summaryrefslogtreecommitdiffhomepage
path: root/src/compat
AgeCommit message (Collapse)Author
2020-12-19simd: detect -rt kernels >= 5.4Jason A. Donenfeld
The 5.4 series of -rt kernels moved from PREEMPT_RT_BASE/PREEMPT_RT_FULL to PREEMPT_RT, so we have to account for it here. Otherwise users get scheduling-while-atomic splats. Reported-by: Erik Schuitema <erik@essd.nl> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-12-14compat: drop rhel 8.2, add rhel 8.4 supportJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-11-12compat: SYM_FUNC_{START,END} were backported to 5.4Jason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-08-27compat: backport NLA policy macrosJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-08-27compat: backport kfree_sensitive and switch to itJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-07-29compat: drop support for SUSE 15.1Jason A. Donenfeld
Now that WireGuard is properly supported by 15.2 and people have had sufficient time to upgrade, we can drop support for 15.1 in this compat module. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-07-29compat: add missing headers for ip_tunnel_parse_protocolJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-07-29compat: ipv6_dst_lookup_flow was ported to rhel 7.9 betaJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-07-29compat: rhel 8.3 beta removed nf_nat_core.hJason A. Donenfeld
Reported-by: Vladimir Benes <vbenes@redhat.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-06-30compat: backport ip_tunnel_parse_protocol and ip_tunnel_header_opsJason A. Donenfeld
These are required for moving wg_examine_packet_protocol out of wireguard and into upstream. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-06-29compat: SUSE 15.1 is the final SUSE we need to supportJason A. Donenfeld
>=15.2 is in SUSE's kernel now. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-06-29compat: rhel 8.3 backported skb_reset_redirectJason A. Donenfeld
Reported-by: Vladimir Benes <vbenes@redhat.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-06-22device: avoid circular netns referencesJason A. Donenfeld
Before, we took a reference to the creating netns if the new netns was different. This caused issues with circular references, with two wireguard interfaces swapping namespaces. The solution is to rather not take any extra references at all, but instead simply invalidate the creating netns pointer when that netns is deleted. In order to prevent this from happening again, this commit improves the rough object leak tracking by allowing it to account for created and destroyed interfaces, aside from just peers and keys. That then makes it possible to check for the object leak when having two interfaces take a reference to each others' namespaces. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-06-15compat: drop centos 8.1 support as 8.2 is now outJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-06-04compat: remove stale suse supportJason A. Donenfeld
The 42.x series is no longer supported, and the 15.2 kernel is getting a proper backport, so at the moment, we only care about supporting 15.1. Eventually we'll drop that too. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-05-28compat: bionic-hwe-5.0/disco kernel backported skb_reset_redirect and ipv6 flowJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-05-28compat: ubuntu appears to have backported ipv6_dst_lookup_flowJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-05-21compat: backport iptunnel_xmit to 3.11Jason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-05-21compat: narrow the breadth of iptunnel_xmit backportJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-05-21compat: widen breadth of prandom_u32_max backportJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-05-21compat: backport skb_scrub_packet to 3.11Jason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-05-21compat: widen breadth of memzero_explicit backportJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-05-21compat: widen breadth of integer constantsJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-05-20compat: support CentOS 8 explicitlyJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-05-20compat: RHEL7 backported the skb hash renamingsJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-05-20compat: ip6_dst_lookup_flow was backported to 4.14, 4.9, and 4.4Jason A. Donenfeld
Also remove the confusing 119/118 distinction from the Debian clause, which is no longer as important. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-05-20compat: backport renamed/missing skb hash membersJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-05-19compat: support RHEL 8 as 8.2, drop 8.1 supportJason A. Donenfeld
This should help with 8.3 beta rolls being recognized as 8.1 instead of 8.2 quirks. Reported-by: Vladimir Benes <vbenes@redhat.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-05-04compat: Ubuntu 19.10 and 18.04-hwe backported skb_reset_redirectJason A. Donenfeld
Reported-by: Pascal Ernster <pascal.ernster@rub.de> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-05-03compat: use bash instead of bc for HZ-->USEC calculationJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-05-03compat: detect Debian's backport of ip6_dst_lookup_flow into 4.19.118Jason A. Donenfeld
Link: https://bugs.debian.org/959157 Reported-by: Luca Filipozzi <lfilipoz@debian.org> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-04-30compat: timeconst.h is a generated artifactJason A. Donenfeld
