From f6cea8e4ef520b13b9329f6690b574d6264e41e6 Mon Sep 17 00:00:00 2001
From: "Jason A. Donenfeld" <Jason@zx2c4.com>
Date: Fri, 10 Nov 2017 15:21:54 +0900
Subject: allowedips: rename from routingtable

Makes it more clear that this _not_ a routing table replacement.
---
 src/Kbuild                  |   2 +-
 src/allowedips.c            | 306 ++++++++++++++++++++++++++
 src/allowedips.h            |  41 ++++
 src/device.c                |   6 +-
 src/device.h                |   4 +-
 src/main.c                  |   2 +-
 src/netlink.c               |  16 +-
 src/peer.c                  |   2 +-
 src/receive.c               |   2 +-
 src/routingtable.c          | 306 --------------------------
 src/routingtable.h          |  41 ----
 src/selftest/allowedips.h   | 510 ++++++++++++++++++++++++++++++++++++++++++++
 src/selftest/routingtable.h | 510 --------------------------------------------
 13 files changed, 874 insertions(+), 874 deletions(-)
 create mode 100644 src/allowedips.c
 create mode 100644 src/allowedips.h
 delete mode 100644 src/routingtable.c
 delete mode 100644 src/routingtable.h
 create mode 100644 src/selftest/allowedips.h
 delete mode 100644 src/selftest/routingtable.h

(limited to 'src')

diff --git a/src/Kbuild b/src/Kbuild
index afbe4be..2ef4efd 100644
--- a/src/Kbuild
+++ b/src/Kbuild
@@ -2,7 +2,7 @@ ccflags-y := -O3 -fvisibility=hidden
 ccflags-$(CONFIG_WIREGUARD_DEBUG) += -DDEBUG -g
 ccflags-y += -Wframe-larger-than=8192
 ccflags-y += -D'pr_fmt(fmt)=KBUILD_MODNAME ": " fmt'
-wireguard-y := main.o noise.o device.o peer.o timers.o queueing.o send.o receive.o socket.o hashtables.o routingtable.o ratelimiter.o cookie.o netlink.o
+wireguard-y := main.o noise.o device.o peer.o timers.o queueing.o send.o receive.o socket.o hashtables.o allowedips.o ratelimiter.o cookie.o netlink.o
 wireguard-y += crypto/curve25519.o crypto/chacha20poly1305.o crypto/blake2s.o
 
 ifeq ($(CONFIG_X86_64),y)
diff --git a/src/allowedips.c b/src/allowedips.c
new file mode 100644
index 0000000..279bdd4
--- /dev/null
+++ b/src/allowedips.c
@@ -0,0 +1,306 @@
+/* Copyright (C) 2015-2017 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved. */
+
+#include "allowedips.h"
+#include "peer.h"
+
+struct allowedips_node {
+	struct allowedips_node __rcu *bit[2];
+	struct rcu_head rcu;
+	struct wireguard_peer *peer;
+	u8 cidr, bit_at_a, bit_at_b;
+	u8 bits[] __aligned(__alignof__(u64));
+};
+
+static inline void copy_and_assign_cidr(struct allowedips_node *node, const u8 *src, u8 cidr)
+{
+	memcpy(node->bits, src, (cidr + 7) / 8);
+	node->bits[(cidr + 7) / 8 - 1] &= 0xffU << ((8 - (cidr % 8)) % 8);
+	node->cidr = cidr;
+	node->bit_at_a = cidr / 8;
+	node->bit_at_b = 7 - (cidr % 8);
+}
+#define choose_node(parent, key) parent->bit[(key[parent->bit_at_a] >> parent->bit_at_b) & 1]
+
+static void node_free_rcu(struct rcu_head *rcu)
+{
+	kfree(container_of(rcu, struct allowedips_node, rcu));
+}
+
+#define push(stack, p, len) ({ \
+	if (rcu_access_pointer(p)) { \
+		BUG_ON(len >= 128); \
+		stack[len++] = rcu_dereference_protected(p, lockdep_is_held(lock)); \
+	} \
+	true; \
+})
+static void free_root_node(struct allowedips_node __rcu *top, struct mutex *lock)
+{
+	struct allowedips_node *stack[128], *node;
+	unsigned int len;
+
+	for (len = 0, push(stack, top, len); len > 0 && (node = stack[--len]) && push(stack, node->bit[0], len) && push(stack, node->bit[1], len);)
+		call_rcu_bh(&node->rcu, node_free_rcu);
+}
+
+static int walk_by_peer(struct allowedips_node __rcu *top, int family, struct allowedips_cursor *cursor, struct wireguard_peer *peer, int (*func)(void *ctx, const u8 *ip, u8 cidr, int family), void *ctx, struct mutex *lock)
+{
+	struct allowedips_node *node;
+	int ret;
+
+	if (!rcu_access_pointer(top))
+		return 0;
+
+	if (!cursor->len)
+		push(cursor->stack, top, cursor->len);
+
+	for (; cursor->len > 0 && (node = cursor->stack[cursor->len - 1]); --cursor->len, push(cursor->stack, node->bit[0], cursor->len), push(cursor->stack, node->bit[1], cursor->len)) {
+		if (node->peer != peer)
+			continue;
+		ret = func(ctx, node->bits, node->cidr, family);
+		if (ret)
+			return ret;
+	}
+	return 0;
+}
+#undef push
+
+#define ref(p) rcu_access_pointer(p)
+#define deref(p) rcu_dereference_protected(*p, lockdep_is_held(lock))
+#define push(p) ({ BUG_ON(len >= 128); stack[len++] = p; })
+static void walk_remove_by_peer(struct allowedips_node __rcu **top, struct wireguard_peer *peer, struct mutex *lock)
+{
+	struct allowedips_node __rcu **stack[128], **nptr;
+	struct allowedips_node *node, *prev;
+	unsigned int len;
+
+	if (unlikely(!peer || !ref(*top)))
+		return;
+
+	for (prev = NULL, len = 0, push(top); len > 0; prev = node) {
+		nptr = stack[len - 1];
+		node = deref(nptr);
+		if (!node) {
+			--len;
+			continue;
+		}
+		if (!prev || ref(prev->bit[0]) == node || ref(prev->bit[1]) == node) {
+			if (ref(node->bit[0]))
+				push(&node->bit[0]);
+			else if (ref(node->bit[1]))
+				push(&node->bit[1]);
+		} else if (ref(node->bit[0]) == prev) {
+			if (ref(node->bit[1]))
+				push(&node->bit[1]);
+		} else {
+			if (node->peer == peer) {
+				node->peer = NULL;
+				if (!node->bit[0] || !node->bit[1]) {
+					rcu_assign_pointer(*nptr, deref(&node->bit[!ref(node->bit[0])]));
+					call_rcu_bh(&node->rcu, node_free_rcu);
+					node = deref(nptr);
+				}
+			}
+			--len;
+		}
+	}
+}
+#undef ref
+#undef deref
+#undef push
+
+static __always_inline unsigned int fls128(u64 a, u64 b)
+{
+	return a ? fls64(a) + 64 : fls64(b);
+}
+
+static __always_inline u8 common_bits(const struct allowedips_node *node, const u8 *key, u8 bits)
+{
+	if (bits == 32)
+		return 32 - fls(be32_to_cpu(*(const __be32 *)node->bits ^ *(const __be32 *)key));
+	else if (bits == 128)
+		return 128 - fls128(be64_to_cpu(*(const __be64 *)&node->bits[0] ^ *(const __be64 *)&key[0]), be64_to_cpu(*(const __be64 *)&node->bits[8] ^ *(const __be64 *)&key[8]));
+	return 0;
+}
+
+static inline struct allowedips_node *find_node(struct allowedips_node *trie, u8 bits, const u8 *key)
+{
+	struct allowedips_node *node = trie, *found = NULL;
+
+	while (node && common_bits(node, key, bits) >= node->cidr) {
+		if (node->peer)
+			found = node;
+		if (node->cidr == bits)
+			break;
+		node = rcu_dereference_bh(choose_node(node, key));
+	}
+	return found;
+}
+
+/* Returns a strong reference to a peer */
+static inline struct wireguard_peer *lookup(struct allowedips_node __rcu *root, u8 bits, const void *ip)
+{
+	struct wireguard_peer *peer = NULL;
+	struct allowedips_node *node;
+
+	rcu_read_lock_bh();
+	node = find_node(rcu_dereference_bh(root), bits, ip);
+	if (node)
+		peer = peer_get(node->peer);
+	rcu_read_unlock_bh();
+	return peer;
+}
+
+static inline bool node_placement(struct allowedips_node __rcu *trie, const u8 *key, u8 cidr, u8 bits, struct allowedips_node **rnode, struct mutex *lock)
+{
+	bool exact = false;
+	struct allowedips_node *parent = NULL, *node = rcu_dereference_protected(trie, lockdep_is_held(lock));
+
+	while (node && node->cidr <= cidr && common_bits(node, key, bits) >= node->cidr) {
+		parent = node;
+		if (parent->cidr == cidr) {
+			exact = true;
+			break;
+		}
+		node = rcu_dereference_protected(choose_node(parent, key), lockdep_is_held(lock));
+	}
+	*rnode = parent;
+	return exact;
+}
+
+static int add(struct allowedips_node __rcu **trie, u8 bits, const u8 *key, u8 cidr, struct wireguard_peer *peer, struct mutex *lock)
+{
+	struct allowedips_node *node, *parent, *down, *newnode;
+
+	if (unlikely(cidr > bits || !peer))
+		return -EINVAL;
+
+	if (!rcu_access_pointer(*trie)) {
+		node = kzalloc(sizeof(*node) + (bits + 7) / 8, GFP_KERNEL);
+		if (!node)
+			return -ENOMEM;
+		node->peer = peer;
+		copy_and_assign_cidr(node, key, cidr);
+		rcu_assign_pointer(*trie, node);
+		return 0;
+	}
+	if (node_placement(*trie, key, cidr, bits, &node, lock)) {
+		node->peer = peer;
+		return 0;
+	}
+
+	newnode = kzalloc(sizeof(*node) + (bits + 7) / 8, GFP_KERNEL);
+	if (!newnode)
+		return -ENOMEM;
+	newnode->peer = peer;
+	copy_and_assign_cidr(newnode, key, cidr);
+
+	if (!node)
+		down = rcu_dereference_protected(*trie, lockdep_is_held(lock));
+	else {
+		down = rcu_dereference_protected(choose_node(node, key), lockdep_is_held(lock));
+		if (!down) {
+			rcu_assign_pointer(choose_node(node, key), newnode);
+			return 0;
+		}
+	}
+	cidr = min(cidr, common_bits(down, key, bits));
+	parent = node;
+
+	if (newnode->cidr == cidr) {
+		rcu_assign_pointer(choose_node(newnode, down->bits), down);
+		if (!parent)
+			rcu_assign_pointer(*trie, newnode);
+		else
+			rcu_assign_pointer(choose_node(parent, newnode->bits), newnode);
+	} else {
+		node = kzalloc(sizeof(*node) + (bits + 7) / 8, GFP_KERNEL);
+		if (!node) {
+			kfree(newnode);
+			return -ENOMEM;
+		}
+		copy_and_assign_cidr(node, newnode->bits, cidr);
+
+		rcu_assign_pointer(choose_node(node, down->bits), down);
+		rcu_assign_pointer(choose_node(node, newnode->bits), newnode);
+		if (!parent)
+			rcu_assign_pointer(*trie, node);
+		else
+			rcu_assign_pointer(choose_node(parent, node->bits), node);
+	}
+	return 0;
+}
+
+void allowedips_init(struct allowedips *table)
+{
+	table->root4 = table->root6 = NULL;
+	table->seq = 1;
+}
+
+void allowedips_free(struct allowedips *table, struct mutex *lock)
+{
+	++table->seq;
+	free_root_node(table->root4, lock);
+	rcu_assign_pointer(table->root4, NULL);
+	free_root_node(table->root6, lock);
+	rcu_assign_pointer(table->root6, NULL);
+}
+
+int allowedips_insert_v4(struct allowedips *table, const struct in_addr *ip, u8 cidr, struct wireguard_peer *peer, struct mutex *lock)
+{
+	++table->seq;
+	return add(&table->root4, 32, (const u8 *)ip, cidr, peer, lock);
+}
+
+int allowedips_insert_v6(struct allowedips *table, const struct in6_addr *ip, u8 cidr, struct wireguard_peer *peer, struct mutex *lock)
+{
+	++table->seq;
+	return add(&table->root6, 128, (const u8 *)ip, cidr, peer, lock);
+}
+
+void allowedips_remove_by_peer(struct allowedips *table, struct wireguard_peer *peer, struct mutex *lock)
+{
+	++table->seq;
+	walk_remove_by_peer(&table->root4, peer, lock);
+	walk_remove_by_peer(&table->root6, peer, lock);
+}
+
+int allowedips_walk_by_peer(struct allowedips *table, struct allowedips_cursor *cursor, struct wireguard_peer *peer, int (*func)(void *ctx, const u8 *ip, u8 cidr, int family), void *ctx, struct mutex *lock)
+{
+	int ret;
+
+	if (!cursor->seq)
+		cursor->seq = table->seq;
+	else if (cursor->seq != table->seq)
+		return 0;
+
+	if (!cursor->second_half) {
+		ret = walk_by_peer(table->root4, AF_INET, cursor, peer, func, ctx, lock);
+		if (ret)
+			return ret;
+		cursor->len = 0;
+		cursor->second_half = true;
+	}
+	return walk_by_peer(table->root6, AF_INET6, cursor, peer, func, ctx, lock);
+}
+
+/* Returns a strong reference to a peer */
+struct wireguard_peer *allowedips_lookup_dst(struct allowedips *table, struct sk_buff *skb)
+{
+	if (skb->protocol == htons(ETH_P_IP))
+		return lookup(table->root4, 32, &ip_hdr(skb)->daddr);
+	else if (skb->protocol == htons(ETH_P_IPV6))
+		return lookup(table->root6, 128, &ipv6_hdr(skb)->daddr);
+	return NULL;
+}
+
+/* Returns a strong reference to a peer */
+struct wireguard_peer *allowedips_lookup_src(struct allowedips *table, struct sk_buff *skb)
+{
+	if (skb->protocol == htons(ETH_P_IP))
+		return lookup(table->root4, 32, &ip_hdr(skb)->saddr);
+	else if (skb->protocol == htons(ETH_P_IPV6))
+		return lookup(table->root6, 128, &ipv6_hdr(skb)->saddr);
+	return NULL;
+}
+
+#include "selftest/allowedips.h"
diff --git a/src/allowedips.h b/src/allowedips.h
new file mode 100644
index 0000000..53e674b
--- /dev/null
+++ b/src/allowedips.h
@@ -0,0 +1,41 @@
+/* Copyright (C) 2015-2017 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved. */
+
+#ifndef _WG_ALLOWEDIPS_H
+#define _WG_ALLOWEDIPS_H
+
+#include <linux/mutex.h>
+#include <linux/ip.h>
+#include <linux/ipv6.h>
+
+struct wireguard_peer;
+struct allowedips_node;
+
+struct allowedips {
+	struct allowedips_node __rcu *root4;
+	struct allowedips_node __rcu *root6;
+	u64 seq;
+};
+
+struct allowedips_cursor {
+	u64 seq;
+	struct allowedips_node *stack[128];
+	unsigned int len;
+	bool second_half;
+};
+
+void allowedips_init(struct allowedips *table);
+void allowedips_free(struct allowedips *table, struct mutex *mutex);
+int allowedips_insert_v4(struct allowedips *table, const struct in_addr *ip, u8 cidr, struct wireguard_peer *peer, struct mutex *lock);
+int allowedips_insert_v6(struct allowedips *table, const struct in6_addr *ip, u8 cidr, struct wireguard_peer *peer, struct mutex *lock);
+void allowedips_remove_by_peer(struct allowedips *table, struct wireguard_peer *peer, struct mutex *lock);
+int allowedips_walk_by_peer(struct allowedips *table, struct allowedips_cursor *cursor, struct wireguard_peer *peer, int (*func)(void *ctx, const u8 *ip, u8 cidr, int family), void *ctx, struct mutex *lock);
+
+/* These return a strong reference to a peer: */
+struct wireguard_peer *allowedips_lookup_dst(struct allowedips *table, struct sk_buff *skb);
+struct wireguard_peer *allowedips_lookup_src(struct allowedips *table, struct sk_buff *skb);
+
+#ifdef DEBUG
+bool allowedips_selftest(void);
+#endif
+
+#endif /* _WG_ALLOWEDIPS_H */
diff --git a/src/device.c b/src/device.c
index 633ae9c..ffc36b4 100644
--- a/src/device.c
+++ b/src/device.c
@@ -124,7 +124,7 @@ static netdev_tx_t xmit(struct sk_buff *skb, struct net_device *dev)
 		goto err;
 	}
 
