aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/src (follow)
Commit message (Collapse)AuthorAgeFilesLines
* wg-quick: check correct variable for route deduplicationJason A. Donenfeld2018-08-211-1/+1
| | | | Reported-by: John Sager <john@sager.me.uk>
* wg-quick: darwin: prefer system paths for toolsJason A. Donenfeld2018-08-121-1/+1
| | | | | | | | | | | | The only things wg-quick(8) needs from Homebrew are bash(1) and wg(8). Other than that, it's explicitly coded against the native system utilities. Since wg-quick(8) and bash(1) are invoked in auto_su by their full absolute path (via $SELF and $BASH, respectively), we can simply set the $PATH to be prefixed by the default system binary paths. This way, if users install tools that conflict with system tools -- such as GNU coreutils -- we won't accidently call those. Reported-by: Deirdre Connolly <durumcrustulum@gmail.com>
* version: bump snapshot0.0.20180809Jason A. Donenfeld2018-08-092-2/+2
|
* netlink: don't start over iteration on multipart non-first allowedipsJason A. Donenfeld2018-08-092-2/+28
| | | | Reported-by: Matt Layher <mdlayher@gmail.com>
* timers: include header in right fileJason A. Donenfeld2018-08-092-2/+2
|
* curve25519-hacl64: correct u64_gte_maskSamuel Neves2018-08-071-3/+1
| | | | | | | | | | | | | | | | | | | Remove signed right shifts. Previously u64_gte_mask was only correct for x < 2^63. Z3 script proving correctness: >>> from z3 import * >>> >>> x = BitVec("x", 64) >>> y = BitVec("y", 64) >>> >>> t = LShR(x^((x^y)|((x-y)^y)), 63) - 1 >>> >>> prove(If(UGE(x, y), BitVecVal(-1, 64), BitVecVal(0, 64)) == t) proved Signed-off-by: Samuel Neves <sneves@dei.uc.pt>
* curve25519-hacl64: simplify u64_eq_maskSamuel Neves2018-08-071-8/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Avoid signed right shift. Z3 script showing equivalence: >>> from z3 import * >>> >>> x = BitVec("x", 64) >>> y = BitVec("y", 64) >>> >>> # Before ... x_ = ~(x ^ y) >>> x_ &= x_ << 32 >>> x_ &= x_ << 16 >>> x_ &= x_ << 8 >>> x_ &= x_ << 4 >>> x_ &= x_ << 2 >>> x_ &= x_ << 1 >>> x_ >>= 63 >>> >>> # After ... y_ = x ^ y >>> y_ = y_ | -y_ >>> y_ = LShR(y_, 63) - 1 >>> >>> prove(x_ == y_) proved Signed-off-by: Samuel Neves <sneves@dei.uc.pt>
* chacha20: use memmove in case buffers overlapJason A. Donenfeld2018-08-071-1/+1
| | | | Suggested-by: Samuel Neves <sneves@dei.uc.pt>
* curve25519-x86_64: avoid use of r12Jason A. Donenfeld2018-08-071-107/+107
| | | | | | | This causes problems with RAP and KERNEXEC for PaX, as r12 is a reserved register. Suggested-by: PaX Team <pageexec@freemail.hu>
* qemu: add easy git harnessJason A. Donenfeld2018-08-061-1/+8
|
* chacha20poly1305: selftest: use arrays for test vectorsJason A. Donenfeld2018-08-061-777/+3577
|
* crypto: move simd context to specific typeJason A. Donenfeld2018-08-0611-147/+153
| | | | Suggested-by: Andy Lutomirski <luto@kernel.org>
* compat: better atomic acquire/release backportJason A. Donenfeld2018-08-041-16/+10
|
* send: switch handshake stamp to an atomicJason A. Donenfeld2018-08-044-14/+12
| | | | | | | | | | | Rather than abusing the handshake lock, we're much better off just using a boring atomic64 for this. It's simpler and performs better. Also, while we're at it, we set the handshake stamp both before and after the calculations, in case the calculations block for a really long time waiting for the RNG to initialize. Otherwise it's possible that when the RNG finally initializes, two handshakes are sent back to back, which isn't sensible.
