LKML Archive on lore.kernel.org
 help / color / Atom feed
From: "Jason A. Donenfeld" <Jason@zx2c4.com>
To: linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
	linux-crypto@vger.kernel.org, davem@davemloft.net,
	gregkh@linuxfoundation.org
Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>
Subject: [PATCH net-next v5 00/20] WireGuard: Secure Network Tunnel
Date: Tue, 18 Sep 2018 18:16:26 +0200
Message-ID: <20180918161646.19105-1-Jason@zx2c4.com> (raw)

v5 has the most comprehensive set of changes yet, and I think should
finally address all of the relevant issues brought up on the mailing
list. In particular, this feedback has come from:

  - Andy Lutomirski
  - Eric Biggers
  - Ard Biesheuvel
  - Kevin Easton
  - Andrew Lunn
  - Martin Willi

Changes v4->v5:
---------------
  - Use fewer inlines, except when measured as necessary.
  - Reduce size of scattergather array to fit within stack on
    small systems.
  - Account for larger stack frames with KASAN.
  - The x86_64 implementations are selected according to input length.
  - Avoid using simd for small blocks on x86_64.
  - The simd_get/put API is now pass by reference, so that the user
    can lazily use the context based on whether or not it's needed.
    See the description again in the first commit for this.
  - Add cycle counts for different sizes for x86_64 commit messages.
  - Relax simd during chapoly sg loop.
  - Replace -include with #if defined(...)
  - Saner and simpler Kconfig.
  - Split into separate modules instead of one monolithic zinc.
  - The combination of these three last items means that there no
    longer are any conditionals in our Makefile.
  - Martin showed a performance regression using tcrypt in v4. This
    has been triaged and fixed, and now the Zinc code runs faster
    than the previous code.
  - While I initially wasn't going to do this for the initial
    patchset, it was just so simple to do: now there's a nosimd
    module parameter that can be used to disable simd instructions
    for debugging and testing, or on weird systems.

-----------------------------------------------------------

This patchset is available on git.kernel.org in this branch, where it may be
pulled directly for inclusion into net-next:

  * https://git.kernel.org/pub/scm/linux/kernel/git/zx2c4/linux.git/log/?h=jd/wireguard

-----------------------------------------------------------

WireGuard is a secure network tunnel written especially for Linux, which
has faced around three years of serious development, deployment, and
scrutiny. It delivers excellent performance and is extremely easy to
use and configure. It has been designed with the primary goal of being
both easy to audit by virtue of being small and highly secure from a
cryptography and systems security perspective. WireGuard is used by some
massive companies pushing enormous amounts of traffic, and likely
already today you've consumed bytes that at some point transited through
a WireGuard tunnel. Even as an out-of-tree module, WireGuard has been
integrated into various userspace tools, Linux distributions, mobile
phones, and data centers. There are ports in several languages to
several operating systems, and even commercial hardware and services
sold integrating WireGuard. It is time, therefore, for WireGuard to be
properly integrated into Linux.

Ample information, including documentation, installation instructions,
and project details, is available at:

  * https://www.wireguard.com/
  * https://www.wireguard.com/papers/wireguard.pdf

As it is currently an out-of-tree module, it lives in its own git repo
and has its own mailing list, and every commit for the module is tested
against every stable kernel since 3.10 on a variety of architectures
using an extensive test suite:

  * https://git.zx2c4.com/WireGuard
    https://git.kernel.org/pub/scm/linux/kernel/git/zx2c4/WireGuard.git/
  * https://lists.zx2c4.com/mailman/listinfo/wireguard
  * https://www.wireguard.com/build-status/

The project has been broadly discussed at conferences, and was presented
to the Netdev developers in Seoul last November, where a paper was
released detailing some interesting aspects of the project. Dave asked
me after the talk if I would consider sending in a v1 "sooner rather
than later", hence this patchset. A decision is still waiting from the
Linux Plumbers Conference, but an update on these topics may be presented
in Vancouver in a few months. Prior presentations:

  * https://www.wireguard.com/presentations/
  * https://www.wireguard.com/papers/wireguard-netdev22.pdf

The cryptography in the protocol itself has been formally verified by
several independent academic teams with positive results, and I know of
two additional efforts on their way to further corroborate those
findings. The version 1 protocol is "complete", and so the purpose of
this review is to assess the implementation of the protocol. However, it
still may be of interest to know that the thing you're reviewing uses a
protocol with various nice security properties:

  * https://www.wireguard.com/formal-verification/

This patchset is divided into four segments. The first introduces a very
simple helper for working with the FPU state for the purposes of amortizing
SIMD operations. The second segment is a small collection of cryptographic
primitives, split up into several commits by primitive and by hardware. The
third shows usage of Zinc within the existing crypto API and as a replacement
to the existing crypto API. The last is WireGuard itself, presented as an
unintrusive and self-contained virtual network driver.

It is intended that this entire patch series enter the kernel through
DaveM's net-next tree. Subsequently, WireGuard patches will go through
DaveM's net-next tree, while Zinc patches will go through Greg KH's tree.