-	peer = routing_table_lookup_dst(&wg->peer_routing_table, skb);
+	peer = allowedips_lookup_dst(&wg->peer_allowedips, skb);
 	if (unlikely(!peer)) {
 		ret = -ENOKEY;
 		net_dbg_skb_ratelimited("%s: No peer is configured for %pISc\n", dev->name, skb);
@@ -216,7 +216,7 @@ static void destruct(struct net_device *dev)
 	packet_queue_free(&wg->encrypt_queue, true);
 	destroy_workqueue(wg->packet_crypt_wq);
 	rcu_barrier_bh(); /* Wait for all the peers to be actually freed. */
-	routing_table_free(&wg->peer_routing_table, &wg->device_update_lock);
+	allowedips_free(&wg->peer_allowedips, &wg->device_update_lock);
 	ratelimiter_uninit();
 	memzero_explicit(&wg->static_identity, sizeof(struct noise_static_identity));
 	skb_queue_purge(&wg->incoming_handshakes);
@@ -273,7 +273,7 @@ static int newlink(struct net *src_net, struct net_device *dev, struct nlattr *t
 	skb_queue_head_init(&wg->incoming_handshakes);
 	pubkey_hashtable_init(&wg->peer_hashtable);
 	index_hashtable_init(&wg->index_hashtable);
-	routing_table_init(&wg->peer_routing_table);
+	allowedips_init(&wg->peer_allowedips);
 	cookie_checker_init(&wg->cookie_checker, wg);
 	INIT_LIST_HEAD(&wg->peer_list);
 	wg->device_update_gen = 1;
diff --git a/src/device.h b/src/device.h
index 6ec3cb2..7b305a3 100644
--- a/src/device.h
+++ b/src/device.h
@@ -4,7 +4,7 @@
 #define _WG_DEVICE_H
 
 #include "noise.h"
-#include "routingtable.h"
+#include "allowedips.h"
 #include "hashtables.h"
 #include "cookie.h"
 
@@ -46,7 +46,7 @@ struct wireguard_device {
 	struct cookie_checker cookie_checker;
 	struct pubkey_hashtable peer_hashtable;
 	struct index_hashtable index_hashtable;
-	struct routing_table peer_routing_table;
+	struct allowedips peer_allowedips;
 	struct mutex device_update_lock, socket_update_lock;
 	struct list_head device_list, peer_list;
 	unsigned int num_peers, device_update_gen;
diff --git a/src/main.c b/src/main.c
index ea11858..be5a42b 100644
--- a/src/main.c
+++ b/src/main.c
@@ -25,7 +25,7 @@ static int __init mod_init(void)
 	blake2s_fpu_init();
 	curve25519_fpu_init();
 #ifdef DEBUG
-	if (!routing_table_selftest() || !packet_counter_selftest() || !curve25519_selftest() || !chacha20poly1305_selftest() || !blake2s_selftest() || !ratelimiter_selftest())
+	if (!allowedips_selftest() || !packet_counter_selftest() || !curve25519_selftest() || !chacha20poly1305_selftest() || !blake2s_selftest() || !ratelimiter_selftest())
 		return -ENOTRECOVERABLE;
 #endif
 	noise_init();
diff --git a/src/netlink.c b/src/netlink.c
index 0c37a6c..ba9e41b 100644
--- a/src/netlink.c
+++ b/src/netlink.c
@@ -85,7 +85,7 @@ static int get_allowedips(void *ctx, const u8 *ip, u8 cidr, int family)
 	return 0;
 }
 
