aboutsummaryrefslogtreecommitdiff
path: root/sys/dev/wg
Commit message (Collapse)AuthorAgeFilesLines
* if_wg: Prefix crypto_init() & crypto_deinit() with wg_ for a cleaner namespace.Bruce M Simpson2026-08-033-6/+6
| | | | | Both these functions have non-static linkage for good reasons, however, their naming may confuse folk when working with crypto(9) code at global scope.
* wg(4): Check for crypto operation errorsJohn Baldwin2026-07-291-1/+10
| | | | | | | | | | | | | | | | In particular, handle authentication errors due to bad MACs when decrypting packets. Since the current dispatch code assumes synchronous OCF sessions by design, explicitly reject any created OCF session that is not synchronous. Software sessions are always synchronous in practice, so this should be a nop. Approved by: so Security: FreeBSD-SA-26:52.if_wg Security: CVE-2026-58085 Reviewed by: markj Sponsored by: Chelsio Communications
* netinet6: store ND context directly in struct in6_ifextraGleb Smirnoff2026-01-231-2/+2
| | | | | | | | | | | | | | | | | | | | | Stop using struct nd_ifinfo for that, because it is an API struct for SIOCGIFINFO_IN6. The functional changes are isolated to the protocol attach and detach: in6_ifarrival(), nd6_ifattach(), in6_ifdeparture(), nd6_ifdetach(), as well as to the nd6_ioctl(), nd6_ra_input(), nd6_slowtimo() and in6_ifmtu(). The dad_failures member was just renamed to match the rest. The M_IP6NDP malloc(9) type declaration moved to files that actually use it. The rest of the changes are mechanical substitution of double pointer dereference via ND_IFINFO() to a single pointer dereference. This was achieved with a sed(1) script: s/ND_IFINFO\(([a-z0-9>_.-]+)\)->(flags|linkmtu|basereachable|reachable|retrans|chlim)/\1->if_inet6->nd_\2/g s/nd_chlim/nd_curhoplimit/g Reviewed by: tuexen, madpilot Differential Revision: https://reviews.freebsd.org/D54725
* wg: fix LINT-NOIP buildKristof Provost2025-06-301-0/+2
| | | | | Fixes: d15d610fac97df4fefed3f14b31dcfbdcec65bf9 Sponsored by: Rubicon Communications, LLC ("Netgate")
* kern: wg: add support for removing Allowed-IPsKyle Evans2025-06-262-1/+75
| | | | | | | | | | | | | This was recently added to Linux to improve incremental update support, as you could previously add Allowed-IPs but not remove without replacing the whole set (and thus, potentially disrupting existing traffic). Removal is incredibly straightforward; we'll find it in p_aips first to ensure that it's actually valid for this peer, then we'll delete it from the radix tree before we remove the corresponding p_aips entry. Reviewed by: Jason A. Donenfeld, jhb Differential Revision: https://reviews.freebsd.org/D50448
* kern: wg: split address/mask construction out of wg_aip_add()Kyle Evans2025-06-261-23/+40
| | | | | | | | We'll re-use these in a future wg_aip_del() to perfectly reconstruct what we expect to find in a_addr/a_mask. Reviewed by: ivy, markj (both earlier version), Aaron LI, jhb Differential Revision: https://reviews.freebsd.org/D50447
* kern: wg: refactor out some repetitive bits in allowed-ip configKyle Evans2025-06-261-4/+12
| | | | | | | | | | | The only difference in the wg_aip_add() call after IP validation is the address family. Just pull that out into a variable and avoid the two different callsites for wg_aip_add(). A future change will add a new call for each case to remove an address from the peer, so it's nice to avoid needing to repeat the logic for two different branches. Reviewed by: Aaron LI, Jason A. Donenfeld, ivy, jhb, markj Differential Revision: https://reviews.freebsd.org/D50446
* wg: Improve wg_peer_alloc() to simplify the callingAaron LI2025-04-181-16/+26
| | | | | | | | | | | | Move the necessary extra logics (i.e., noise_remote_enable() and TAILQ_INSERT_TAIL()) from wg_ioctl_set() to wg_peer_alloc(), and thus make it easier to be called. Actually, the updated version is more asymmetric to wg_peer_destroy() and thus less likely to be misused. Meanwhile, rename it to wg_peer_create() to look more consistent with wg_peer_destroy(). Reviewed by: aly_aaronly.me (diff), markj Obtained from: DragonflyBSD 902964ab24ba (with some changes)
* kern: wg: remove overly-restrictive address family checkKyle Evans2025-03-041-5/+3
| | | | | | | | | | | | | | | | | | | IPv4 packets can be routed via an IPv6 nexthop, so the handling of the parsed address family is more strict than it needs to be. If we have a valid header that matches a known peer, then we have no reason to decline the packet. Convert it to an assertion that it matches the destination as viewed by the stack below it, instead. `dst` may be the gateway instead of the destination in the case of a nexthop, so the `af` assignment must be switched to use the destination in all cases. Add a test case that approximates a setup like in the PR and demonstrates the issue. PR: 284857 Reviewed by: markj (earlier version), zlei Differential Revision: https://reviews.freebsd.org/D49172
