wireguard-openbsd - WireGuard implementation for the OpenBSD kernel

Age	Commit message (Collapse)	Author	Files	Lines
2019-06-23	Merge LLVM 8.0.0 release.	patrick	1	-113/+79
	Prepared with help from jsg@ and mortimer@ Tested on amd64 by bcallah@, krw@, naddy@ Tested on arm64 by patrick@ Tested on macppc by kettenis@ Tested on octeon by visa@ Tested on sparc64 by claudio@
2019-04-02	Emit variable length trap padding in retguard epilogue.	mortimer	1	-0/+21
	This adds more trap padding before the return while ensuring that the return is still in the same cache line. ok deraadt@
2019-02-22	Improve the X86FixupGadgets pass:	mortimer	1	-0/+11
	- Target all four kinds of return bytes (c2, c3, ca, cb) - Fix up instructions using both ModR/M and SIB bytes - Force alignment before instructions with return bytes in immediates - Force alignment before instructions that have return bytes in their encoding - Add a command line switch to toggle the functionality. ok deraadt@
2019-01-27	Merge LLVM 7.0.1 release.	patrick	1	-246/+474
	With fixes from mortimer@ (thanks!) Tested by many, especially naddy@ (thanks!)
2018-06-06	Add RETGUARD to clang for amd64. This security mechanism uses per-function	mortimer	1	-0/+10
	random cookies to protect access to function return instructions, with the effect that the integrity of the return address is protected, and function return instructions are harder to use in ROP gadgets. On function entry the return address is combined with a per-function random cookie and stored in the stack frame. The integrity of this value is verified before function return, and if this check fails, the program aborts. In this way RETGUARD is an improved stack protector, since the cookies are per-function. The verification routine is constructed such that the binary space immediately before each ret instruction is padded with int03 instructions, which makes these return instructions difficult to use in ROP gadgets. In the kernel, this has the effect of removing approximately 50% of total ROP gadgets, and 15% of unique ROP gadgets compared to the 6.3 release kernel. Function epilogues are essentially gadget free, leaving only the polymorphic gadgets that result from jumping into the instruction stream partway through other instructions. Work to remove these gadgets will continue through other mechanisms. Remaining work includes adding this mechanism to assembly routines, which must be done by hand. Many thanks to all those who helped test and provide feedback, especially deaadt, tb, espie and naddy. ok deraadt@
2018-04-06	Merge LLVM 6.0.0 release.	patrick	1	-69/+132

2017-10-04	Merge LLVM 5.0.0 release.	patrick	1	-77/+308

2017-08-01	Use int3 trap padding between functions instead of trapsleds with a leading jump.	mortimer	1	-0/+6
	ok deraadt@
2017-03-14	Import LLVM 4.0.0 release including clang and lld.	patrick	1	-8/+1

2017-01-24	Import LLVM 4.0.0 rc1 including clang and lld to help the current	patrick	1	-106/+165
	development effort on OpenBSD/arm64.
2017-01-14	Import LLVM 3.9.1 including clang and lld.	patrick	1	-203/+430

2016-09-03	Use the space freed up by sparc and zaurus to import LLVM.	pascal	1	-0/+1459
	ok hackroom@