-static int get_peer(struct wireguard_peer *peer, unsigned int index, struct routing_table_cursor *rt_cursor, struct sk_buff *skb)
+static int get_peer(struct wireguard_peer *peer, unsigned int index, struct allowedips_cursor *rt_cursor, struct sk_buff *skb)
 {
 	struct allowedips_ctx ctx = { .skb = skb };
 	struct nlattr *allowedips_nest, *peer_nest = nla_nest_start(skb, index);
@@ -124,7 +124,7 @@ static int get_peer(struct wireguard_peer *peer, unsigned int index, struct rout
 	allowedips_nest = nla_nest_start(skb, WGPEER_A_ALLOWEDIPS);
 	if (!allowedips_nest)
 		goto err;
-	if (routing_table_walk_by_peer(&peer->device->peer_routing_table, rt_cursor, peer, get_allowedips, &ctx, &peer->device->device_update_lock)) {
+	if (allowedips_walk_by_peer(&peer->device->peer_allowedips, rt_cursor, peer, get_allowedips, &ctx, &peer->device->device_update_lock)) {
 		nla_nest_end(skb, allowedips_nest);
 		nla_nest_end(skb, peer_nest);
 		return -EMSGSIZE;
@@ -146,7 +146,7 @@ static int get_device_start(struct netlink_callback *cb)
 
 	if (ret < 0)
 		return ret;
-	cb->args[2] = (long)kzalloc(sizeof(struct routing_table_cursor), GFP_KERNEL);
+	cb->args[2] = (long)kzalloc(sizeof(struct allowedips_cursor), GFP_KERNEL);
 	if (!cb->args[2])
 		return -ENOMEM;
 	wg = lookup_interface(attrs, cb->skb);
@@ -163,7 +163,7 @@ static int get_device_dump(struct sk_buff *skb, struct netlink_callback *cb)
 {
 	struct wireguard_device *wg = (struct wireguard_device *)cb->args[0];
 	struct wireguard_peer *peer, *next_peer_cursor = NULL, *last_peer_cursor = (struct wireguard_peer *)cb->args[1];
-	struct routing_table_cursor *rt_cursor = (struct routing_table_cursor *)cb->args[2];
+	struct allowedips_cursor *rt_cursor = (struct allowedips_cursor *)cb->args[2];
 	unsigned int peer_idx = 0;
 	struct nlattr *peers_nest;
 	bool done = true;
@@ -245,7 +245,7 @@ static int get_device_done(struct netlink_callback *cb)
 {
 	struct wireguard_device *wg = (struct wireguard_device *)cb->args[0];
 	struct wireguard_peer *peer = (struct wireguard_peer *)cb->args[1];
-	struct routing_table_cursor *rt_cursor = (struct routing_table_cursor *)cb->args[2];
+	struct allowedips_cursor *rt_cursor = (struct allowedips_cursor *)cb->args[2];
 
 	if (wg)
 		dev_put(wg->dev);
@@ -281,9 +281,9 @@ static int set_allowedip(struct wireguard_peer *peer, struct nlattr **attrs)
 	cidr = nla_get_u8(attrs[WGALLOWEDIP_A_CIDR_MASK]);
 
 	if (family == AF_INET && cidr <= 32 && nla_len(attrs[WGALLOWEDIP_A_IPADDR]) == sizeof(struct in_addr))
-		ret = routing_table_insert_v4(&peer->device->peer_routing_table, nla_data(attrs[WGALLOWEDIP_A_IPADDR]), cidr, peer, &peer->device->device_update_lock);
+		ret = allowedips_insert_v4(&peer->device->peer_allowedips, nla_data(attrs[WGALLOWEDIP_A_IPADDR]), cidr, peer, &peer->device->device_update_lock);
 	else if (family == AF_INET6 && cidr <= 128 && nla_len(attrs[WGALLOWEDIP_A_IPADDR]) == sizeof(struct in6_addr))
-		ret = routing_table_insert_v6(&peer->device->peer_routing_table, nla_data(attrs[WGALLOWEDIP_A_IPADDR]), cidr, peer, &peer->device->device_update_lock);
+		ret = allowedips_insert_v6(&peer->device->peer_allowedips, nla_data(attrs[WGALLOWEDIP_A_IPADDR]), cidr, peer, &peer->device->device_update_lock);
 
 	return ret;
 }
@@ -353,7 +353,7 @@ static int set_peer(struct wireguard_device *wg, struct nlattr **attrs)
 	}
 
 	if (flags & WGPEER_F_REPLACE_ALLOWEDIPS)
-		routing_table_remove_by_peer(&wg->peer_routing_table, peer, &wg->device_update_lock);
+		allowedips_remove_by_peer(&wg->peer_allowedips, peer, &wg->device_update_lock);
 
 	if (attrs[WGPEER_A_ALLOWEDIPS]) {
 		int rem;
diff --git a/src/peer.c b/src/peer.c
index 81b71d4..6ff14f4 100644
--- a/src/peer.c
+++ b/src/peer.c
@@ -81,7 +81,7 @@ void peer_remove(struct wireguard_peer *peer)
 	if (unlikely(!peer))
 		return;
 	lockdep_assert_held(&peer->device->device_update_lock);
-	routing_table_remove_by_peer(&peer->device->peer_routing_table, peer, &peer->device->device_update_lock);
+	allowedips_remove_by_peer(&peer->device->peer_allowedips, peer, &peer->device->device_update_lock);
 	pubkey_hashtable_remove(&peer->device->peer_hashtable, peer);
 	skb_queue_purge(&peer->staged_packet_queue);
 	noise_handshake_clear(&peer->handshake);
diff --git a/src/receive.c b/src/receive.c
index 7f9d1d7..080f6ba 100644
--- a/src/receive.c
+++ b/src/receive.c
@@ -329,7 +329,7 @@ static void packet_consume_data_done(struct sk_buff *skb, struct endpoint *endpo
 
 	timers_data_received(peer);
 
-	routed_peer = routing_table_lookup_src(&peer->device->peer_routing_table, skb);
+	routed_peer = allowedips_lookup_src(&peer->device->peer_allowedips, skb);
 	peer_put(routed_peer); /* We don't need the extra reference. */
 