* wg: Implement if_transmit unconditionallyMark Johnston2024-06-161-2/+2
| | | | | | | | | | | | | | Commit bf454ca88bdf made wg_transmit() defined only when "device netmap" is configured, as if_wg's if_transmit implementation should never be called otherwise, but this breaks a requirement that interfaces implement both or neither of if_transmit and if_qflush. Restore the old behaviour of unconditionally defining wg_transmit(). It contains an assertion that the interface is in netmap mode. Reported by: peterj MFC after: 2 weeks Fixes: bf454ca88bdf ("wg: Add netmap support")
* wg: uma_zcreate() does not failMark Johnston2024-04-242-6/+5
| | | | | | No functional change intended. MFC after: 1 week
* wg: Add netmap supportMark Johnston2024-04-201-6/+149
| | | | | | | | | | | | | | | | | | | | | | | When in netmap (emulated) mode, wireguard interfaces prepend or strip a dummy ethernet header when interfacing with netmap. The netmap application thus sees unencrypted, de-encapsulated frames with a fixed header. In this mode, netmap hooks the if_input and if_transmit routines of the ifnet. Packets from the host TX ring are handled by wg_if_input(), which simply hands them to the netisr layer; packets which would otherwise be tunneled are intercepted in wg_output() and placed in the host RX ring. The "physical" TX ring is processed by wg_transmit(), which behaves identically to wg_output() when netmap is not enabled, and packets appear in the "physical" RX ring by hooking wg_deliver_in(). Reviewed by: vmaffione MFC after: 1 month Sponsored by: Klara, Inc. Sponsored by: Zenarmor Differential Revision: https://reviews.freebsd.org/D43460
* bpf: Make BPF interop consistent with if_loopSeth Hoffert2024-04-191-1/+2
| | | | | | | | | | | | The pseudo_AF_HDRCMPLT check is already being done in if_loop and just needed to be ported over to if_ic, if_wg, if_disc, if_gif, if_gre, if_me, if_tuntap and ng_iface. This is needed in order to allow these interfaces to work properly with e.g., tcpreplay. PR: 256587 Reviewed by: markj MFC after: 2 weeks Pull Request: https://github.com/freebsd/freebsd-src/pull/876
* wg: Use ENETUNREACH when transmitting to a non-existent peerMark Johnston2024-04-011-4/+1
| | | | | | | | | | | | The old errno value used is specifically for Capsicum and shouldn't be co-opted in this way. It has special handling in the generic syscall layer (see syscallret()). OpenBSD returns ENETUNREACH in this case; let's do the same thing. Reviewed by: kevans, imp MFC after: 2 weeks Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D44582
* if_wg: use proper barriers around pkt->p_stateKyle Evans2024-03-151-6/+4
| | | | | | | | | | | | | | | | | | | | | Without appropriate load-synchronization to pair with store barriers in wg_encrypt() and wg_decrypt(), the compiler and hardware are often allowed to reorder these loads in wg_deliver_out() and wg_deliver_in() such that we end up with a garbage or intermediate mbuf that we try to pass on. The issue is particularly prevalent with the weaker memory models of !x86 platforms. Switch from the big-hammer wmb() to more explicit acq/rel atomics to both make it obvious what we're syncing up with, and to avoid somewhat hefty fences on platforms that don't necessarily need this. With this patch, my dual-iperf3 reproducer is dramatically more stable than it is without on aarch64. PR: 264115 MFC after: 1 week Reviewed by: andrew, zlei Differential Revision: https://reviews.freebsd.org/D44283
* wg: detach bpf upon destroy as wellAaron LI2024-01-221-0/+1
| | | | | | | | | | bpfattach() is called in wg_clone_create(), but the bpfdetach() is missing from wg_close_destroy(). Add the missing bpfdetach() to avoid leaking both the associated bpf bits as well as the ifnet that bpf will hold a reference to. PR: 276526 MFC after: 3 days
* if_wg: fix access to noise_local->l_has_identity and l_privateAaron LI2024-01-171-0/+4
| | | | | | | | These members are protected by the identity lock, so rlock it in noise_remote_alloc() and then assert that we have it held to some extent in noise_precompute_ss(). PR: 276392
* if_wg: fix erroneous calculation in calculate_padding() for p_mtu == 0Aaron LI2024-01-171-3/+7
| | | | | | | | | In practice this is harmless; only keepalive packets may realistically have p_mtu == 0, and they'll also have no payload so the math works out the same either way. Still, let's prefer technical accuracy and calculate the amount of padding needed rather than the padded length... PR: 276363
* sockets: don't malloc/free sockaddr memory on getpeername/getsocknameGleb Smirnoff2023-11-301-11/+13
| | | | | | | | | | | | | Just like it was done for accept(2) in cfb1e92912b4, use same approach for two simplier syscalls that return socket addresses. Although, these two syscalls aren't performance critical, this change generalizes some code between 3 syscalls trimming code size. Following example of accept(2), provide VNET-aware and INVARIANT-checking wrappers sopeeraddr() and sosockaddr() around protosw methods. Reviewed by: tuexen Differential Revision: https://reviews.freebsd.org/D42694
