From patchwork Thu Oct 18 14:56:44 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Jason A. Donenfeld" X-Patchwork-Id: 149151 Delivered-To: patch@linaro.org Received: by 2002:a2e:8595:0:0:0:0:0 with SMTP id b21-v6csp2083760lji; Thu, 18 Oct 2018 07:57:36 -0700 (PDT) X-Google-Smtp-Source: ACcGV63TpdDS714zcmZ0GbrO6QAYaTpDos3gRshb4UgxAL+kHaFL0LY2I+wrgkfXk2QyL7eTNdp9 X-Received: by 2002:a63:6a86:: with SMTP id f128-v6mr29213980pgc.165.1539874656136; Thu, 18 Oct 2018 07:57:36 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1539874656; cv=none; d=google.com; s=arc-20160816; b=GVi76dswGtlOKJw4yr0PijXset0iK2Udsv+2pVHAjLUvrwIDOjPj8Sr4vP8e++DTx1 wQMRcbTzRP1extPLmmhfzwPP3EJ2WLBqSOWaTpFpXnpeEdM7a5Y82pOxDVGfXa9UJh9S ksc9ka8KHTU71hkodjyb88oQWBpxe2NZXTEuIRGWo17Q1wpdLSqotkTOXbVHrsQA9mKO sP4II/9o1xO6FZCGc1H3f7fSgL4uy8jWXPw+IqUurmz/2IGuwMyhku1rcsFu07db3S3e 7wOrDXufWdmjUwE/5+JRVHxcmfNISuKqOf6v8/F4XzRgwjTYw80ZsG+CVD6NT2ng4vR1 ti6A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=mZcHi50exichlC/K/Qhi5AyHMrKcnwnAOx/VEmeJ+dQ=; b=WwVzXEIXrdxt2QvnMDzEnc/lrgM0UURJaTwqxNgIOz43eMWdx2jdJTSiDbPPu6Gkwj MAYcsyTmgCI21mIoC0pNeSZYW+MHrEsyrgfbSUyUxdOfS2ZhXoFjrm1xTR75b8jZpkXC QdweJMKMUeNPK95e2TkwcgjsXBD6pKU3kaMF9u5QB6J8jyCeputZNWCB7gJ1BNCn2tPP xU00iNRWMt/fNd7Bg76iJLHmH1AnaL4n1xdW1tKWnmu8RaL2YeBJXkz3UqL2HVVhYUGH s0PCSE43gWvewVQAAzZuWMKvg9UYR10RHlIG14r8Xp83fxO1iCoJY/sZ1zCXYzlhAd31 an2w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@zx2c4.com header.s=mail header.b=bXhxNWgp; spf=pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=zx2c4.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id x6-v6si21225309pgf.303.2018.10.18.07.57.35; Thu, 18 Oct 2018 07:57:36 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@zx2c4.com header.s=mail header.b=bXhxNWgp; spf=pass (google.com: best guess record for domain of linux-crypto-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=zx2c4.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726359AbeJRW65 (ORCPT + 2 others); Thu, 18 Oct 2018 18:58:57 -0400 Received: from frisell.zx2c4.com ([192.95.5.64]:46347 "EHLO frisell.zx2c4.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726816AbeJRW65 (ORCPT ); Thu, 18 Oct 2018 18:58:57 -0400 Received: by frisell.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 22d6653d; Thu, 18 Oct 2018 14:55:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=zx2c4.com; h=from:to:cc :subject:date:message-id:mime-version:content-type :content-transfer-encoding; s=mail; bh=sbzpnrsLr6BDTQn0FnaV6LGTh Qk=; b=bXhxNWgpMWFqDEdiWXXYdHFpxj5jwZc8BQrdCu7huFwEqifePHbaZA00o hIYcskpPh1S5hVxqg3j3FwB9TimJgMdcv28i/tByoNIktuVMhatEQ+XWjKBIuJJI f94x+s7XZY/bl6GEwDBBEE//CX7P13nDNmPW8jnCZjdnGh78iPm+ibj9SrkJwnn/ S9qJe8vep3nFjYFMhuYDEHvFpros7no4oGg5S0T0QO9UcXbXM8Lltx5/YigRrWVd 7VlsS4cUllj/oXgzEFHtk8OjKYIi74FRWWnirqHIpFBbKRugd1Mf06GKpiovIIHK Z/41y1RwxdupCGVwnl8tZTijFYf/g== Received: by frisell.zx2c4.com (ZX2C4 Mail Server) with ESMTPSA id 068d587a (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256:NO); Thu, 18 Oct 2018 14:55:31 +0000 (UTC) From: "Jason A. Donenfeld" To: linux-kernel@vger.kernel.org, netdev@vger.kernel.org, linux-crypto@vger.kernel.org, davem@davemloft.net, gregkh@linuxfoundation.org Cc: "Jason A. Donenfeld" Subject: [PATCH net-next v8 00/28] WireGuard: Secure Network Tunnel Date: Thu, 18 Oct 2018 16:56:44 +0200 Message-Id: <20181018145712.7538-1-Jason@zx2c4.com> MIME-Version: 1.0 Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org Changes v7->v8, along with who suggested it. -------------------------------------------- - Implementations that fail the selftests are now disabled, after a warning is printed. This way users don't make wrong calculations, even in the face of a rather grave bug. - [Sultan Alsawaf] When assigning to a boolean, prefer "BIT(i) & a" to "(a >> i) & 1". - [Andrew Lunn] Avoid control statements inside macros. - [Jiri Pirko] Prefix functions used in callbacks with wg_. - [Jiri Pirko] Rename struct wireguard_peer and struct wireguard_device to struct wg_peer and struct wg_device. - [Eugene Syromiatnikov] Do not use nla type field as an index, and actually don't use an index at all, because it has no meaning or relevance at all. - [Joe Perches] Do not place a space between for_each iterators and parentheses. - Enumerable style cleanups and nits. - [Arnd Bergmann] Swap endianness in allowedips early on in case optimizer is able to look a bit further in