 	if (unlikely(routed_peer != peer))
diff --git a/src/routingtable.c b/src/routingtable.c
deleted file mode 100644
index 6cbea3d..0000000
--- a/src/routingtable.c
+++ /dev/null
@@ -1,306 +0,0 @@
-/* Copyright (C) 2015-2017 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved. */
-
-#include "routingtable.h"
-#include "peer.h"
-
-struct routing_table_node {
-	struct routing_table_node __rcu *bit[2];
-	struct rcu_head rcu;
-	struct wireguard_peer *peer;
-	u8 cidr, bit_at_a, bit_at_b;
-	u8 bits[] __aligned(__alignof__(u64));
-};
-
-static inline void copy_and_assign_cidr(struct routing_table_node *node, const u8 *src, u8 cidr)
-{
-	memcpy(node->bits, src, (cidr + 7) / 8);
-	node->bits[(cidr + 7) / 8 - 1] &= 0xffU << ((8 - (cidr % 8)) % 8);
-	node->cidr = cidr;
-	node->bit_at_a = cidr / 8;
-	node->bit_at_b = 7 - (cidr % 8);
-}
-#define choose_node(parent, key) parent->bit[(key[parent->bit_at_a] >> parent->bit_at_b) & 1]
-
-static void node_free_rcu(struct rcu_head *rcu)
-{
-	kfree(container_of(rcu, struct routing_table_node, rcu));
-}
-
-#define push(stack, p, len) ({ \
-	if (rcu_access_pointer(p)) { \
-		BUG_ON(len >= 128); \
-		stack[len++] = rcu_dereference_protected(p, lockdep_is_held(lock)); \
-	} \
-	true; \
-})
-static void free_root_node(struct routing_table_node __rcu *top, struct mutex *lock)
-{
-	struct routing_table_node *stack[128], *node;
-	unsigned int len;
-
-	for (len = 0, push(stack, top, len); len > 0 && (node = stack[--len]) && push(stack, node->bit[0], len) && push(stack, node->bit[1], len);)
-		call_rcu_bh(&node->rcu, node_free_rcu);
-}
-
-static int walk_by_peer(struct routing_table_node __rcu *top, int family, struct routing_table_cursor *cursor, struct wireguard_peer *peer, int (*func)(void *ctx, const u8 *ip, u8 cidr, int family), void *ctx, struct mutex *lock)
-{
-	struct routing_table_node *node;
-	int ret;
-
-	if (!rcu_access_pointer(top))
-		return 0;
-
-	if (!cursor->len)
-		push(cursor->stack, top, cursor->len);
-
-	for (; cursor->len > 0 && (node = cursor->stack[cursor->len - 1]); --cursor->len, push(cursor->stack, node->bit[0], cursor->len), push(cursor->stack, node->bit[1], cursor->len)) {
-		if (node->peer != peer)
-			continue;
-		ret = func(ctx, node->bits, node->cidr, family);
-		if (ret)
-			return ret;
-	}
-	return 0;
-}
-#undef push
-
-#define ref(p) rcu_access_pointer(p)
-#define deref(p) rcu_dereference_protected(*p, lockdep_is_held(lock))
-#define push(p) ({ BUG_ON(len >= 128); stack[len++] = p; })
-static void walk_remove_by_peer(struct routing_table_node __rcu **top, struct wireguard_peer *peer, struct mutex *lock)
-{
-	struct routing_table_node __rcu **stack[128], **nptr;
-	struct routing_table_node *node, *prev;
-	unsigned int len;
-
-	if (unlikely(!peer || !ref(*top)))
-		return;
-
-	for (prev = NULL, len = 0, push(top); len > 0; prev = node) {
-		nptr = stack[len - 1];
-		node = deref(nptr);
-		if (!node) {
-			--len;
-			continue;
-		}
-		if (!prev || ref(prev->bit[0]) == node || ref(prev->bit[1]) == node) {
-			if (ref(node->bit[0]))
-				push(&node->bit[0]);
-			else if (ref(node->bit[1]))
-				push(&node->bit[1]);
-		} else if (ref(node->bit[0]) == prev) {
-			if (ref(node->bit[1]))
-				push(&node->bit[1]);
-		} else {
-			if (node->peer == peer) {
-				node->peer = NULL;
-				if (!node->bit[0] || !node->bit[1]) {
-					rcu_assign_pointer(*nptr, deref(&node->bit[!ref(node->bit[0])]));
-					call_rcu_bh(&node->rcu, node_free_rcu);
-					node = deref(nptr);
-				}
-			}
-			--len;
-		}
-	}
-}
-#undef ref
-#undef deref
-#undef push
-
-static __always_inline unsigned int fls128(u64 a, u64 b)
-{
-	return a ? fls64(a) + 64 : fls64(b);
-}
-
-static __always_inline u8 common_bits(const struct routing_table_node *node, const u8 *key, u8 bits)
-{
-	if (bits == 32)
-		return 32 - fls(be32_to_cpu(*(const __be32 *)node->bits ^ *(const __be32 *)key));
-	else if (bits == 128)
-		return 128 - fls128(be64_to_cpu(*(const __be64 *)&node->bits[0] ^ *(const __be64 *)&key[0]), be64_to_cpu(*(const __be64 *)&node->bits[8] ^ *(const __be64 *)&key[8]));
-	return 0;
-}
-
-static inline struct routing_table_node *find_node(struct routing_table_node *trie, u8 bits, const u8 *key)
-{
-	struct routing_table_node *node = trie, *found = NULL;
-
-	while (node && common_bits(node, key, bits) >= node->cidr) {
-		if (node->peer)
-			found = node;
-		if (node->cidr == bits)
-			break;
-		node = rcu_dereference_bh(choose_node(node, key));
-	}
-	return found;
-}
-
-/* Returns a strong reference to a peer */
-static inline struct wireguard_peer *lookup(struct routing_table_node __rcu *root, u8 bits, const void *ip)
-{
-	struct wireguard_peer *peer = NULL;
-	struct routing_table_node *node;
-
-	rcu_read_lock_bh();
-	node = find_node(rcu_dereference_bh(root), bits, ip);
-	if (node)
-		peer = peer_get(node->peer);
-	rcu_read_unlock_bh();
-	return peer;
-}
-
-static inline bool node_placement(struct routing_table_node __rcu *trie, const u8 *key, u8 cidr, u8 bits, struct routing_table_node **rnode, struct mutex *lock)
-{
-	bool exact = false;
-	struct routing_table_node *parent = NULL, *node = rcu_dereference_protected(trie, lockdep_is_held(lock));
-
-	while (node && node->cidr <= cidr && common_bits(node, key, bits) >= node->cidr) {
-		parent = node;
-		if (parent->cidr == cidr) {
-			exact = true;
-			break;
-		}
-		node = rcu_dereference_protected(choose_node(parent, key), lockdep_is_held(lock));
-	}
-	*rnode = parent;
-	return exact;
-}
-
-static int add(struct routing_table_node __rcu **trie, u8 bits, const u8 *key, u8 cidr, struct wireguard_peer *peer, struct mutex *lock)
-{
-	struct routing_table_node *node, *parent, *down, *newnode;
-
-	if (unlikely(cidr > bits || !peer))
-		return -EINVAL;
-
-	if (!rcu_access_pointer(*trie)) {
-		node = kzalloc(sizeof(*node) + (bits + 7) / 8, GFP_KERNEL);
-		if (!node)
-			return -ENOMEM;
-		node->peer = peer;
-		copy_and_assign_cidr(node, key, cidr);
-		rcu_assign_pointer(*trie, node);
-		return 0;
-	}
-	if (node_placement(*trie, key, cidr, bits, &node, lock)) {
-		node->peer = peer;
-		return 0;
-	}
-
-	newnode = kzalloc(sizeof(*node) + (bits + 7) / 8, GFP_KERNEL);
-	if (!newnode)
-		return -ENOMEM;
-	newnode->peer = peer;
-	copy_and_assign_cidr(newnode, key, cidr);
-
-	if (!node)
-		down = rcu_dereference_protected(*trie, lockdep_is_held(lock));
-	else {
-		down = rcu_dereference_protected(choose_node(node, key), lockdep_is_held(lock));
-		if (!down) {
-			rcu_assign_pointer(choose_node(node, key), newnode);
-			return 0;
-		}
-	}
-	cidr = min(cidr, common_bits(down, key, bits));
-	parent = node;
-
-	if (newnode->cidr == cidr) {
-		rcu_assign_pointer(choose_node(newnode, down->bits), down);
-		if (!parent)
-			rcu_assign_pointer(*trie, newnode);
-		else
-			rcu_assign_pointer(choose_node(parent, newnode->bits), newnode);
-	} else {
-		node = kzalloc(sizeof(*node) + (bits + 7) / 8, GFP_KERNEL);
-		if (!node) {
-			kfree(newnode);
-			return -ENOMEM;
-		}
-		copy_and_assign_cidr(node, newnode->bits, cidr);
-
-		rcu_assign_pointer(choose_node(node, down->bits), down);
-		rcu_assign_pointer(choose_node(node, newnode->bits), newnode);
-		if (!parent)
-			rcu_assign_pointer(*trie, node);
-		else
-			rcu_assign_pointer(choose_node(parent, node->bits), node);
-	}
-	return 0;
-}
-
-void routing_table_init(struct routing_table *table)
-{
-	table->root4 = table->root6 = NULL;
-	table->seq = 1;
-}
-
-void routing_table_free(struct routing_table *table, struct mutex *lock)
-{
-	++table->seq;
-	free_root_node(table->root4, lock);
-	rcu_assign_pointer(table->root4, NULL);
-	free_root_node(table->root6, lock);
-	rcu_assign_pointer(table->root6, NULL);
-}
-
-int routing_table_insert_v4(struct routing_table *table, const struct in_addr *ip, u8 cidr, struct wireguard_peer *peer, struct mutex *lock)
-{
-	++table->seq;
-	return add(&table->root4, 32, (const u8 *)ip, cidr, peer, lock);
-}
-
-int routing_table_insert_v6(struct routing_table *table, const struct in6_addr *ip, u8 cidr, struct wireguard_peer *peer, struct mutex *lock)
-{
-	++table->seq;
-	return add(&table->root6, 128, (const u8 *)ip, cidr, peer, lock);
-}
-
-void routing_table_remove_by_peer(struct routing_table *table, struct wireguard_peer *peer, struct mutex *lock)
-{
-	++table->seq;
-	walk_remove_by_peer(&table->root4, peer, lock);
-	walk_remove_by_peer(&table->root6, peer, lock);
-}
-
-int routing_table_walk_by_peer(struct routing_table *table, struct routing_table_cursor *cursor, struct wireguard_peer *peer, int (*func)(void *ctx, const u8 *ip, u8 cidr, int family), void *ctx, struct mutex *lock)
-{
-	int ret;
-
-	if (!cursor->seq)
-		cursor->seq = table->seq;
-	else if (cursor->seq != table->seq)
-		return 0;
-
-	if (!cursor->second_half) {
-		ret = walk_by_peer(table->root4, AF_INET, cursor, peer, func, ctx, lock);
-		if (ret)
-			return ret;
