This was recently added to Linux to improve incremental update support, as you could previously add Allowed-IPs but not remove without replacing the whole set (and thus, potentially disrupting existing traffic). Removal is incredibly straightforward; we'll find it in p_aips first to ensure that it's actually valid for this peer, then we'll delete it from the radix tree before we remove the corresponding p_aips entry. Reviewed by: Jason A. Donenfeld, jhb (cherry picked from commit d15d610fac97df4fefed3f14b31dcfbdcec65bf9) (cherry picked from commit d1ac3e245f084ee0637bde9a446687621358c418)
We'll re-use these in a future wg_aip_del() to perfectly reconstruct what we expect to find in a_addr/a_mask. Reviewed by: ivy, markj (both earlier version), Aaron LI, jhb (cherry picked from commit 2475a3dab0d5c5614e303c0022a834f725e2a078)
The only difference in the wg_aip_add() call after IP validation is the address family. Just pull that out into a variable and avoid the two different callsites for wg_aip_add(). A future change will add a new call for each case to remove an address from the peer, so it's nice to avoid needing to repeat the logic for two different branches. Reviewed by: Aaron LI, Jason A. Donenfeld, ivy, jhb, markj (cherry picked from commit ba2607ae7dff17957d9e62ccd567ba716c168e77)
Move the necessary extra logics (i.e., noise_remote_enable() and TAILQ_INSERT_TAIL()) from wg_ioctl_set() to wg_peer_alloc(), and thus make it easier to be called. Actually, the updated version is more asymmetric to wg_peer_destroy() and thus less likely to be misused. Meanwhile, rename it to wg_peer_create() to look more consistent with wg_peer_destroy(). Reviewed by: aly_aaronly.me (diff), markj Obtained from: DragonflyBSD 902964ab24ba (with some changes) (cherry picked from commit 7121e9414f294d116caeadd07ebd969136d3a631)
IPv4 packets can be routed via an IPv6 nexthop, so the handling of the parsed address family is more strict than it needs to be. If we have a valid header that matches a known peer, then we have no reason to decline the packet. Convert it to an assertion that it matches the destination as viewed by the stack below it, instead. `dst` may be the gateway instead of the destination in the case of a nexthop, so the `af` assignment must be switched to use the destination in all cases. Add a test case that approximates a setup like in the PR and demonstrates the issue. PR: 284857 Reviewed by: markj (earlier version), zlei (cherry picked from commit 2bef0d54f74dad6962ef7d1dfa407e95cb4fb4ad)
Commit bf454ca88bdf made wg_transmit() defined only when "device netmap"
is configured, as if_wg's if_transmit implementation should never be
called otherwise, but this breaks a requirement that interfaces
implement both or neither of if_transmit and if_qflush.
Restore the old behaviour of unconditionally defining wg_transmit(). It
contains an assertion that the interface is in netmap mode.
Reported by: peterj
MFC after: 2 weeks
Fixes: bf454ca88bdf ("wg: Add netmap support")
(cherry picked from commit 5515e8874a8d85a8d961fca64c494dfc1bea4bd0)
When in netmap (emulated) mode, wireguard interfaces prepend or strip a dummy ethernet header when interfacing with netmap. The netmap application thus sees unencrypted, de-encapsulated frames with a fixed header. In this mode, netmap hooks the if_input and if_transmit routines of the ifnet. Packets from the host TX ring are handled by wg_if_input(), which simply hands them to the netisr layer; packets which would otherwise be tunneled are intercepted in wg_output() and placed in the host RX ring. The "physical" TX ring is processed by wg_transmit(), which behaves identically to wg_output() when netmap is not enabled, and packets appear in the "physical" RX ring by hooking wg_deliver_in(). Reviewed by: vmaffione MFC after: 1 month Sponsored by: Klara, Inc. Sponsored by: Zenarmor Differential Revision: https://reviews.freebsd.org/D43460 (cherry picked from commit bf454ca88bdf4acfa873386e876ff5e772e6a830)
The pseudo_AF_HDRCMPLT check is already being done in if_loop and just needed to be ported over to if_ic, if_wg, if_disc, if_gif, if_gre, if_me, if_tuntap and ng_iface. This is needed in order to allow these interfaces to work properly with e.g., tcpreplay. PR: 256587 Reviewed by: markj MFC after: 2 weeks Pull Request: https://github.com/freebsd/freebsd-src/pull/876 (cherry picked from commit 2cb0fce24d64039090dc9243cdf0715ee80c91b1)
No functional change intended. MFC after: 1 week (cherry picked from commit b6a0ed7c78dd45937e404706620467bef61c308d)
The old errno value used is specifically for Capsicum and shouldn't be co-opted in this way. It has special handling in the generic syscall layer (see syscallret()). OpenBSD returns ENETUNREACH in this case; let's do the same thing. Reviewed by: kevans, imp MFC after: 2 weeks Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D44582 (cherry picked from commit 63613e3ba1e188e9fece43e1613bd697f04b345e)