* version: bump snapshot0.0.20180802Jason A. Donenfeld2018-08-032-2/+2
|
* allowedips: use different macro names so as to avoid confusionJason A. Donenfeld2018-08-031-5/+5
| | | | | | | A mailing list interlocutor argues that sharing the same macro name might lead to errors down the road. Suggested-by: Andrew Lunn <andrew@lunn.ch>
* peer: ensure destruction doesn't raceJason A. Donenfeld2018-08-0311-110/+148
| | | | | Completely rework peer removal to ensure peers don't jump between contexts and create races.
* noise: free peer references on failureJason A. Donenfeld2018-08-021-11/+11
|
* cookie: returned keypair might disappear if rcu lock not heldJason A. Donenfeld2018-08-022-14/+19
| | | | | | And in general it's good to prefer dereferencing entry.peer from a handshake object rather than a keypair object, when possible, since keypairs could disappear before their underlying peer.
* queueing: ensure strictly ordered loads and storesJason A. Donenfeld2018-08-024-5/+33
| | | | | | | We don't want a consumer to read plaintext when it's supposed to be reading ciphertext, which means we need to synchronize across cores. Suggested-by: Jann Horn <jann@thejh.net>
* queueing: document double-adding and reference conditionsJason A. Donenfeld2018-08-011-0/+12
|
* peer: ensure resources are freed when creation failsJason A. Donenfeld2018-08-011-13/+19
| | | | And in general tighten up the logic of peer creation.
* queueing: keep reference to peer after setting atomic state bitJason A. Donenfeld2018-08-012-3/+8
| | | | | | | | After we atomic_set, the peer is allowed to be freed, which means if we want to continue to reference it, we need to bump the reference count. This was introduced a few commits ago by b713ab0e when implementing some simplification suggestions.
* allowedips: free root inside of RCU callbackJason A. Donenfeld2018-08-011-8/+10
| | | | | | This reduces the amount of call_rcu invocations considerably. Suggested-by: Stephen Hemminger <stephen@networkplumber.org>
* hashtables: document immediate zeroing semanticsJason A. Donenfeld2018-08-011-0/+6
| | | | Suggested-by: Jann Horn <jann@thejh.net>
* allowedips: avoid window of disappeared peerJann Horn2018-08-011-1/+5
| | | | | | | If a peer is removed, it's possible for a lookup to momentarily return NULL, resulting in needless -ENOKEY returns. Signed-off-by: Jann Horn <jannh@google.com>
* allowedips: prevent double read in krefJason A. Donenfeld2018-08-012-17/+17
| | | | | | | | | | | | | | | | | Blocks like: if (node_placement(*trie, key, cidr, bits, &node, lock)) { node->peer = peer; return 0; } May result in a double read when adjusting the refcount, in the highly unlikely case of LTO and an overly smart compiler. While we're at it, replace rcu_assign_pointer(X, NULL); with RCU_INIT_POINTER. Reported-by: Jann Horn <jann@thejh.net>
* chacha20poly1305: selftest: split up test vector constantsJason A. Donenfeld2018-07-311-69/+210
|
* version: bump snapshot0.0.20180731Jason A. Donenfeld2018-07-312-2/+2
|
* device: adjust commentJason A. Donenfeld2018-07-311-1/+1
| | | | Suggested-by: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
* noise: use hex constant for tai64n offsetJason A. Donenfeld2018-07-311-1/+1
| | | | Suggested-by: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
* main: properly name labelJason A. Donenfeld2018-07-311-2/+2
|
* noise: remove outdated commentJason A. Donenfeld2018-07-312-5/+0
| | | | docs/protocol.md hasn't existed for 3 years.