-		cursor->len = 0;
-		cursor->second_half = true;
-	}
-	return walk_by_peer(table->root6, AF_INET6, cursor, peer, func, ctx, lock);
-}
-
-/* Returns a strong reference to a peer */
-struct wireguard_peer *routing_table_lookup_dst(struct routing_table *table, struct sk_buff *skb)
-{
-	if (skb->protocol == htons(ETH_P_IP))
-		return lookup(table->root4, 32, &ip_hdr(skb)->daddr);
-	else if (skb->protocol == htons(ETH_P_IPV6))
-		return lookup(table->root6, 128, &ipv6_hdr(skb)->daddr);
-	return NULL;
-}
-
-/* Returns a strong reference to a peer */
-struct wireguard_peer *routing_table_lookup_src(struct routing_table *table, struct sk_buff *skb)
-{
-	if (skb->protocol == htons(ETH_P_IP))
-		return lookup(table->root4, 32, &ip_hdr(skb)->saddr);
-	else if (skb->protocol == htons(ETH_P_IPV6))
-		return lookup(table->root6, 128, &ipv6_hdr(skb)->saddr);
-	return NULL;
-}
-
-#include "selftest/routingtable.h"
diff --git a/src/routingtable.h b/src/routingtable.h
deleted file mode 100644
index d8666f8..0000000
--- a/src/routingtable.h
+++ /dev/null
@@ -1,41 +0,0 @@
-/* Copyright (C) 2015-2017 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved. */
-
-#ifndef _WG_ROUTINGTABLE_H
-#define _WG_ROUTINGTABLE_H
-
-#include <linux/mutex.h>
-#include <linux/ip.h>
-#include <linux/ipv6.h>
-
-struct wireguard_peer;
-struct routing_table_node;
-
-struct routing_table {
-	struct routing_table_node __rcu *root4;
-	struct routing_table_node __rcu *root6;
-	u64 seq;
-};
-
-struct routing_table_cursor {
-	u64 seq;
-	struct routing_table_node *stack[128];
-	unsigned int len;
-	bool second_half;
-};
-
-void routing_table_init(struct routing_table *table);
-void routing_table_free(struct routing_table *table, struct mutex *mutex);
-int routing_table_insert_v4(struct routing_table *table, const struct in_addr *ip, u8 cidr, struct wireguard_peer *peer, struct mutex *lock);
-int routing_table_insert_v6(struct routing_table *table, const struct in6_addr *ip, u8 cidr, struct wireguard_peer *peer, struct mutex *lock);
-void routing_table_remove_by_peer(struct routing_table *table, struct wireguard_peer *peer, struct mutex *lock);
-int routing_table_walk_by_peer(struct routing_table *table, struct routing_table_cursor *cursor, struct wireguard_peer *peer, int (*func)(void *ctx, const u8 *ip, u8 cidr, int family), void *ctx, struct mutex *lock);
-
-/* These return a strong reference to a peer: */
-struct wireguard_peer *routing_table_lookup_dst(struct routing_table *table, struct sk_buff *skb);
-struct wireguard_peer *routing_table_lookup_src(struct routing_table *table, struct sk_buff *skb);
-
-#ifdef DEBUG
-bool routing_table_selftest(void);
-#endif
-
-#endif /* _WG_ROUTINGTABLE_H */
diff --git a/src/selftest/allowedips.h b/src/selftest/allowedips.h
new file mode 100644
index 0000000..78b019d
--- /dev/null
+++ b/src/selftest/allowedips.h
@@ -0,0 +1,510 @@
+/* Copyright (C) 2015-2017 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved. */
+
+#ifdef DEBUG
+
+#ifdef DEBUG_PRINT_TRIE_GRAPHVIZ
+#include <linux/siphash.h>
+static __init void print_node(struct allowedips_node *node, u8 bits)
+{
+	u32 color = 0;
+	char *style = "dotted";
+	char *fmt_connection = KERN_DEBUG "\t\"%p/%d\" -> \"%p/%d\";\n";
+	char *fmt_declaration = KERN_DEBUG "\t\"%p/%d\"[style=%s, color=\"#%06x\"];\n";
+	if (bits == 32) {
+		fmt_connection = KERN_DEBUG "\t\"%pI4/%d\" -> \"%pI4/%d\";\n";
+		fmt_declaration = KERN_DEBUG "\t\"%pI4/%d\"[style=%s, color=\"#%06x\"];\n";
+	} else if (bits == 128) {
+		fmt_connection = KERN_DEBUG "\t\"%pI6/%d\" -> \"%pI6/%d\";\n";
+		fmt_declaration = KERN_DEBUG "\t\"%pI6/%d\"[style=%s, color=\"#%06x\"];\n";
+	}
+	if (node->peer) {
+		hsiphash_key_t key = { 0 };
+		memcpy(&key, &node->peer, sizeof(node->peer));
+		color = hsiphash_1u32(0xdeadbeef, &key) % 200 << 16 | hsiphash_1u32(0xbabecafe, &key) % 200 << 8 | hsiphash_1u32(0xabad1dea, &key) % 200;
+		style = "bold";
+	}
+	printk(fmt_declaration, node->bits, node->cidr, style, color);
+	if (node->bit[0]) {
+		printk(fmt_connection, node->bits, node->cidr, node->bit[0]->bits, node->bit[0]->cidr);
+		print_node(node->bit[0], bits);
+	}
+	if (node->bit[1]) {
+		printk(fmt_connection, node->bits, node->cidr, node->bit[1]->bits, node->bit[1]->cidr);
+		print_node(node->bit[1], bits);
+	}
+}
+static __init void print_tree(struct allowedips_node *top, u8 bits)
+{
+	printk(KERN_DEBUG "digraph trie {\n");
+	print_node(top, bits);
+	printk(KERN_DEBUG "}\n");
+}
+#endif
+
+#ifdef DEBUG_RANDOM_TRIE
+#define NUM_PEERS 2000
+#define NUM_RAND_ROUTES 400
+#define NUM_MUTATED_ROUTES 100
+#define NUM_QUERIES (NUM_RAND_ROUTES * NUM_MUTATED_ROUTES * 30)
+#include <linux/random.h>
+struct horrible_allowedips {
+	struct hlist_head head;
+};
+struct horrible_allowedips_node {
+	struct hlist_node table;
+	union nf_inet_addr ip;
+	union nf_inet_addr mask;
+	uint8_t ip_version;
+	void *value;
+};
+static __init void horrible_allowedips_init(struct horrible_allowedips *table)
+{
+	INIT_HLIST_HEAD(&table->head);
+}
+static __init void horrible_allowedips_free(struct horrible_allowedips *table)
+{
+	struct hlist_node *h;
+	struct horrible_allowedips_node *node;
+	hlist_for_each_entry_safe(node, h, &table->head, table) {
+		hlist_del(&node->table);
+		kfree(node);
+	}
+}
+static __init inline union nf_inet_addr horrible_cidr_to_mask(uint8_t cidr)
+{
+	union nf_inet_addr mask;
+	memset(&mask, 0x00, 128 / 8);
+	memset(&mask, 0xff, cidr / 8);
+	if (cidr % 32)
+		mask.all[cidr / 32] = htonl((0xFFFFFFFFUL << (32 - (cidr % 32))) & 0xFFFFFFFFUL);
+	return mask;
+}
+static __init inline uint8_t horrible_mask_to_cidr(union nf_inet_addr subnet)
+{
+	return hweight32(subnet.all[0])
+	     + hweight32(subnet.all[1])
+	     + hweight32(subnet.all[2])
+	     + hweight32(subnet.all[3]);
+}
+static __init inline void horrible_mask_self(struct horrible_allowedips_node *node)
+{
+	if (node->ip_version == 4)
+		node->ip.ip &= node->mask.ip;
+	else if (node->ip_version == 6) {
+		node->ip.ip6[0] &= node->mask.ip6[0];
+		node->ip.ip6[1] &= node->mask.ip6[1];
+		node->ip.ip6[2] &= node->mask.ip6[2];
+		node->ip.ip6[3] &= node->mask.ip6[3];
+	}
+}
+static __init inline bool horrible_match_v4(const struct horrible_allowedips_node *node, struct in_addr *ip)
+{
+	return (ip->s_addr & node->mask.ip) == node->ip.ip;
+}
+static __init inline bool horrible_match_v6(const struct horrible_allowedips_node *node, struct in6_addr *ip)
+{
+	return	(ip->in6_u.u6_addr32[0] & node->mask.ip6[0]) == node->ip.ip6[0] &&
+		(ip->in6_u.u6_addr32[1] & node->mask.ip6[1]) == node->ip.ip6[1] &&
+		(ip->in6_u.u6_addr32[2] & node->mask.ip6[2]) == node->ip.ip6[2] &&
+		(ip->in6_u.u6_addr32[3] & node->mask.ip6[3]) == node->ip.ip6[3];
+}
+static __init void horrible_insert_ordered(struct horrible_allowedips *table, struct horrible_allowedips_node *node)
+{
+	struct horrible_allowedips_node *other = NULL, *where = NULL;
+	uint8_t my_cidr = horrible_mask_to_cidr(node->mask);
+	hlist_for_each_entry(other, &table->head, table) {
+		if (!memcmp(&other->mask, &node->mask, sizeof(union nf_inet_addr)) &&
+		    !memcmp(&other->ip, &node->ip, sizeof(union nf_inet_addr)) &&
+		    other->ip_version == node->ip_version) {
+			other->value = node->value;
+			kfree(node);
+			return;
+		}
+		where = other;
+		if (horrible_mask_to_cidr(other->mask) <= my_cidr)
+			break;
+	}
+	if (!other && !where)
+		hlist_add_head(&node->table, &table->head);
+	else if (!other)
+		hlist_add_behind(&node->table, &where->table);
+	else
+		hlist_add_before(&node->table, &where->table);
+}
+static __init int horrible_allowedips_insert_v4(struct horrible_allowedips *table, struct in_addr *ip, uint8_t cidr, void *value)
+{
+	struct horrible_allowedips_node *node = kzalloc(sizeof(struct horrible_allowedips_node), GFP_KERNEL);
+	if (!node)
+		return -ENOMEM;
+	node->ip.in = *ip;
+	node->mask = horrible_cidr_to_mask(cidr);
+	node->ip_version = 4;
+	node->value = value;
+	horrible_mask_self(node);
+	horrible_insert_ordered(table, node);
+	return 0;
+}
+static __init int horrible_allowedips_insert_v6(struct horrible_allowedips *table, struct in6_addr *ip, uint8_t cidr, void *value)
+{
+	struct horrible_allowedips_node *node = kzalloc(sizeof(struct horrible_allowedips_node), GFP_KERNEL);
+	if (!node)
+		return -ENOMEM;
+	node->ip.in6 = *ip;
+	node->mask = horrible_cidr_to_mask(cidr);
+	node->ip_version = 6;
+	node->value = value;
+	horrible_mask_self(node);
+	horrible_insert_ordered(table, node);
+	return 0;
+}
+static __init void *horrible_allowedips_lookup_v4(struct horrible_allowedips *table, struct in_addr *ip)
+{
+	struct horrible_allowedips_node *node;
+	void *ret = NULL;
+	hlist_for_each_entry(node, &table->head, table) {
+		if (node->ip_version != 4)
+			continue;
+		if (horrible_match_v4(node, ip)) {
+			ret = node->value;
+			break;
