summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)Author
2017-09-15timers: styleJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-09-15routingtable: satisfy sparseJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-09-15socket: satisfy sparseJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-09-11device: IFF_NO_QUEUE is a private flag, not a public oneJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-09-07version: bump snapshotJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-09-07compat: fix padata to work with 4.13Jason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-08-23socket: improve reply-to-src algorithmJason A. Donenfeld
We store the destination IP of incoming packets as the source IP of outgoing packets. When we send outgoing packets, we then ask the routing table for which interface to use and which source address, given our inputs of the destination address and a suggested source address. This all is good and fine, since it means we'll successfully reply using the correct source address, correlating with the destination address for incoming packets. However, what happens when default routes change? Or when interface IP addresses change? Prior to this commit, after getting the response from the routing table of the source address, destination address, and interface, we would then make sure that the source address actually belonged to the outbound interface. If it didn't, we'd reset our source address to zero and re-ask the routing table, in which case the routing table would then give us the default IP address for sending that packet. This worked mostly fine for most purposes, but there was a problem: what if WireGuard legitimately accepted an inbound packet on a default interface using an IP of another interface? In this case, falling back to asking for the default source IP was not a good strategy, since it'd nearly always mean we'd fail to reply using the right source. So, this commit changes the algorithm slightly. Rather than falling back to using the default IP if the preferred source IP doesn't belong to the outbound interface, we have two checks: we make sure that the source IP address belongs to _some_ interface on the system, no matter which one (so long as it's within the network namespace), and we check whether or not the interface of an incoming packet matches the returned interface for the outbound traffic. If both these conditions are true, then we proceed with using this source IP address. If not, we fall back to the default IP address. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-08-10version: bump snapshotJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-08-08hashtables: if we have an index match, don't search further everJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-08-08hashtables: allow up to 2^{20} peers per interfaceJason A. Donenfeld
This allows for nearly 1 million peers per interface, which should be more than enough. If needed later, this number could easily be increased beyond this. We also increase the size of the hashtables to accommodate this upper bound. In the future, it might be smart to dynamically expand the hashtable instead of this hard coded compromise value between small systems and large systems. Ongoing work includes figuring out the most optimal scheme for these hashtables and for the insertion to mask their order from timing inference. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-08-06compat: support grsecurity with our compat padata implementationJason A. Donenfeld
Some SMP kernels don't have PADATA enabled, which means we actually ship our own copy of it, lifted right out of the kernel. This is completely insane and stupid, but so it goes with really grotesque "compat/" layers such as this one. What this amounts to is having to make this upstream file compile on all kernels back to 3.10. Ouch. It also means making it compile with whatever other kernels people are using, such as Grsecurity. This patch _should_ make this part of the compat layer work with Grsecurity, but unfortunately I really have no way of knowing, since I don't actually have access to their source code. I assume, though, if this doesn't work, I'll receive more complaints and will take another stab in the dark. The general situation saddens me, as I really liked that project and wish I could still play with it. Alas. Fortunately this entire problem with padata will go away, anyway, when we stop using padata, and move to a better form of multicore processing. But for now, we add this to work around the issue. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-08-05timers: do not send out double keepaliveJason A. Donenfeld
It's possible that a persistent keepalive that comes before a normal keepalive will not invalidate the normal keepalive, and then we'll needlessly send two keepalives. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-08-04noise: infer initiator or not from handshake stateJason A. Donenfeld
Suggested-by: Mathias Hall-Andersen <mathias@hall-andersen.dk> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-08-04timers: rename confusingly named functions and variablesJason A. Donenfeld
Suggested-by: Mathias Hall-Andersen <mathias@hall-andersen.dk> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-08-04receive: move lastminute guard into timer eventJason A. Donenfeld
Suggested-by: Mathias Hall-Andersen <mathias@hall-andersen.dk> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-08-03netns: work around linux 3.10 issuesJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-08-03netns: explictly test reply to sender routingJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-08-02routingtable: unbloat BUG()Jason A. Donenfeld
Really isn't necessary. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-08-02blake2s: satisfy sparseJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-08-02selftest: more checking in ratelimiterJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-08-01recieve: pskb_trim already checks lengthJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-08-01receive: single line if styleJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-28socket: move print function from compatJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-28compat: get rid of warnings on frankenkernelsJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-28recieve: cleanup variable usageJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-27compat: work around odd kernels that backport kv[mz]allocJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-26version: bump snapshotJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-20qemu: warn on all unseeded random usage when in debug modeJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-20global: wireguard.io --> wireguard.comJason A. Donenfeld
Due to concerns with the .io TLD, we are switching to using wireguard.com instead. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-20blake2s: fix up alignment issuesJason A. Donenfeld
When it's unclear if block is aligned, we just assume unaligned, rather than branching. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-20blake2s: move compression loop to assemblySamuel Neves
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-20send: use skb_queue_empty where appropriateSamuel Holland
Signed-off-by: Samuel Holland <samuel@sholland.org> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-20data: simplify no-keypair failure caseSamuel Holland
Signed-off-by: Samuel Holland <samuel@sholland.org> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-20data: use KMEM_CACHE macroJason A. Donenfeld
Suggested-by: Samuel Holland <samuel@sholland.org> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-20ratelimiter: use KMEM_CACHE macroJason A. Donenfeld
Suggested-by: Samuel Holland <samuel@sholland.org> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-20global: use pointer to net_deviceJason A. Donenfeld
DaveM prefers it to be this way per [1]. [1] http://www.spinics.net/lists/netdev/msg443992.html Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-20device: support 4.13's extact newlink paramJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-20send: orphan skbs when buffering longtermJason A. Donenfeld
Otherwise we quickly use up all of a socket's memory, which prevents a socket from sending packets to other interfaces. This also has the nice effect of letting TCP connections continue to attempt to begin, with the older ones being naturally rotated out and freed, so when a connection finally is made, only the later TCP connections are attempted, not the ones that would already have timed out. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-20selftests: ensure that there isnt CPU lag when testing rate limiterJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-07compat: work around odd kernels that backport kvfreeJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-07socket: styleJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-07qemu: update default testing kernelJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-07ratelimiter: consistently use non-bh rcuJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-06version: bump snapshotJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-06socket: the checkers distinguish between _bh and non _bhJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-06device: cleanup register_netdev logicJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-06compat: priv_destructor got backportedJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-06counter: use correct unit for indicesJason A. Donenfeld
Even though redundant bits == bits per long, we're indexing into something that uses longs as its unit, so this is correct. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-06ratelimiter: add self-testJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2017-07-04ratelimiter: use IPv6 /64 instead of /96Jason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-30 09:04:19 +0000