* if_wg: Missing radix unlock can cause deadlockAaron LI2023-11-111-1/+1
| | | | | | | | | | In function 'wg_aip_add()', the error path of returning ENOMEM when (node == NULL) is forgetting to unlock the radix tree, and thus may lead to a deadlock. PR: 275001 Reviewed by: kp MFC after: 1 week
* sys: Remove $FreeBSD$: two-line .h patternWarner Losh2023-08-161-2/+0
| | | | Remove /^\s*\*\n \*\s+\$FreeBSD\$$\n/
* wg: fix a number of issues with module load failure handlingKyle Evans2023-06-232-20/+17
| | | | | | | | | | | | | | | | | | | | | | | | | If MOD_LOAD fails, then MOD_UNLOAD will be called to unwind module state, but wg_module_init() will have already deinitialized everything it needs to in a manner that renders it unsafe to call MOD_UNLOAD after (e.g., freed zone not reset to NULL, wg_osd_jail_slot not reset to 0). Let's simply stop trying to handle freeing everything in wg_module_init() to simplify it; let the subsequent MOD_UNLOAD deal with it, and let's make that robust against partially-constructed state. jhb@ notes that MOD_UNLOAD being called if MOD_LOAD fails is kind of an anomaly that doesn't match other paradigms in the kernel; e.g., if device_attach() fails, we don't invoke device_detach(). It's likely that a future commit will revert this and instead stop calling MOD_UNLOAD if MOD_LOAD fails, expecting modules to clean up after themselves in MOD_LOAD upon failure. Some other modules already do this and may see similar problems to the wg module (see: carp). The proper fix is decidedly a bit too invasive to do this close to 14 branching, and it requires auditing all kmods (base + ports) for potential leaks. PR: 272089 Reviewed by: emaste MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D40708
* wg: fix MOD_LOAD to fail properly if cookie_init() failsKyle Evans2023-06-231-1/+2
| | | | | | | | | Previously we'd jump to the `free_crypto` label, but never set `ret` to a failure value -- it would retain success from the call just prior. Set ret up properly. This is part of D40708, but not the main point of the change.
* wg: change module name to if_wgKristof Provost2023-04-291-4/+4
| | | | | | | | | | | | | Other virtual interface drivers (e.g. if_gif, if_stf, if_ovpn) all start with if_. The wireguard file is also named if_wg, but the module name was 'wg'. Fix this inconsistency. Reported by: Christian McDonald <cmcdonald@netgate.com> Reviewed by: zlei, kevans Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D39853
* Mechanically convert wg(4) to IfAPIJustin Hibbits2023-02-031-54/+55
| | | | | | Reviewed By: jhb Sponsored by: Juniper Networks, Inc. Differential Revision: https://reviews.freebsd.org/D38307
* Switch wg(4) to the new if_clone KPIAlan Somers2023-01-101-10/+20
| | | | | | MFC after: 2 weeks Reviewed by: jhb Differential Revision: https://reviews.freebsd.org/D37740
* wg: Use NET_EPOCH_DRAIN_CALLBACKS macroZhenlei Huang2022-12-281-1/+1
| | | | | | Reviewed by: jhb, kp Approved by: kp (mentor) Differential Revision: https://reviews.freebsd.org/D37734
* wg: Drop the compat shim for sbcreatecontrol().John Baldwin2022-11-111-7/+0
| | | | | | | I had to make a few other changes when merging the driver to stable/13 anyway, so adjusting this as well isn't really a big deal. MFC after: 3 days
* wg: Trim compat shims for versions older than current stable/13.John Baldwin2022-10-283-1761/+52
| | | | | | Reviewed by: kevans, markj, emaste Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D36913
* wg: Retire now unused support.h.John Baldwin2022-10-283-23/+0
| | | | | | Reviewed by: kevans, markj, emaste Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D36912
* wg: Use zfree.John Baldwin2022-10-282-10/+5
| | | | | | Reviewed by: kevans, markj, emaste Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D36911
* wg: Use atomic(9) instead of concurrency-kit atomics.John Baldwin2022-10-282-63/+65
| | | | | | | | | Kernel sanitizers only support atomic(9) operations. Reviewed by: kevans, markj, emaste Reported by: markj Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D36910
* Import the WireGuard driver from zx2c4.com.John Baldwin2022-10-2811-0/+7357
This commit brings back the driver from FreeBSD commit f187d6dfbf633665ba6740fe22742aec60ce02a2 plus subsequent fixes from upstream. Relative to upstream this commit includes a few other small fixes such as additional INET and INET6 #ifdef's, #include cleanups, and updates for recent API changes in main. Reviewed by: pauamma, gbe, kevans, emaste Obtained from: git@git.zx2c4.com:wireguard-freebsd @ 3cc22b2 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D36909
generated by cgit v1.3 (git 2.53.0) at 2026-09-01 18:25:19 +0000