_ make this part of the compat layer work with Grsecurity, but unfortunately I really have no way of knowing, since I don't actually have access to their source code. I assume, though, if this doesn't work, I'll receive more complaints and will take another stab in the dark. The general situation saddens me, as I really liked that project and wish I could still play with it. Alas. Fortunately this entire problem with padata will go away, anyway, when we stop using padata, and move to a better form of multicore processing. But for now, we add this to work around the issue.
* socket: move print function from compatJason A. Donenfeld2017-07-281-10/+0
|
* compat: get rid of warnings on frankenkernelsJason A. Donenfeld2017-07-281-0/+8
|
* compat: work around odd kernels that backport kv[mz]allocJason A. Donenfeld2017-07-271-3/+5
|
* global: use pointer to net_deviceJason A. Donenfeld2017-07-201-7/+0
| | | | | | DaveM prefers it to be this way per [1]. [1] http://www.spinics.net/lists/netdev/msg443992.html
* device: support 4.13's extact newlink paramJason A. Donenfeld2017-07-201-0/+4
|
* compat: work around odd kernels that backport kvfreeJason A. Donenfeld2017-07-071-1/+3
|
* device: cleanup register_netdev logicJason A. Donenfeld2017-07-061-0/+5
|
* ratelimiter: use kvzalloc for hash table allocationJason A. Donenfeld2017-07-041-0/+35
|
* compat: workaround Ubuntu 16.10 kernel weirdnessJason A. Donenfeld2017-07-031-0/+1
|
* compat: support OpenSUSE's backportsJason A. Donenfeld2017-07-031-1/+6
|
* compat: support Ubuntu 14.04Jason A. Donenfeld2017-06-281-4/+10
|
* compat: support EL7.3Jason A. Donenfeld2017-06-281-16/+21
|
* compat: do not export symbols unnecessarilyJason A. Donenfeld2017-06-284-34/+0
|
* device: remove icmp conntrack hacksJason A. Donenfeld2017-06-261-0/+31
| | | | This logic belongs upstream.
* compat: clean up cruftJason A. Donenfeld2017-06-261-4/+2
|
* socket: verify saddr belongs to interfaceJason A. Donenfeld2017-06-261-0/+5
| | | | | This helps "unstick" stuck source addresses, when changing routes dynamically.
* ratelimiter: rewrite from scratchJason A. Donenfeld2017-06-261-9/+12
| | | | | | | This not only removes the depenency on x_tables, but it also gives us much better performance and memory usage. Now, systems are able to have millions of WireGuard interfaces, without having to worry about a thundering herd of garbage collection.
* random: wait for random bytes when generating nonces and ephemeralsJason A. Donenfeld2017-06-121-0/+10
| | | | | | | | | | | We can let userspace configure wireguard interfaces before the RNG is fully initialized, since what we mostly care about is having good randomness for ephemerals and xchacha nonces. By deferring the wait to actually asking for the randomness, we give a lot more opportunity for gathering entropy. This won't cover entropy for hash table secrets or cookie secrets (which rotate anyway), but those have far less catastrophic failure modes, so ensuring good randomness for elliptic curve points and nonces should be sufficient.
* config: ensure the RNG is initialized before settingJason A. Donenfeld2017-06-081-0/+43
| | | | | | | | It's possible that get_random_bytes() will return bad randomness if it hasn't been seeded. This patch makes configuration block until the RNG is properly initialized. Reference: http://www.openwall.com/lists/kernel-hardening/2017/06/02/2
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.