+		}
+	}
+	return ret;
+}
+static __init void *horrible_allowedips_lookup_v6(struct horrible_allowedips *table, struct in6_addr *ip)
+{
+	struct horrible_allowedips_node *node;
+	void *ret = NULL;
+	hlist_for_each_entry(node, &table->head, table) {
+		if (node->ip_version != 6)
+			continue;
+		if (horrible_match_v6(node, ip)) {
+			ret = node->value;
+			break;
+		}
+	}
+	return ret;
+}
+
+static __init bool randomized_test(void)
+{
+	bool ret = false;
+	unsigned int i, j, k, mutate_amount, cidr;
+	struct wireguard_peer **peers, *peer;
+	struct allowedips t;
+	struct horrible_allowedips h;
+	u8 ip[16], mutate_mask[16], mutated[16];
+
+	allowedips_init(&t);
+	horrible_allowedips_init(&h);
+
+	peers = kcalloc(NUM_PEERS, sizeof(struct wireguard_peer *), GFP_KERNEL);
+	if (!peers) {
+		pr_info("allowedips random self-test: out of memory\n");
+		goto free;
+	}
+	for (i = 0; i < NUM_PEERS; ++i) {
+		peers[i] = kzalloc(sizeof(struct wireguard_peer), GFP_KERNEL);
+		if (!peers[i]) {
+			pr_info("allowedips random self-test: out of memory\n");
+			goto free;
+		}
+		kref_init(&peers[i]->refcount);
+	}
+
+	for (i = 0; i < NUM_RAND_ROUTES; ++i) {
+		prandom_bytes(ip, 4);
+		cidr = prandom_u32_max(32) + 1;
+		peer = peers[prandom_u32_max(NUM_PEERS)];
+		if (allowedips_insert_v4(&t, (struct in_addr *)ip, cidr, peer) < 0) {
+			pr_info("allowedips random self-test: out of memory\n");
+			goto free;
+		}
+		if (horrible_allowedips_insert_v4(&h, (struct in_addr *)ip, cidr, peer) < 0) {
+			pr_info("allowedips random self-test: out of memory\n");
+			goto free;
+		}
+		for (j = 0; j < NUM_MUTATED_ROUTES; ++j) {
+			memcpy(mutated, ip, 4);
+			prandom_bytes(mutate_mask, 4);
+			mutate_amount = prandom_u32_max(32);
+			for (k = 0; k < mutate_amount / 8; ++k)
+				mutate_mask[k] = 0xff;
+			mutate_mask[k] = 0xff << ((8 - (mutate_amount % 8)) % 8);
+			for (; k < 4; ++k)
+				mutate_mask[k] = 0;
+			for (k = 0; k < 4; ++k)
+				mutated[k] = (mutated[k] & mutate_mask[k]) | (~mutate_mask[k] & prandom_u32_max(256));
+			cidr = prandom_u32_max(32) + 1;
+			peer = peers[prandom_u32_max(NUM_PEERS)];
+			if (allowedips_insert_v4(&t, (struct in_addr *)mutated, cidr, peer) < 0) {
+				pr_info("allowedips random self-test: out of memory\n");
+				goto free;
+			}
+			if (horrible_allowedips_insert_v4(&h, (struct in_addr *)mutated, cidr, peer)) {
+				pr_info("allowedips random self-test: out of memory\n");
+				goto free;
+			}
+		}
+	}
+
+	for (i = 0; i < NUM_RAND_ROUTES; ++i) {
+		prandom_bytes(ip, 16);
+		cidr = prandom_u32_max(128) + 1;
+		peer = peers[prandom_u32_max(NUM_PEERS)];
+		if (allowedips_insert_v6(&t, (struct in6_addr *)ip, cidr, peer) < 0) {
+			pr_info("allowedips random self-test: out of memory\n");
+			goto free;
+		}
+		if (horrible_allowedips_insert_v6(&h, (struct in6_addr *)ip, cidr, peer) < 0) {
+			pr_info("allowedips random self-test: out of memory\n");
+			goto free;
+		}
+		for (j = 0; j < NUM_MUTATED_ROUTES; ++j) {
+			memcpy(mutated, ip, 16);
+			prandom_bytes(mutate_mask, 16);
+			mutate_amount = prandom_u32_max(128);
+			for (k = 0; k < mutate_amount / 8; ++k)
+				mutate_mask[k] = 0xff;
+			mutate_mask[k] = 0xff << ((8 - (mutate_amount % 8)) % 8);
+			for (; k < 4; ++k)
+				mutate_mask[k] = 0;
+			for (k = 0; k < 4; ++k)
+				mutated[k] = (mutated[k] & mutate_mask[k]) | (~mutate_mask[k] & prandom_u32_max(256));
+			cidr = prandom_u32_max(128) + 1;
+			peer = peers[prandom_u32_max(NUM_PEERS)];
+			if (allowedips_insert_v6(&t, (struct in6_addr *)mutated, cidr, peer) < 0) {
+				pr_info("allowedips random self-test: out of memory\n");
+				goto free;
+			}
+			if (horrible_allowedips_insert_v6(&h, (struct in6_addr *)mutated, cidr, peer)) {
+				pr_info("allowedips random self-test: out of memory\n");
+				goto free;
+			}
+		}
+	}
+
+#ifdef DEBUG_PRINT_TRIE_GRAPHVIZ
+	print_tree(t.root4, 32);
+	print_tree(t.root6, 128);
+#endif
+
+	for (i = 0; i < NUM_QUERIES; ++i) {
+		prandom_bytes(ip, 4);
+		if (lookup(t.root4, 32, ip) != horrible_allowedips_lookup_v4(&h, (struct in_addr *)ip)) {
+			pr_info("allowedips random self-test: FAIL\n");
+			goto free;
+		}
+	}
+
+	for (i = 0; i < NUM_QUERIES; ++i) {
+		prandom_bytes(ip, 16);
+		if (lookup(t.root6, 128, ip) != horrible_allowedips_lookup_v6(&h, (struct in6_addr *)ip)) {
+			pr_info("allowedips random self-test: FAIL\n");
+			goto free;
+		}
+	}
+	ret = true;
+
+free:
+	allowedips_free(&t);
+	horrible_allowedips_free(&h);
+	if (peers) {
+		for (i = 0; i < NUM_PEERS; ++i)
+			kfree(peers[i]);
+	}
+	kfree(peers);
+	return ret;
+}
+#endif
+
+static __init inline struct in_addr *ip4(u8 a, u8 b, u8 c, u8 d)
+{
+	static struct in_addr ip;
+	u8 *split = (u8 *)&ip;
+	split[0] = a;
+	split[1] = b;
+	split[2] = c;
+	split[3] = d;
+	return &ip;
+}
+static __init inline struct in6_addr *ip6(u32 a, u32 b, u32 c, u32 d)
+{
+	static struct in6_addr ip;
+	__be32 *split = (__be32 *)&ip;
+	split[0] = cpu_to_be32(a);
+	split[1] = cpu_to_be32(b);
+	split[2] = cpu_to_be32(c);
+	split[3] = cpu_to_be32(d);
+	return &ip;
+}
+
+#define init_peer(name) do { \
+	name = kzalloc(sizeof(struct wireguard_peer), GFP_KERNEL); \
+	if (!name) { \
+		pr_info("allowedips self-test: out of memory\n"); \
+		goto free; \
+	} \
+	kref_init(&name->refcount); \
+} while (0)
+
+#define insert(version, mem, ipa, ipb, ipc, ipd, cidr) \
+	allowedips_insert_v##version(&t, ip##version(ipa, ipb, ipc, ipd), cidr, mem, &mutex)
+
+#define maybe_fail \
+	++i; \
+	if (!_s) { \
+		pr_info("allowedips self-test %zu: FAIL\n", i); \
+		success = false; \
+	}
+
+#define test(version, mem, ipa, ipb, ipc, ipd) do { \
+	bool _s = lookup(t.root##version, version == 4 ? 32 : 128, ip##version(ipa, ipb, ipc, ipd)) == mem; \
+	maybe_fail \
+} while (0)
+
+#define test_negative(version, mem, ipa, ipb, ipc, ipd) do { \
+	bool _s = lookup(t.root##version, version == 4 ? 32 : 128, ip##version(ipa, ipb, ipc, ipd)) != mem; \
+	maybe_fail \
+} while (0)
+
+bool __init allowedips_selftest(void)
+{
+	DEFINE_MUTEX(mutex);
+	struct allowedips t;
+	struct wireguard_peer *a = NULL, *b = NULL, *c = NULL, *d = NULL, *e = NULL, *f = NULL, *g = NULL, *h = NULL;
+	size_t i = 0;
+	bool success = false;
+	struct in6_addr ip;
+	__be64 part;
+
+	mutex_init(&mutex);
+
+	mutex_lock(&mutex);
+
+	allowedips_init(&t);
+	init_peer(a);
+	init_peer(b);
+	init_peer(c);
+	init_peer(d);
+	init_peer(e);
+	init_peer(f);
+	init_peer(g);
+	init_peer(h);
+
+	insert(4, a, 192, 168, 4, 0, 24);
+	insert(4, b, 192, 168, 4, 4, 32);
+	insert(4, c, 192, 168, 0, 0, 16);
+	insert(4, d, 192, 95, 5, 64, 27);
+	insert(4, c, 192, 95, 5, 65, 27); /* replaces previous entry, and maskself is required */
+	insert(6, d, 0x26075300, 0x60006b00, 0, 0xc05f0543, 128);
+	insert(6, c, 0x26075300, 0x60006b00, 0, 0, 64);
+	insert(4, e, 0, 0, 0, 0, 0);
+	insert(6, e, 0, 0, 0, 0, 0);
+	insert(6, f, 0, 0, 0, 0, 0); /* replaces previous entry */
+	insert(6, g, 0x24046800, 0, 0, 0, 32);
+	insert(6, h, 0x24046800, 0x40040800, 0xdeadbeef, 0xdeadbeef, 64); /* maskself is required */
+	insert(6, a, 0x24046800, 0x40040800, 0xdeadbeef, 0xdeadbeef, 128);
+	insert(6, c, 0x24446800, 0x40e40800, 0xdeaebeef, 0xdefbeef, 128);
+	insert(6, b, 0x24446800, 0xf0e40800, 0xeeaebeef, 0, 98);
+	insert(4, g, 64, 15, 112, 0, 20);
+	insert(4, h, 64, 15, 123, 211, 25); /* maskself is required */
+	insert(4, a, 10, 0, 0, 0, 25);
+	insert(4, b, 10, 0, 0, 128, 25);
+	insert(4, a, 10, 1, 0, 0, 30);
+	insert(4, b, 10, 1, 0, 4, 30);
+	insert(4, c, 10, 1, 0, 8, 29);
+	insert(4, d, 10, 1, 0, 16, 29);
+
+#ifdef DEBUG_PRINT_TRIE_GRAPHVIZ
+	print_tree(t.root4, 32);
+	print_tree(t.root6, 128);
+#endif
+
+	success = true;
+
+	test(4, a, 192, 168, 4, 20);
+	test(4, a, 192, 168, 4, 0);
+	test(4, b, 192, 168, 4, 4);
+	test(4, c, 192, 168, 200, 182);
+	test(4, c, 192, 95, 5, 68);
+	test(4, e, 192, 95, 5, 96);
+	test(6, d, 0x26075300, 0x60006b00, 0, 0xc05f0543);
+	test(6, c, 0x26075300, 0x60006b00, 0, 0xc02e01ee);
+	test(6, f, 0x26075300, 0x60006b01, 0, 0);
+	test(6, g, 0x24046800, 0x40040806, 0, 0x1006);
+	test(6, g, 0x24046800, 0x40040806, 0x1234, 0x5678);
+	test(6, f, 0x240467ff, 0x40040806, 0x1234, 0x5678);
+	test(6, f, 0x24046801, 0x40040806, 0x1234, 0x5678);
+	test(6, h, 0x24046800, 0x40040800, 0x1234, 0x5678);
+	test(6, h, 0x24046800, 0x40040800, 0, 0);
+	test(6, h, 0x24046800, 0x40040800, 0x10101010, 0x10101010);
+	test(6, a, 0x24046800, 0x40040800, 0xdeadbeef, 0xdeadbeef);
+	test(4, g, 64, 15, 116, 26);
+	test(4, g, 64, 15, 127, 3);
+	test(4, g, 64, 15, 123, 1);
+	test(4, h, 64, 15, 123, 128);
+	test(4, h, 64, 15, 123, 129);
+	test(4, a, 10, 0, 0, 52);
+	test(4, b, 10, 0, 0, 220);
+	test(4, a, 10, 1, 0, 2);
+	test(4, b, 10, 1, 0, 6);
+	test(4, c, 10, 1, 0, 10);
+	test(4, d, 10, 1, 0, 20);
+
+	insert(4, a, 1, 0, 0, 0, 32);
+	insert(4, a, 64, 0, 0, 0, 32);
+	insert(4, a, 128, 0, 0, 0, 32);