Enjoy,
Jason

             reply index

Thread overview: 65+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-09-18 16:16 Jason A. Donenfeld [this message]
2018-09-18 16:16 ` [PATCH net-next v5 01/20] asm: simd context helper API Jason A. Donenfeld
2018-09-18 16:16 ` [PATCH net-next v5 02/20] zinc: introduce minimal cryptography library Jason A. Donenfeld
2018-09-20 15:41   ` Ard Biesheuvel
2018-09-20 16:01     ` Andy Lutomirski
2018-09-20 16:02     ` Arnd Bergmann
2018-09-21  0:11       ` Jason A. Donenfeld
2018-09-21  3:12         ` Andrew Lunn
2018-09-21  3:16           ` Jason A. Donenfeld
2018-09-21  3:23           ` Andy Lutomirski
2018-09-21  4:15             ` Jason A. Donenfeld
2018-09-21  4:30               ` Ard Biesheuvel
2018-09-21  4:32                 ` Jason A. Donenfeld
2018-09-21  4:52                 ` Andy Lutomirski
2018-09-22 16:11         ` Arnd Bergmann
2018-09-25  7:18           ` Arnd Bergmann
2018-09-25 14:29             ` Jason A. Donenfeld
2018-09-21  0:17     ` Jason A. Donenfeld
2018-09-25 10:25   ` Ard Biesheuvel
2018-09-25 14:44     ` Jason A. Donenfeld
2018-09-18 16:16 ` [PATCH net-next v5 03/20] zinc: ChaCha20 generic C implementation and selftest Jason A. Donenfeld
2018-09-19  1:08   ` Eric Biggers
2018-09-19  2:02     ` Jason A. Donenfeld
2018-09-18 16:16 ` [PATCH net-next v5 04/20] zinc: ChaCha20 x86_64 implementation Jason A. Donenfeld
2018-09-18 22:29   ` Thomas Gleixner
2018-09-19  2:14     ` Jason A. Donenfeld
2018-09-19  6:13       ` Thomas Gleixner
2018-09-19 11:33         ` Jason A. Donenfeld
2018-09-18 16:16 ` [PATCH net-next v5 05/20] zinc: ChaCha20 ARM and ARM64 implementations Jason A. Donenfeld
2018-09-18 16:16 ` [PATCH net-next v5 06/20] zinc: ChaCha20 MIPS32r2 implementation Jason A. Donenfeld
2018-09-18 20:25   ` Paul Burton
2018-09-20 13:19     ` Jason A. Donenfeld
2018-09-18 16:16 ` [PATCH net-next v5 07/20] zinc: Poly1305 generic C implementations and selftest Jason A. Donenfeld
2018-09-19  0:50   ` Eric Biggers
2018-09-19  1:35     ` Jason A. Donenfeld
2018-09-19  4:13       ` Andy Lutomirski
2018-09-19 11:50         ` Jason A. Donenfeld
2018-09-19 12:26           ` Jason A. Donenfeld
2018-09-19  1:39     ` Jason A. Donenfeld
2018-09-19  1:41       ` Jason A. Donenfeld
2018-09-18 16:16 ` [PATCH net-next v5 08/20] zinc: Poly1305 x86_64 implementation Jason A. Donenfeld
2018-09-18 16:16 ` [PATCH net-next v5 09/20] zinc: Poly1305 ARM and ARM64 implementations Jason A. Donenfeld
2018-09-18 22:55   ` Eric Biggers
2018-09-19  0:17     ` Jason A. Donenfeld
2018-09-18 16:16 ` [PATCH net-next v5 10/20] zinc: Poly1305 MIPS32r2 and MIPS64 implementations Jason A. Donenfeld
2018-09-18 16:16 ` [PATCH net-next v5 11/20] zinc: ChaCha20Poly1305 construction and selftest Jason A. Donenfeld
2018-09-18 16:16 ` [PATCH net-next v5 12/20] zinc: BLAKE2s generic C implementation " Jason A. Donenfeld
2018-09-19  0:41   ` Eric Biggers
2018-09-19  0:45     ` Jason A. Donenfeld
2018-09-18 16:16 ` [PATCH net-next v5 13/20] zinc: BLAKE2s x86_64 implementation Jason A. Donenfeld
2018-09-18 16:16 ` [PATCH net-next v5 14/20] zinc: Curve25519 generic C implementations and selftest Jason A. Donenfeld
2018-09-18 16:16 ` [PATCH net-next v5 15/20] zinc: Curve25519 x86_64 implementation Jason A. Donenfeld
2018-09-18 16:16 ` [PATCH net-next v5 16/20] zinc: Curve25519 ARM implementation Jason A. Donenfeld
2018-09-18 16:16 ` [PATCH net-next v5 17/20] crypto: port Poly1305 to Zinc Jason A. Donenfeld
2018-09-18 16:16 ` [PATCH net-next v5 18/20] crypto: port ChaCha20 " Jason A. Donenfeld
2018-09-18 16:16 ` [PATCH net-next v5 19/20] security/keys: rewrite big_key crypto to use Zinc Jason A. Donenfeld
2018-09-18 16:16 ` [PATCH net-next v5 20/20] net: WireGuard secure network tunnel Jason A. Donenfeld
2018-09-18 23:34   ` Andrew Lunn
2018-09-19  2:04     ` Jason A. Donenfeld
2018-09-19 12:38       ` Andrew Lunn
2018-09-18 17:01 ` [PATCH net-next v5 19/20] security/keys: rewrite big_key crypto to use Zinc David Howells
2018-09-18 17:12   ` Jason A. Donenfeld
2018-09-18 18:28 ` [PATCH net-next v5 00/20] WireGuard: Secure Network Tunnel Ard Biesheuvel
2018-09-18 21:01   ` Jason A. Donenfeld
2018-09-19 17:21     ` Ard Biesheuvel

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180918161646.19105-1-Jason@zx2c4.com \
    --to=jason@zx2c4.com \
    --cc=davem@davemloft.net \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-crypto@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git
	git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git
	git clone --mirror https://lore.kernel.org/lkml/8 lkml/git/8.git
	git clone --mirror https://lore.kernel.org/lkml/9 lkml/git/9.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org
	public-inbox-index lkml

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git