Before we were trying to check for timeconst.h by looking in the kernel source directory. This isn't quite correct on configurations in which the object directory is separate from the kernel source directory, for example when using O="elsewhere" as a make option when building the kernel. The correct fix is to use $(CURDIR), which should point to where we want. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-04-29compat: ip6_dst_lookup_flow was backported to 4.19.119Jason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-04-29compat: ip6_dst_lookup_flow was backported to 3.16.83Jason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-04-28receive: use tunnel helpers for decapsulating ECN markingsToke Høiland-Jørgensen
WireGuard currently only propagates ECN markings on tunnel decap according to the old RFC3168 specification. However, the spec has since been updated in RFC6040 to recommend slightly different decapsulation semantics. This was implemented in the kernel as a set of common helpers for ECN decapsulation, so let's just switch over WireGuard to using those, so it can benefit from this enhancement and any future tweaks. We do not drop packets with invalid ECN marking combinations, because WireGuard is frequently used to work around broken ISPs, which could be doing that. Reported-by: Olivier Tilmans <olivier.tilmans@nokia-bell-labs.com> Cc: Dave Taht <dave.taht@gmail.com> Cc: Rodney W. Grimes <ietf@gndrsh.dnsmgr.net> Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-04-26compat: prefix icmp[v6]_ndo_send with __compatJason A. Donenfeld
Some distros that backported icmp[v6]_ndo_send still try to build the compat module in some corner case circumstances, resulting in errors. Work around this with the usual __compat games. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-04-22compat: kvmalloc_array is not required anywayJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-04-22compat: don't assume READ_ONCE barriers on old kernelsJason A. Donenfeld
76ebbe78f7390aee075a7f3768af197ded1bdfbb didn't come until 4.15. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-04-22compat: import latest fixes for ptr_ringJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-04-16compat: include sch_generic.h header for skb_reset_tcJason A. Donenfeld
Reported-by: King DuckZ <dev00@gmx.it> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-04-14compat: backport hsiphash_1u32 for testsJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-04-14compat: error out if bc is missingJason A. Donenfeld
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-04-14compat: support RHEL 7.8's faulty siphash backportJason A. Donenfeld
Reported-by: Christian Weiss <cwei@gmx.net> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-04-07compat: support latest suse 15.1 and 15.2Jason A. Donenfeld
Contributed-by: Martin Hauke <mardnh@gmx.de> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-04-01compat: queueing: skb_reset_redirect change has been backported to 5.[45]Christian Hesse
This is a follow up to 2d4fa2a6e7903ec3340f1b075456cbd84ba6a744. Upstream commit 2c64605b590edadb3fb46d1ec6badb49e940b479 has been backported to 5.4.29 and 5.5.14. Signed-off-by: Christian Hesse <mail@eworm.de> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-03-28queueing: backport skb_reset_redirect change from 5.6Jason A. Donenfeld
This backports upstream commit 2c64605b590edadb3fb46d1ec6badb49e940b479. It makes no difference for us, but it's nice to keep this code in sync with upstream as much as possible. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-03-03compat: RHEL 8.2 backported ipv6_dst_lookup_flowJason A. Donenfeld
Reported-by: Vladimir Benes <vbenes@redhat.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-02-15compat: RHEL 7 backported skb_ensure_writable()Luis Ressel
Reported-by: chotaire <chotaire@chotaire.net> Signed-off-by: Luis Ressel <aranea@aixah.de> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-02-14send: account for mtu=0 devicesJason A. Donenfeld
It turns out there's an easy way to get packets queued up while still having an MTU of zero, and that's via persistent keep alive. This commit makes sure that in whatever condition, we don't wind up dividing by zero. Note that an MTU of zero for a wireguard interface is something quasi-valid, so I don't think the correct fix is to limit it via min_mtu. This can be reproduced easily with: ip link add wg0 type wireguard ip link add wg1 type wireguard ip link set wg0 up mtu 0 ip link set wg1 up wg set wg0 private-key <(wg genkey) wg set wg1 listen-port 1 private-key <(wg genkey) peer $(wg show wg0 public-key) wg set wg0 peer $(wg show wg1 public-key) persistent-keepalive 1 endpoint 127.0.0.1:1 However, while min_mtu=0 seems fine, it makes sense to restrict the max_mtu. This commit also restricts the maximum MTU to the greatest number for which rounding up to the padding multiple won't overflow a signed integer. Packets this large were always rejected anyway eventually, due to checks deeper in, but it seems more sound not to even let the administrator configure something that won't work anyway. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-02-12netns: ensure that icmp src address is correct with natJason A. Donenfeld
This is a small test to ensure that icmp_ndo_send is actually doing the right with with regards to the source address. It tests this by ensuring that the error comes back along the right path. Also, backport the new ndo function for this. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-17 09:57:51 +0000