aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/src (follow)
Commit message (Collapse)AuthorAgeFilesLines
* compat: workaround Ubuntu 16.10 kernel weirdnessJason A. Donenfeld2017-07-031-0/+1
|
* compat: support OpenSUSE's backportsJason A. Donenfeld2017-07-031-1/+6
|
* receive: cleanup error handlersJason A. Donenfeld2017-06-291-21/+23
|
* version: bump snapshot0.0.20170629Jason A. Donenfeld2017-06-292-2/+2
|
* receive: pull IP header into headJason A. Donenfeld2017-06-291-0/+4
|
* receive: fix off-by-one in packet length checkingJason A. Donenfeld2017-06-291-1/+1
| | | | | | | | | | | | This caused certain packets to be rejected that shouldn't be rejected, in the case of certain scatter-gather ethernet drivers doing GRO pulling right up to the UDP bounds but not beyond. This caused certain TCP connections to fail. Thanks very much to Reuben for providing access to the machine to debug this regression. Reported-by: Reuben Martin <reuben.m@gmail.com>
* tools: remove double include in ipcJason A. Donenfeld2017-06-291-1/+0
|
* version: bump snapshot0.0.20170628Jason A. Donenfeld2017-06-282-2/+2
|
* compat: support Ubuntu 14.04Jason A. Donenfeld2017-06-281-4/+10
|
* compat: support EL7.3Jason A. Donenfeld2017-06-281-16/+21
|
* wg-quick: use printf -v instead of namerefs for bash 4.2Jason A. Donenfeld2017-06-281-3/+2
| | | | I'm not happy about this.
* compat: do not export symbols unnecessarilyJason A. Donenfeld2017-06-284-34/+0
|
* global: cleanup IP header checkingJason A. Donenfeld2017-06-267-77/+46
| | | | This way is more correct and ensures we're within the skb head.
* device: remove icmp conntrack hacksJason A. Donenfeld2017-06-263-35/+37
| | | | This logic belongs upstream.
* compat: clean up cruftJason A. Donenfeld2017-06-261-4/+2
|
* device: avoid double icmp send on routing loopJason A. Donenfeld2017-06-261-1/+0
|
* socket: use ip_rt_put instead of dst_releaseJason A. Donenfeld2017-06-261-2/+2
|
* socket: verify saddr belongs to interfaceJason A. Donenfeld2017-06-262-1/+9
| | | | | This helps "unstick" stuck source addresses, when changing routes dynamically.
* ratelimiter: rewrite from scratchJason A. Donenfeld2017-06-2611-159/+179
| | | | | | | This not only removes the depenency on x_tables, but it also gives us much better performance and memory usage. Now, systems are able to have millions of WireGuard interfaces, without having to worry about a thundering herd of garbage collection.
* curve25519: keep certain sandy2x functions in CJason A. Donenfeld2017-06-252-232/+84
| | | | We can let the compiler optimize how it sees fit.
* curve25519: satisfy sparse and use short typesJason A. Donenfeld2017-06-241-26/+26
|
* receive: extend rate limiting to 1 second after under load detectionJason A. Donenfeld2017-06-241-0/+5
|
* device: only use one sleep notifierJason A. Donenfeld2017-06-242-23/+27
| | | | | This greatly improves performance when adding and removing interfaces, since the power registration function does a linear search each time.
* device: netdevice destruction logic change for 4.12Jason A. Donenfeld2017-06-241-4/+13
|
* wg-quick: properly match IPv6 endpointJason A. Donenfeld2017-06-241-1/+1
|
* selftest: remove antique siphash self testJason A. Donenfeld2017-06-241-89/+0
|
* main: annotate init/exit functions to save memoryJason A. Donenfeld2017-06-2411-39/+39
|
* version: bump snapshot0.0.20170613Jason A. Donenfeld2017-06-132-2/+2
|
* tools: use proper __linux__ ifdefJason A. Donenfeld2017-06-121-1/+1
|
* random: wait for random bytes when generating nonces and ephemeralsJason A. Donenfeld2017-06-124-7/+12
| | | | | | | | | | | We can let userspace configure wireguard interfaces before the RNG is fully initialized, since what we mostly care about is having good randomness for ephemerals and xchacha nonces. By deferring the wait to actually asking for the randomness, we give a lot more opportunity for gathering entropy. This won't cover entropy for hash table secrets or cookie secrets (which rotate anyway), but those have far less catastrophic failure modes, so ensuring good randomness for elliptic curve points and nonces should be sufficient.