+	insert(4, a, 192, 0, 0, 0, 32);
+	insert(4, a, 255, 0, 0, 0, 32);
+	allowedips_remove_by_peer(&t, a, &mutex);
+	test_negative(4, a, 1, 0, 0, 0);
+	test_negative(4, a, 64, 0, 0, 0);
+	test_negative(4, a, 128, 0, 0, 0);
+	test_negative(4, a, 192, 0, 0, 0);
+	test_negative(4, a, 255, 0, 0, 0);
+
+	allowedips_free(&t, &mutex);
+	allowedips_init(&t);
+	insert(4, a, 192, 168, 0, 0, 16);
+	insert(4, a, 192, 168, 0, 0, 24);
+	allowedips_remove_by_peer(&t, a, &mutex);
+	test_negative(4, a, 192, 168, 0, 1);
+
+	/* These will hit the BUG_ON(len >= 128) in free_node if something goes wrong. */
+	for (i = 0; i < 128; ++i) {
+		part = cpu_to_be64(~(1LLU << (i % 64)));
+		memset(&ip, 0xff, 16);
+		memcpy((u8 *)&ip + (i < 64) * 8, &part, 8);
+		allowedips_insert_v6(&t, &ip, 128, a, &mutex);
+	}
+
+#ifdef DEBUG_RANDOM_TRIE
+	if (success)
+		success = randomized_test();
+#endif
+
+	if (success)
+		pr_info("allowedips self-tests: pass\n");
+
+free:
+	allowedips_free(&t, &mutex);
+	kfree(a);
+	kfree(b);
+	kfree(c);
+	kfree(d);
+	kfree(e);
+	kfree(f);
+	kfree(g);
+	kfree(h);
+	mutex_unlock(&mutex);
+
+	return success;
+}
+#undef test_negative
+#undef test
+#undef remove
+#undef insert
+#undef init_peer
+
+#endif
diff --git a/src/selftest/routingtable.h b/src/selftest/routingtable.h
deleted file mode 100644
index 434c6fc..0000000
--- a/src/selftest/routingtable.h
+++ /dev/null
@@ -1,510 +0,0 @@
-/* Copyright (C) 2015-2017 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved. */
-
-#ifdef DEBUG
-
-#ifdef DEBUG_PRINT_TRIE_GRAPHVIZ
-#include <linux/siphash.h>
-static __init void print_node(struct routing_table_node *node, u8 bits)
-{
-	u32 color = 0;
-	char *style = "dotted";
-	char *fmt_connection = KERN_DEBUG "\t\"%p/%d\" -> \"%p/%d\";\n";
-	char *fmt_declaration = KERN_DEBUG "\t\"%p/%d\"[style=%s, color=\"#%06x\"];\n";
-	if (bits == 32) {
-		fmt_connection = KERN_DEBUG "\t\"%pI4/%d\" -> \"%pI4/%d\";\n";
-		fmt_declaration = KERN_DEBUG "\t\"%pI4/%d\"[style=%s, color=\"#%06x\"];\n";
-	} else if (bits == 128) {
-		fmt_connection = KERN_DEBUG "\t\"%pI6/%d\" -> \"%pI6/%d\";\n";
-		fmt_declaration = KERN_DEBUG "\t\"%pI6/%d\"[style=%s, color=\"#%06x\"];\n";
-	}
-	if (node->peer) {
-		hsiphash_key_t key = { 0 };
-		memcpy(&key, &node->peer, sizeof(node->peer));
-		color = hsiphash_1u32(0xdeadbeef, &key) % 200 << 16 | hsiphash_1u32(0xbabecafe, &key) % 200 << 8 | hsiphash_1u32(0xabad1dea, &key) % 200;
-		style = "bold";
-	}
-	printk(fmt_declaration, node->bits, node->cidr, style, color);
-	if (node->bit[0]) {
-		printk(fmt_connection, node->bits, node->cidr, node->bit[0]->bits, node->bit[0]->cidr);
-		print_node(node->bit[0], bits);
-	}
-	if (node->bit[1]) {
-		printk(fmt_connection, node->bits, node->cidr, node->bit[1]->bits, node->bit[1]->cidr);
-		print_node(node->bit[1], bits);
-	}
-}
-static __init void print_tree(struct routing_table_node *top, u8 bits)
-{
-	printk(KERN_DEBUG "digraph trie {\n");
-	print_node(top, bits);
-	printk(KERN_DEBUG "}\n");
-}
-#endif
-
-#ifdef DEBUG_RANDOM_TRIE
-#define NUM_PEERS 2000
-#define NUM_RAND_ROUTES 400
-#define NUM_MUTATED_ROUTES 100
-#define NUM_QUERIES (NUM_RAND_ROUTES * NUM_MUTATED_ROUTES * 30)
-#include <linux/random.h>
-struct horrible_routing_table {
-	struct hlist_head head;
-};
-struct horrible_routing_table_node {
-	struct hlist_node table;
-	union nf_inet_addr ip;
-	union nf_inet_addr mask;
-	uint8_t ip_version;
-	void *value;
-};
-static __init void horrible_routing_table_init(struct horrible_routing_table *table)
-{
-	INIT_HLIST_HEAD(&table->head);
-}
-static __init void horrible_routing_table_free(struct horrible_routing_table *table)
-{
-	struct hlist_node *h;
-	struct horrible_routing_table_node *node;
-	hlist_for_each_entry_safe(node, h, &table->head, table) {
-		hlist_del(&node->table);
-		kfree(node);
-	}
-}
-static __init inline union nf_inet_addr horrible_cidr_to_mask(uint8_t cidr)
-{
-	union nf_inet_addr mask;
-	memset(&mask, 0x00, 128 / 8);
-	memset(&mask, 0xff, cidr / 8);
-	if (cidr % 32)
-		mask.all[cidr / 32] = htonl((0xFFFFFFFFUL << (32 - (cidr % 32))) & 0xFFFFFFFFUL);
-	return mask;
-}
-static __init inline uint8_t horrible_mask_to_cidr(union nf_inet_addr subnet)
-{
-	return hweight32(subnet.all[0])
-	     + hweight32(subnet.all[1])
-	     + hweight32(subnet.all[2])
-	     + hweight32(subnet.all[3]);
-}
-static __init inline void horrible_mask_self(struct horrible_routing_table_node *node)
-{
-	if (node->ip_version == 4)
-		node->ip.ip &= node->mask.ip;
-	else if (node->ip_version == 6) {
-		node->ip.ip6[0] &= node->mask.ip6[0];
-		node->ip.ip6[1] &= node->mask.ip6[1];
-		node->ip.ip6[2] &= node->mask.ip6[2];
-		node->ip.ip6[3] &= node->mask.ip6[3];
-	}
-}
-static __init inline bool horrible_match_v4(const struct horrible_routing_table_node *node, struct in_addr *ip)
-{
-	return (ip->s_addr & node->mask.ip) == node->ip.ip;
-}
-static __init inline bool horrible_match_v6(const struct horrible_routing_table_node *node, struct in6_addr *ip)
-{
-	return	(ip->in6_u.u6_addr32[0] & node->mask.ip6[0]) == node->ip.ip6[0] &&
-		(ip->in6_u.u6_addr32[1] & node->mask.ip6[1]) == node->ip.ip6[1] &&
-		(ip->in6_u.u6_addr32[2] & node->mask.ip6[2]) == node->ip.ip6[2] &&
-		(ip->in6_u.u6_addr32[3] & node->mask.ip6[3]) == node->ip.ip6[3];
-}
-static __init void horrible_insert_ordered(struct horrible_routing_table *table, struct horrible_routing_table_node *node)
-{
-	struct horrible_routing_table_node *other = NULL, *where = NULL;
-	uint8_t my_cidr = horrible_mask_to_cidr(node->mask);
-	hlist_for_each_entry(other, &table->head, table) {
-		if (!memcmp(&other->mask, &node->mask, sizeof(union nf_inet_addr)) &&
-		    !memcmp(&other->ip, &node->ip, sizeof(union nf_inet_addr)) &&
-		    other->ip_version == node->ip_version) {
-			other->value = node->value;
-			kfree(node);
-			return;
-		}
-		where = other;
-		if (horrible_mask_to_cidr(other->mask) <= my_cidr)
-			break;
-	}
-	if (!other && !where)
-		hlist_add_head(&node->table, &table->head);
-	else if (!other)
-		hlist_add_behind(&node->table, &where->table);
-	else
-		hlist_add_before(&node->table, &where->table);
-}
-static __init int horrible_routing_table_insert_v4(struct horrible_routing_table *table, struct in_addr *ip, uint8_t cidr, void *value)
-{
-	struct horrible_routing_table_node *node = kzalloc(sizeof(struct horrible_routing_table_node), GFP_KERNEL);
-	if (!node)
-		return -ENOMEM;
-	node->ip.in = *ip;
-	node->mask = horrible_cidr_to_mask(cidr);
-	node->ip_version = 4;
-	node->value = value;
-	horrible_mask_self(node);
-	horrible_insert_ordered(table, node);
-	return 0;
-}
-static __init int horrible_routing_table_insert_v6(struct horrible_routing_table *table, struct in6_addr *ip, uint8_t cidr, void *value)
-{
-	struct horrible_routing_table_node *node = kzalloc(sizeof(struct horrible_routing_table_node), GFP_KERNEL);
-	if (!node)
-		return -ENOMEM;
-	node->ip.in6 = *ip;
-	node->mask = horrible_cidr_to_mask(cidr);
-	node->ip_version = 6;
-	node->value = value;
-	horrible_mask_self(node);
-	horrible_insert_ordered(table, node);
-	return 0;
-}
-static __init void *horrible_routing_table_lookup_v4(struct horrible_routing_table *table, struct in_addr *ip)
-{
-	struct horrible_routing_table_node *node;
-	void *ret = NULL;
-	hlist_for_each_entry(node, &table->head, table) {
-		if (node->ip_version != 4)
-			continue;
-		if (horrible_match_v4(node, ip)) {
-			ret = node->value;
-			break;
-		}
-	}
-	return ret;
-}
-static __init void *horrible_routing_table_lookup_v6(struct horrible_routing_table *table, struct in6_addr *ip)
-{
-	struct horrible_routing_table_node *node;
-	void *ret = NULL;
-	hlist_for_each_entry(node, &table->head, table) {
-		if (node->ip_version != 6)
-			continue;
-		if (horrible_match_v6(node, ip)) {
-			ret = node->value;
-			break;
-		}
-	}
-	return ret;
-}
-
-static __init bool randomized_test(void)
-{
-	bool ret = false;
-	unsigned int i, j, k, mutate_amount, cidr;
-	struct wireguard_peer **peers, *peer;
-	struct routing_table t;
-	struct horrible_routing_table h;
-	u8 ip[16], mutate_mask[16], mutated[16];
-
-	routing_table_init(&t);
-	horrible_routing_table_init(&h);
-
-	peers = kcalloc(NUM_PEERS, sizeof(struct wireguard_peer *), GFP_KERNEL);
-	if (!peers) {
-		pr_info("routing table random self-test: out of memory\n");
-		goto free;
-	}
-	for (i = 0; i < NUM_PEERS; ++i) {
-		peers[i] = kzalloc(sizeof(struct wireguard_peer), GFP_KERNEL);
-		if (!peers[i]) {
-			pr_info("routing table random self-test: out of memory\n");
-			goto free;
-		}
-		kref_init(&peers[i]->refcount);
-	}
-
-	for (i = 0; i < NUM_RAND_ROUTES; ++i) {
-		prandom_bytes(ip, 4);
-		cidr = prandom_u32_max(32) + 1;
-		peer = peers[prandom_u32_max(NUM_PEERS)];
-		if (routing_table_insert_v4(&t, (struct in_addr *)ip, cidr, peer) < 0) {