but not too far, resulting in a warning from -Wmaybe-uninitialized. - [Jiri Pirko] Use textual error labels instead of numerical ones. - [Jiri Pirko] Better module description string. - [Eric Biggers] In poly1305 port to crypto API, account for short inputs in final function, in which case -ENOKEY should be returned. ----------------------------------------------------------- This patchset is available on git.kernel.org in this branch, where it may be pulled directly for inclusion into net-next: * https://git.kernel.org/pub/scm/linux/kernel/git/zx2c4/linux.git/log/?h=jd/wireguard ----------------------------------------------------------- WireGuard is a secure network tunnel written especially for Linux, which has faced around three years of serious development, deployment, and scrutiny. It delivers excellent performance and is extremely easy to use and configure. It has been designed with the primary goal of being both easy to audit by virtue of being small and highly secure from a cryptography and systems security perspective. WireGuard is used by some massive companies pushing enormous amounts of traffic, and likely already today you've consumed bytes that at some point transited through a WireGuard tunnel. Even as an out-of-tree module, WireGuard has been integrated into various userspace tools, Linux distributions, mobile phones, and data centers. There are ports in several languages to several operating systems, and even commercial hardware and services sold integrating WireGuard. It is time, therefore, for WireGuard to be properly integrated into Linux. Ample information, including documentation, installation instructions, and project details, is available at: * https://www.wireguard.com/ * https://www.wireguard.com/papers/wireguard.pdf As it is currently an out-of-tree module, it lives in its own git repo and has its own mailing list, and every commit for the module is tested against every stable kernel since 3.10 on a variety of architectures using an extensive test suite: * https://git.zx2c4.com/WireGuard https://git.kernel.org/pub/scm/linux/kernel/git/zx2c4/WireGuard.git/ * https://lists.zx2c4.com/mailman/listinfo/wireguard * https://www.wireguard.com/build-status/ The project has been broadly discussed at conferences, and was presented to the Netdev developers in Seoul last November, where a paper was released detailing some interesting aspects of the project. Dave asked me after the talk if I would consider sending in a v1 "sooner rather than later", hence this patchset. Zinc was presented at Kernel Recipes in September, and a video is available online. Both Zinc and WireGuard will be presented at the conference in Vancouver in November. * https://www.wireguard.com/presentations/ * https://www.wireguard.com/papers/wireguard-netdev22.pdf * Zinc talk: https://www.youtube.com/watch?v=bFhdln8aJ_U * Netdev talk: https://www.youtube.com/watch?v=54orFwtQ1XY The cryptography in the protocol itself has been formally verified by several independent academic teams with positive results, and I know of two additional efforts on their way to further corroborate those findings. The version 1 protocol is "complete", and so the purpose of this review is to assess the implementation of the protocol. However, it still may be of interest to know that the thing you're reviewing uses a protocol with various nice security properties: * https://www.wireguard.com/formal-verification/ This patchset is divided into four segments. The first introduces a very simple helper for working with the FPU state for the purposes of amortizing SIMD operations. The second segment is a small collection of cryptographic primitives, split up into several commits by primitive and by hardware. The third shows usage of Zinc within the existing crypto API and as a replacement to the existing crypto API. The last is WireGuard itself, presented as an unintrusive and self-contained virtual network driver. It is intended that this entire patch series enter the kernel through DaveM's net-next tree. Subsequently, WireGuard patches will go through DaveM's net-next tree, while Zinc patches will go through Greg KH's tree in cases when an entire development cycle has no relationships with existing code in crypto/; however, if there are any relationships with code in crypto/, then pull requests will be sent to Herbert instead in case there are merge conflicts. Enjoy, Jason