* version: bump snapshot0.0.20170612Jason A. Donenfeld2017-06-122-2/+2
|
* wg-quick: match ipv6 default route more broadlyJason A. Donenfeld2017-06-121-1/+1
|
* wg-quick: make sure we have empty table for both v6 and v4Jason A. Donenfeld2017-06-111-1/+3
| | | | | | | Otherwise, we wind up not doing the right thing in the v6-only case, or doing something totally borked when v4 and v6 are filled unevenly. Reported-by: Roelf Wichertjes <contact@roelf.org>
* config: ensure the RNG is initialized before settingJason A. Donenfeld2017-06-082-0/+48
| | | | | | | | It's possible that get_random_bytes() will return bad randomness if it hasn't been seeded. This patch makes configuration block until the RNG is properly initialized. Reference: http://www.openwall.com/lists/kernel-hardening/2017/06/02/2
* noise: fix race when replacing handshakeJason A. Donenfeld2017-06-083-11/+24
| | | | | | | | Replacing an entry that's already been replaced is something that could happen when processing handshake messages in parallel, when starting up multiple instances on the same machine. Reported-by: Hubert Goisern <zweizweizwoelf@gmail.com>
* peer: explicitly initialize atomicJason A. Donenfeld2017-06-051-0/+3
|
* compat: remove padata hotplug codeJason A. Donenfeld2017-06-011-149/+0
| | | | | | It's different on different kernel versions, and we're not using it anyway, so it's easiest to just get rid of it, rather than having another ifdef maze.
* curve25519: use more standard label convention in asmJason A. Donenfeld2017-06-012-24/+24
|
* device: do-while assignment styleJason A. Donenfeld2017-06-011-1/+1
|
* receive: trim incoming packets to IP header lengthJason A. Donenfeld2017-06-013-2/+17
|
* timers: queue up killing ephemerals only if not alreadyJason A. Donenfeld2017-05-311-1/+1
|
* config: add new line for styleJason A. Donenfeld2017-05-311-0/+1
|
* version: bump snapshot0.0.20170531Jason A. Donenfeld2017-05-312-2/+2
|
* timers: reset retry-attempt counter when not retryingJason A. Donenfeld2017-05-314-7/+10
|
* timers: the completion of a handshake also is on key confirmationJason A. Donenfeld2017-05-312-2/+3
|
* timers: rework handshake reply control flowJason A. Donenfeld2017-05-311-9/+8
|
* debug: print interface name in dmesgJason A. Donenfeld2017-05-3111-50/+52
|
* compat: remove warning for < 4.1Jason A. Donenfeld2017-05-311-2/+0
| | | | | | | | | | | | It still is sort of experimental, I suppose, especially this part in the udp_tunnel drop-in: skb_orphan(skb); sk_mem_reclaim(sk); It seems like sometimes this won't do what we want, but it's hard to diagnose exactly what's happening. In any case, nobody paid attention to that warning anyway, so let's just get rid of it.
* config: it's faster to memcpy than strncpyJason A. Donenfeld2017-05-311-2/+1
| | | | IFNAMSIZ is 16, so this is two instructions on 64-bit.
* routingtable: Remove unnecessary check in node_placement()Sultan Alsawaf2017-05-311-2/+1
| | | | | | | node_placement() is always given the address of a stack variable for rnode, so there's no need to check if rnode is null. Signed-off-by: Sultan Alsawaf <sultanxda@gmail.com>