| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
It's good to have SPDX identifiers in all files as the Linux kernel
developers are working to add these identifiers to all files.
Update all files with the correct SPDX license identifier based on the license
text of the project or based on the license in the file itself. The SPDX
identifier is a legally binding shorthand, which can be used instead of the
full boiler plate text.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Modified-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
| | |
|
| | |
|
| |
|
|
| |
Also clean up related logic quite a bit and add unit tests.
|
| | |
|
| | |
|
| |
|
|
|
|
|
| |
Fedora/Redhat doesn't ship with a prefixed strip, and we don't need to
use it anyway when we're not cross compiling, so don't.
Reported-by: Samuel Neves <sneves@dei.uc.pt>
|
| | |
|
| |
|
|
|
|
|
| |
Otherwise, if messages pack really close together, we'll exceed the size
of the sk_buff and return ENOBUFS. I suspect this has been the cause of
a lot of weird bugs that people just worked around by increasing the
receive buffer size. This actually addresses the root cause.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
| |
This misses lines that are greater than 128 bytes -- read returns
-EINVAL -- but the lines we care about anyway are less than that, so we
simply keep looping and skip the bad reads when this happens. Not ideal,
but probably the best we can do in pure bash.
And, importantly, it's much better than streaming this over a TCP
socket, which was an even uglier hack.
|
| | |
|
| |
|
|
|
| |
Upstream's a2d3f3e33853ef52e5f66b41c3e8ee5710aa3305 broke things in
strange and confusing ways.
|
| | |
|
| | |
|
| |
|
|
|
|
|
| |
Although I was secretly proud of having figured out these unholy hacks,
it turns out -no-reboot lets us do things in a platform-independent way.
Suggested-by: Jann Horn <jann@thejh.net>
|
| | |
|
| |
|
|
|
| |
Now that we have the watchdog, killing the watchdog process is another
way of shutting down.
|
| | |
|
| | |
|
| |
|
|
| |
Useful for IDEs
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
Suggested-by: Sultan Alsawaf <sultanxda@gmail.com>
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
| |
This removes our dependency on padata and moves to a different mode of
multiprocessing that is more efficient.
This began as Samuel Holland's GSoC project and was gradually
reworked/redesigned/rebased into this present commit, which is a
combination of his initial contribution and my subsequent rewriting and
redesigning.
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We store the destination IP of incoming packets as the source IP of
outgoing packets. When we send outgoing packets, we then ask the routing
table for which interface to use and which source address, given our
inputs of the destination address and a suggested source address. This
all is good and fine, since it means we'll successfully reply using the
correct source address, correlating with the destination address for
incoming packets. However, what happens when default routes change? Or
when interface IP addresses change?
Prior to this commit, after getting the response from the routing table
of the source address, destination address, and interface, we would then
make sure that the source address actually belonged to the outbound
interface. If it didn't, we'd reset our source address to zero and
re-ask the routing table, in which case the routing table would then
give us the default IP address for sending that packet. This worked
mostly fine for most purposes, but there was a problem: what if
WireGuard legitimately accepted an inbound packet on a default interface
using an IP of another interface? In this case, falling back to asking
for the default source IP was not a good strategy, since it'd nearly
always mean we'd fail to reply using the right source.
So, this commit changes the algorithm slightly. Rather than falling back
to using the default IP if the preferred source IP doesn't belong to the
outbound interface, we have two checks: we make sure that the source IP
address belongs to _some_ interface on the system, no matter which one
(so long as it's within the network namespace), and we check whether or
not the interface of an incoming packet matches the returned interface
for the outbound traffic. If both these conditions are true, then we
proceed with using this source IP address. If not, we fall back to the
default IP address.
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
| |
Due to concerns with the .io TLD, we are switching to using
wireguard.com instead.
|
| | |
|
| |
|
|
| |
This logic belongs upstream.
|
| |
|
|
|
|
|
| |
This not only removes the depenency on x_tables, but it also gives us
much better performance and memory usage. Now, systems are able to have
millions of WireGuard interfaces, without having to worry about a
thundering herd of garbage collection.
|
| | |
|
| |
|
|
|
| |
The kernel API for this has changed a lot, so this test is important to
ensure our compat layer is doing the right thing.
|
| | |
|
Jason A. Donenfeld
Greg Kroah-Hartman