* send: address of variable is never nullJason A. Donenfeld2018-07-311-1/+1
| | | | Reported-by: Jann Horn <jann@thejh.net>
* peer: simplify rcu reference countsJason A. Donenfeld2018-07-319-30/+23
| | | | | | | Use RCU reference counts only when we must, and otherwise use a more reasonably named function. Reported-by: Jann Horn <jann@thejh.net>
* ratelimiter: prevent init/uninit raceJason A. Donenfeld2018-07-312-4/+8
| | | | | | | Fixes a classic ABA problem that isn't actually reachable because of rtnl_lock, but it's good to be correct anyway. Reported-by: Jann Horn <jann@thejh.net>
* main: add missing chacha20poly1305 headerJason A. Donenfeld2018-07-313-3/+2
|
* curve25519-x86_64: tighten reductions modulo 2^256-38Samuel Neves2018-07-281-21/+18
| | | | | | | | | At this stage the value if C[4] is at most ((2^256-1) + 38*(2^256-1)) / 2^256 = 38, so there is no need to use a wide multiplication. Change inspired by Andy Polyakov's OpenSSL implementation. Signed-off-by: Samuel Neves <sneves@dei.uc.pt>
* curve25519-x86_64: simplify the final reduction by adding 19 beforehandSamuel Neves2018-07-281-40/+26
| | | | | | | | | | | | | | | | | | | | Correctness can be quickly verified with the following z3py script: >>> from z3 import * >>> x = BitVec("x", 256) # any 256-bit value >>> ref = URem(x, 2**255 - 19) # correct value >>> t = Extract(255, 255, x); x &= 2**255 - 1; # btrq $63, %3 >>> u = If(t != 0, BitVecVal(38, 256), BitVecVal(19, 256)) # cmovncl %k5, %k4 >>> x += u # addq %4, %0; adcq $0, %1; adcq $0, %2; adcq $0, %3; >>> t = Extract(255, 255, x); x &= 2**255 - 1; # btrq $63, %3 >>> u = If(t != 0, BitVecVal(0, 256), BitVecVal(19, 256)) # cmovncl %k5, %k4 >>> x -= u # subq %4, %0; sbbq $0, %1; sbbq $0, %2; sbbq $0, %3; >>> prove(x == ref) proved Change inspired by Andy Polyakov's OpenSSL implementation. Signed-off-by: Samuel Neves <sneves@dei.uc.pt>
* curve25519-x86_64: tighten the x25519 assemblySamuel Neves2018-07-281-3/+3
| | | | | | | | | | The wide multiplication by 38 in mul_a24_eltfp25519_1w is redundant: (2^256-1) * 121666 / 2^256 is at most 121665, and therefore a 64-bit multiplication can never overflow. Change inspired by Andy Polyakov's OpenSSL implementation. Signed-off-by: Samuel Neves <sneves@dei.uc.pt>
* qemu: update musl and kernelJason A. Donenfeld2018-07-241-2/+2
|
* wg-quick: android: remove compat codeJason A. Donenfeld2018-07-241-10/+0
|
* wg-quick: android: allow package to be overriddenJason A. Donenfeld2018-07-241-4/+9
|
* qemu: show log if process crashesJason A. Donenfeld2018-07-241-10/+16
|
* receive: check against proper return value typeJason A. Donenfeld2018-07-241-1/+1
|
* version: bump snapshot0.0.20180718Jason A. Donenfeld2018-07-182-2/+2
|
* recieve: disable NAPI busy pollingThomas Gschwantner2018-07-182-0/+10
| | | | | | | | | | | | | | This avoids adding one reference per peer to the napi_hash hashtable, as normally done by netif_napi_add(). Since we potentially could have up to 2^20 peers this would make busy polling very slow globally. This approach is preferable to having only a single napi struct because we get one gro_list per peer, which means packets can be combined nicely even if we have a large number of peers. This is also done by gro_cells_init() in net/core/gro_cells.c . Signed-off-by: Thomas Gschwantner <tharre3@gmail.com>
* device: destroy workqueue before freeing queueJason A. Donenfeld2018-07-181-1/+1
|
* wg-quick: allow link local default gatewayJason A. Donenfeld2018-07-163-3/+0
| | | | | | | It's unclear why it was like this in the first place, but it apparently broke certain IPv6 setups. Reported-by: Jonas Blahut <j@die-blahuts.de>
* receive: use gro call instead of plain callJason A. Donenfeld2018-07-121-1/+1
|
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.