| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | device: remove icmp conntrack hacks |   Jason A. Donenfeld | 2017-06-26 | 1 | -0/+31 | |
| | | | | | This logic belongs upstream. | |||||
| * | compat: clean up cruft | Jason A. Donenfeld | 2017-06-26 | 1 | -4/+2 | |
| | | ||||||
| * | socket: verify saddr belongs to interface | Jason A. Donenfeld | 2017-06-26 | 1 | -0/+5 | |
| | | | | | | This helps "unstick" stuck source addresses, when changing routes dynamically. | |||||
| * | ratelimiter: rewrite from scratch | Jason A. Donenfeld | 2017-06-26 | 1 | -9/+12 | |
| | | | | | | | | This not only removes the depenency on x_tables, but it also gives us much better performance and memory usage. Now, systems are able to have millions of WireGuard interfaces, without having to worry about a thundering herd of garbage collection. | |||||
| * | random: wait for random bytes when generating nonces and ephemerals | Jason A. Donenfeld | 2017-06-12 | 1 | -0/+10 | |
| | | | | | | | | | | | | We can let userspace configure wireguard interfaces before the RNG is fully initialized, since what we mostly care about is having good randomness for ephemerals and xchacha nonces. By deferring the wait to actually asking for the randomness, we give a lot more opportunity for gathering entropy. This won't cover entropy for hash table secrets or cookie secrets (which rotate anyway), but those have far less catastrophic failure modes, so ensuring good randomness for elliptic curve points and nonces should be sufficient. | |||||
| * | config: ensure the RNG is initialized before setting | Jason A. Donenfeld | 2017-06-08 | 1 | -0/+43 | |
| | | | | | | | | | It's possible that get_random_bytes() will return bad randomness if it hasn't been seeded. This patch makes configuration block until the RNG is properly initialized. Reference: http://www.openwall.com/lists/kernel-hardening/2017/06/02/2 | |||||
| * | compat: remove padata hotplug code | Jason A. Donenfeld | 2017-06-01 | 1 | -149/+0 | |
| | | | | | | | It's different on different kernel versions, and we're not using it anyway, so it's easiest to just get rid of it, rather than having another ifdef maze. | |||||
| * | debug: print interface name in dmesg | Jason A. Donenfeld | 2017-05-31 | 1 | -2/+2 | |
| | | ||||||
| * | compat: remove warning for < 4.1 | Jason A. Donenfeld | 2017-05-31 | 1 | -2/+0 | |
| | | | | | | | | | | | | | It still is sort of experimental, I suppose, especially this part in the udp_tunnel drop-in: skb_orphan(skb); sk_mem_reclaim(sk); It seems like sometimes this won't do what we want, but it's hard to diagnose exactly what's happening. In any case, nobody paid attention to that warning anyway, so let's just get rid of it. | |||||
| * | style: spaces after for loops | Jason A. Donenfeld | 2017-05-30 | 1 | -1/+1 | |
| | | ||||||
| * | compat: ship padata if kernel doesn't have it | Jason A. Donenfeld | 2017-05-30 | 2 | -0/+1052 | |
| | | ||||||
| * | compat: remember to call iptunnel_xmit_stats | Jason A. Donenfeld | 2017-05-17 | 1 | -4/+13 | |
| | | | | | Upstream's 039f50629b7f860f36644ed1f34b27da9aa62f43 only came in 4.5 | |||||
| * | compat: use real crypto_memneq | Jason A. Donenfeld | 2017-05-17 | 4 | -14/+181 | |
| | | ||||||
| * | compat: work around ubnt offloading | Jason A. Donenfeld | 2017-05-17 | 1 | -0/+4 | |
| | | ||||||
| * | compat: ssse3 support | Jason A. Donenfeld | 2017-05-04 | 1 | -0/+4 | |
| | | ||||||
| * | compat: use existing iptunnel_xmit function for stats | Jason A. Donenfeld | 2017-04-24 | 1 | -7/+2 | |
| | | ||||||
| * | compat: work on old 3.10 | Jason A. Donenfeld | 2017-04-21 | 2 | -0/+35 | |
| | | ||||||
| * | tools: side channel resistant base64 | Jason A. Donenfeld | 2017-04-19 | 1 | -1/+1 | |
| | | ||||||
| * | compat: warn on < 4.1 | Jason A. Donenfeld | 2017-04-09 | 1 | -0/+2 | |
| | | ||||||
| * | compat: careful with destructors | Jason A. Donenfeld | 2017-04-09 | 2 | -7/+7 | |
| | | ||||||
| * | compat: support 3.10 | Jason A. Donenfeld | 2017-04-09 | 2 | -3/+104 | |
| | | ||||||
| * | compat: support 3.12 | Jason A. Donenfeld | 2017-04-09 | 6 | -5/+237 | |
| | | ||||||
| * | compat: support 3.14 | Jason A. Donenfeld | 2017-04-09 | 2 | -6/+130 | |
| | | ||||||
| * | compat: support 3.16 | Jason A. Donenfeld | 2017-04-09 | 6 | -109/+573 | |
| | | ||||||
| * | compat: allow create-patch to work on debian-based builds | Jason A. Donenfeld | 2017-03-27 | 1 | -0/+4 | |
| | | ||||||
| * | blake2s: add AVX implementation | Jason A. Donenfeld | 2017-03-19 | 2 | -0/+5 | |
| | | ||||||
| * | hashtables: get_random_int is now more secure, so expose directly | Jason A. Donenfeld | 2017-03-19 | 1 | -0/+19 | |
| | | | | | | | | | On 4.11, get_random_u32 now either uses chacha or rdrand, rather than the horrible former MD5 construction, so we feel more comfortable exposing RNG output directly. On older kernels, we fall back to something a bit disgusting. | |||||
| * | compat: use maybe_unused macro over gcc-specific | Jason A. Donenfeld | 2017-02-27 | 1 | -1/+1 | |
| | | ||||||
| * | data: transition to skb_reset_tc for 4.11 | Jason A. Donenfeld | 2017-02-27 | 1 | -0/+10 | |
| | | ||||||
| * | socket: do not try to create v6 socket when disabled | Jason A. Donenfeld | 2017-02-23 | 1 | -0/+8 | |
| | | ||||||
| * | compat: backport siphash & dst_cache from mainline | Jason A. Donenfeld | 2017-02-13 | 6 | -0/+1156 | |
 |
index : wireguard-monolithic-historical | |
| Historical monolithic WireGuard repository, split into wireguard-tools, wireguard-linux, and wireguard-linux-compat. | Jason A. Donenfeld |
| aboutsummaryrefslogtreecommitdiffstatshomepage |