-			pr_info("routing table random self-test: out of memory\n");
-			goto free;
-		}
-		if (horrible_routing_table_insert_v4(&h, (struct in_addr *)ip, cidr, peer) < 0) {
-			pr_info("routing table random self-test: out of memory\n");
-			goto free;
-		}
-		for (j = 0; j < NUM_MUTATED_ROUTES; ++j) {
-			memcpy(mutated, ip, 4);
-			prandom_bytes(mutate_mask, 4);
-			mutate_amount = prandom_u32_max(32);
-			for (k = 0; k < mutate_amount / 8; ++k)
-				mutate_mask[k] = 0xff;
-			mutate_mask[k] = 0xff << ((8 - (mutate_amount % 8)) % 8);
-			for (; k < 4; ++k)
-				mutate_mask[k] = 0;
-			for (k = 0; k < 4; ++k)
-				mutated[k] = (mutated[k] & mutate_mask[k]) | (~mutate_mask[k] & prandom_u32_max(256));
-			cidr = prandom_u32_max(32) + 1;
-			peer = peers[prandom_u32_max(NUM_PEERS)];
-			if (routing_table_insert_v4(&t, (struct in_addr *)mutated, cidr, peer) < 0) {
-				pr_info("routing table random self-test: out of memory\n");
-				goto free;
-			}
-			if (horrible_routing_table_insert_v4(&h, (struct in_addr *)mutated, cidr, peer)) {
-				pr_info("routing table random self-test: out of memory\n");
-				goto free;
-			}
-		}
-	}
-
-	for (i = 0; i < NUM_RAND_ROUTES; ++i) {
-		prandom_bytes(ip, 16);
-		cidr = prandom_u32_max(128) + 1;
-		peer = peers[prandom_u32_max(NUM_PEERS)];
-		if (routing_table_insert_v6(&t, (struct in6_addr *)ip, cidr, peer) < 0) {
-			pr_info("routing table random self-test: out of memory\n");
-			goto free;
-		}
-		if (horrible_routing_table_insert_v6(&h, (struct in6_addr *)ip, cidr, peer) < 0) {
-			pr_info("routing table random self-test: out of memory\n");
-			goto free;
-		}
-		for (j = 0; j < NUM_MUTATED_ROUTES; ++j) {
-			memcpy(mutated, ip, 16);
-			prandom_bytes(mutate_mask, 16);
-			mutate_amount = prandom_u32_max(128);
-			for (k = 0; k < mutate_amount / 8; ++k)
-				mutate_mask[k] = 0xff;
-			mutate_mask[k] = 0xff << ((8 - (mutate_amount % 8)) % 8);
-			for (; k < 4; ++k)
-				mutate_mask[k] = 0;
-			for (k = 0; k < 4; ++k)
-				mutated[k] = (mutated[k] & mutate_mask[k]) | (~mutate_mask[k] & prandom_u32_max(256));
-			cidr = prandom_u32_max(128) + 1;
-			peer = peers[prandom_u32_max(NUM_PEERS)];
-			if (routing_table_insert_v6(&t, (struct in6_addr *)mutated, cidr, peer) < 0) {
-				pr_info("routing table random self-test: out of memory\n");
-				goto free;
-			}
-			if (horrible_routing_table_insert_v6(&h, (struct in6_addr *)mutated, cidr, peer)) {
-				pr_info("routing table random self-test: out of memory\n");
-				goto free;
-			}
-		}
-	}
-
-#ifdef DEBUG_PRINT_TRIE_GRAPHVIZ
-	print_tree(t.root4, 32);
-	print_tree(t.root6, 128);
-#endif
-
-	for (i = 0; i < NUM_QUERIES; ++i) {
-		prandom_bytes(ip, 4);
-		if (lookup(t.root4, 32, ip) != horrible_routing_table_lookup_v4(&h, (struct in_addr *)ip)) {
-			pr_info("routing table random self-test: FAIL\n");
-			goto free;
-		}
-	}
-
-	for (i = 0; i < NUM_QUERIES; ++i) {
-		prandom_bytes(ip, 16);
-		if (lookup(t.root6, 128, ip) != horrible_routing_table_lookup_v6(&h, (struct in6_addr *)ip)) {
-			pr_info("routing table random self-test: FAIL\n");
-			goto free;
-		}
-	}
-	ret = true;
-
-free:
-	routing_table_free(&t);
-	horrible_routing_table_free(&h);
-	if (peers) {
-		for (i = 0; i < NUM_PEERS; ++i)
-			kfree(peers[i]);
-	}
-	kfree(peers);
-	return ret;
-}
-#endif
-
-static __init inline struct in_addr *ip4(u8 a, u8 b, u8 c, u8 d)
-{
-	static struct in_addr ip;
-	u8 *split = (u8 *)&ip;
-	split[0] = a;
-	split[1] = b;
-	split[2] = c;
-	split[3] = d;
-	return &ip;
-}
-static __init inline struct in6_addr *ip6(u32 a, u32 b, u32 c, u32 d)
-{
-	static struct in6_addr ip;
-	__be32 *split = (__be32 *)&ip;
-	split[0] = cpu_to_be32(a);
-	split[1] = cpu_to_be32(b);
-	split[2] = cpu_to_be32(c);
-	split[3] = cpu_to_be32(d);
-	return &ip;
-}
-
-#define init_peer(name) do { \
-	name = kzalloc(sizeof(struct wireguard_peer), GFP_KERNEL); \
-	if (!name) { \
-		pr_info("routing table self-test: out of memory\n"); \
-		goto free; \
-	} \
-	kref_init(&name->refcount); \
-} while (0)
-
-#define insert(version, mem, ipa, ipb, ipc, ipd, cidr) \
-	routing_table_insert_v##version(&t, ip##version(ipa, ipb, ipc, ipd), cidr, mem, &mutex)
-
-#define maybe_fail \
-	++i; \
-	if (!_s) { \
-		pr_info("routing table self-test %zu: FAIL\n", i); \
-		success = false; \
-	}
-
-#define test(version, mem, ipa, ipb, ipc, ipd) do { \
-	bool _s = lookup(t.root##version, version == 4 ? 32 : 128, ip##version(ipa, ipb, ipc, ipd)) == mem; \
-	maybe_fail \
-} while (0)
-
-#define test_negative(version, mem, ipa, ipb, ipc, ipd) do { \
-	bool _s = lookup(t.root##version, version == 4 ? 32 : 128, ip##version(ipa, ipb, ipc, ipd)) != mem; \
-	maybe_fail \
-} while (0)
-
-bool __init routing_table_selftest(void)
-{
-	DEFINE_MUTEX(mutex);
-	struct routing_table t;
-	struct wireguard_peer *a = NULL, *b = NULL, *c = NULL, *d = NULL, *e = NULL, *f = NULL, *g = NULL, *h = NULL;
-	size_t i = 0;
-	bool success = false;
-	struct in6_addr ip;
-	__be64 part;
-
-	mutex_init(&mutex);
-
-	mutex_lock(&mutex);
-
-	routing_table_init(&t);
-	init_peer(a);
-	init_peer(b);
-	init_peer(c);
-	init_peer(d);
-	init_peer(e);
-	init_peer(f);
-	init_peer(g);
-	init_peer(h);
-
-	insert(4, a, 192, 168, 4, 0, 24);
-	insert(4, b, 192, 168, 4, 4, 32);
-	insert(4, c, 192, 168, 0, 0, 16);
-	insert(4, d, 192, 95, 5, 64, 27);
-	insert(4, c, 192, 95, 5, 65, 27); /* replaces previous entry, and maskself is required */
-	insert(6, d, 0x26075300, 0x60006b00, 0, 0xc05f0543, 128);
-	insert(6, c, 0x26075300, 0x60006b00, 0, 0, 64);
-	insert(4, e, 0, 0, 0, 0, 0);
-	insert(6, e, 0, 0, 0, 0, 0);
-	insert(6, f, 0, 0, 0, 0, 0); /* replaces previous entry */
-	insert(6, g, 0x24046800, 0, 0, 0, 32);
-	insert(6, h, 0x24046800, 0x40040800, 0xdeadbeef, 0xdeadbeef, 64); /* maskself is required */
-	insert(6, a, 0x24046800, 0x40040800, 0xdeadbeef, 0xdeadbeef, 128);
-	insert(6, c, 0x24446800, 0x40e40800, 0xdeaebeef, 0xdefbeef, 128);
-	insert(6, b, 0x24446800, 0xf0e40800, 0xeeaebeef, 0, 98);
-	insert(4, g, 64, 15, 112, 0, 20);
-	insert(4, h, 64, 15, 123, 211, 25); /* maskself is required */
-	insert(4, a, 10, 0, 0, 0, 25);
-	insert(4, b, 10, 0, 0, 128, 25);
-	insert(4, a, 10, 1, 0, 0, 30);
-	insert(4, b, 10, 1, 0, 4, 30);
-	insert(4, c, 10, 1, 0, 8, 29);
-	insert(4, d, 10, 1, 0, 16, 29);
-
-#ifdef DEBUG_PRINT_TRIE_GRAPHVIZ
-	print_tree(t.root4, 32);
-	print_tree(t.root6, 128);
-#endif
-
-	success = true;
-
-	test(4, a, 192, 168, 4, 20);
-	test(4, a, 192, 168, 4, 0);
-	test(4, b, 192, 168, 4, 4);
-	test(4, c, 192, 168, 200, 182);
-	test(4, c, 192, 95, 5, 68);
-	test(4, e, 192, 95, 5, 96);
-	test(6, d, 0x26075300, 0x60006b00, 0, 0xc05f0543);
-	test(6, c, 0x26075300, 0x60006b00, 0, 0xc02e01ee);
-	test(6, f, 0x26075300, 0x60006b01, 0, 0);
-	test(6, g, 0x24046800, 0x40040806, 0, 0x1006);
-	test(6, g, 0x24046800, 0x40040806, 0x1234, 0x5678);
-	test(6, f, 0x240467ff, 0x40040806, 0x1234, 0x5678);
-	test(6, f, 0x24046801, 0x40040806, 0x1234, 0x5678);
-	test(6, h, 0x24046800, 0x40040800, 0x1234, 0x5678);
-	test(6, h, 0x24046800, 0x40040800, 0, 0);
-	test(6, h, 0x24046800, 0x40040800, 0x10101010, 0x10101010);
-	test(6, a, 0x24046800, 0x40040800, 0xdeadbeef, 0xdeadbeef);
-	test(4, g, 64, 15, 116, 26);
-	test(4, g, 64, 15, 127, 3);
-	test(4, g, 64, 15, 123, 1);
-	test(4, h, 64, 15, 123, 128);
-	test(4, h, 64, 15, 123, 129);
-	test(4, a, 10, 0, 0, 52);
-	test(4, b, 10, 0, 0, 220);
-	test(4, a, 10, 1, 0, 2);
-	test(4, b, 10, 1, 0, 6);
-	test(4, c, 10, 1, 0, 10);
-	test(4, d, 10, 1, 0, 20);
-
-	insert(4, a, 1, 0, 0, 0, 32);
-	insert(4, a, 64, 0, 0, 0, 32);
-	insert(4, a, 128, 0, 0, 0, 32);
-	insert(4, a, 192, 0, 0, 0, 32);
-	insert(4, a, 255, 0, 0, 0, 32);
-	routing_table_remove_by_peer(&t, a, &mutex);
-	test_negative(4, a, 1, 0, 0, 0);
-	test_negative(4, a, 64, 0, 0, 0);
-	test_negative(4, a, 128, 0, 0, 0);
-	test_negative(4, a, 192, 0, 0, 0);
-	test_negative(4, a, 255, 0, 0, 0);
-
-	routing_table_free(&t, &mutex);
-	routing_table_init(&t);
-	insert(4, a, 192, 168, 0, 0, 16);
-	insert(4, a, 192, 168, 0, 0, 24);
-	routing_table_remove_by_peer(&t, a, &mutex);
-	test_negative(4, a, 192, 168, 0, 1);
-
-	/* These will hit the BUG_ON(len >= 128) in free_node if something goes wrong. */
-	for (i = 0; i < 128; ++i) {
-		part = cpu_to_be64(~(1LLU << (i % 64)));
-		memset(&ip, 0xff, 16);
-		memcpy((u8 *)&ip + (i < 64) * 8, &part, 8);
-		routing_table_insert_v6(&t, &ip, 128, a, &mutex);
-	}
-
-#ifdef DEBUG_RANDOM_TRIE
-	if (success)
-		success = randomized_test();
-#endif
-
-	if (success)
-		pr_info("routing table self-tests: pass\n");
-
-free:
-	routing_table_free(&t, &mutex);
-	kfree(a);
-	kfree(b);
-	kfree(c);
-	kfree(d);
-	kfree(e);
-	kfree(f);
-	kfree(g);
-	kfree(h);
-	mutex_unlock(&mutex);
-
-	return success;
-}
-#undef test_negative
-#undef test
-#undef remove
-#undef insert
-#undef init_peer
-
-#endif
-- 
cgit v1.2.3-59-g8ed1b