linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH net-next v6 00/23] WireGuard: Secure Network Tunnel
@ 2018-09-25 14:55 Jason A. Donenfeld
  2018-09-25 14:56 ` [PATCH net-next v6 01/23] asm: simd context helper API Jason A. Donenfeld
                   ` (23 more replies)
  0 siblings, 24 replies; 146+ messages in thread
From: Jason A. Donenfeld @ 2018-09-25 14:55 UTC (permalink / raw)
  To: linux-kernel, netdev, linux-crypto, davem, gregkh; +Cc: Jason A. Donenfeld

Changes v5->v6, along with who suggested it.
--------------------------------------------
  - [Eric Biggers] Cleaner and more efficient blake2s_final function.
  - [Eric Biggers] Remove modulo trick that was working around a gcc 8.1 bug.
  - [Eric Biggers] Use crypto_xor_cpy to avoid a memmove in chacha20.
  - In the unlikely condition that we transition from SIMD back to scalar
    instructions for Poly1305, it's important that we also convert back
    from base 2^26 to 2^64. This is super rare and weird, and it's hard
    to imagine somebody actually doing this for whatever bad reason, but
    it is a possibility, so we shouldn't calculate things wrong in that
    instance.
  - [Andrew Lunn] Change BUG_ON to WARN_ON in choice places.
  - [Thomas Gleixner] Explicitly dual license files under X where X≠GPL2
    to be under X && GPL2.
  - [Andy Lutomirski] Use separate symbols for selftests that are of
    variable length, so that we neither waste space on disk nor waste space
    in memory (via __initconst).
  - [Thomas Gleixner] Make SPDX headers a standalone comment, and use the
    // commenting style in .h files, per the kernel style guide.
  - [Paul Burton] Allow assembler to fill branch delay slots on MIPS32r2,
    so that the implementation is more future-proof.
  - [Eric Biggers] Use Eric's scalar implementation for ChaCha20 ARM, which
    performs very well for Cortex-A7,5 and ARMv6, while using Andy
    Polyakov's NEON implementation for other ARMv7.
  - [Ard Biesheuvel] Reduce optimization from -O3 to -O2.
  - [Arn?d Bi?e(rgmann|shuvel)] Make sure stack frames stay inside 1024
    bytes on 32-bit and 1280 bytes on 64-bit.
  - [Ard Biesheuvel] CRYPTOGAMS-related commit messages now have the
    corresponding OpenSSL commit written in them.
  - [Eric Biggers] Keep HChaCha20 key in native endian, since in some
    cases it can trivially be passed into the ChaCha20 block later.
  - Make constants follow a consistent naming scheme.
  - Workaround gcc 8 stack mis-optimization on m68k.
  - [Arnd Bergmann] Workaround gcc 8 stack mis-optimization with KASAN.

Many of the above ARM changes are a result of discussions between Ard,
Eric, AndyL, AndyP, Samuel, and me. These discussions are ongoing, and so
it's possible we'll do another revision with further ARM tweaks. But perhaps
this one will be sufficient for merging now, and we can continue to refine
later in the cycle.

-----------------------------------------------------------

This patchset is available on git.kernel.org in this branch, where it may be
pulled directly for inclusion into net-next:

  * https://git.kernel.org/pub/scm/linux/kernel/git/zx2c4/linux.git/log/?h=jd/wireguard

-----------------------------------------------------------

WireGuard is a secure network tunnel written especially for Linux, which
has faced around three years of serious development, deployment, and
scrutiny. It delivers excellent performance and is extremely easy to
use and configure. It has been designed with the primary goal of being
both easy to audit by virtue of being small and highly secure from a
cryptography and systems security perspective. WireGuard is used by some
massive companies pushing enormous amounts of traffic, and likely
already today you've consumed bytes that at some point transited through
a WireGuard tunnel. Even as an out-of-tree module, WireGuard has been
integrated into various userspace tools, Linux distributions, mobile
phones, and data centers. There are ports in several languages to
several operating systems, and even commercial hardware and services
sold integrating WireGuard. It is time, therefore, for WireGuard to be
properly integrated into Linux.

Ample information, including documentation, installation instructions,
and project details, is available at:

  * https://www.wireguard.com/
  * https://www.wireguard.com/papers/wireguard.pdf

As it is currently an out-of-tree module, it lives in its own git repo
and has its own mailing list, and every commit for the module is tested
against every stable kernel since 3.10 on a variety of architectures
using an extensive test suite:

  * https://git.zx2c4.com/WireGuard
    https://git.kernel.org/pub/scm/linux/kernel/git/zx2c4/WireGuard.git/
  * https://lists.zx2c4.com/mailman/listinfo/wireguard
  * https://www.wireguard.com/build-status/

The project has been broadly discussed at conferences, and was presented
to the Netdev developers in Seoul last November, where a paper was
released detailing some interesting aspects of the project. Dave asked
me after the talk if I would consider sending in a v1 "sooner rather
than later", hence this patchset. A decision is still waiting from the
Linux Plumbers Conference, but an update on these topics may be presented
in Vancouver in a few months. Prior presentations:

  * https://www.wireguard.com/presentations/
  * https://www.wireguard.com/papers/wireguard-netdev22.pdf

The cryptography in the protocol itself has been formally verified by
several independent academic teams with positive results, and I know of
two additional efforts on their way to further corroborate those
findings. The version 1 protocol is "complete", and so the purpose of
this review is to assess the implementation of the protocol. However, it
still may be of interest to know that the thing you're reviewing uses a
protocol with various nice security properties:

  * https://www.wireguard.com/formal-verification/

This patchset is divided into four segments. The first introduces a very
simple helper for working with the FPU state for the purposes of amortizing
SIMD operations. The second segment is a small collection of cryptographic
primitives, split up into several commits by primitive and by hardware. The
third shows usage of Zinc within the existing crypto API and as a replacement
to the existing crypto API. The last is WireGuard itself, presented as an
unintrusive and self-contained virtual network driver.

It is intended that this entire patch series enter the kernel through
DaveM's net-next tree. Subsequently, WireGuard patches will go through
DaveM's net-next tree, while Zinc patches will go through Greg KH's tree.

Enjoy,
Jason

^ permalink raw reply	[flat|nested] 146+ messages in thread

end of thread, other threads:[~2018-11-13  0:13 UTC | newest]

Thread overview: 146+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-09-25 14:55 [PATCH net-next v6 00/23] WireGuard: Secure Network Tunnel Jason A. Donenfeld
2018-09-25 14:56 ` [PATCH net-next v6 01/23] asm: simd context helper API Jason A. Donenfeld
2018-09-28  8:28   ` Ard Biesheuvel
2018-09-28  8:49     ` Ard Biesheuvel
2018-09-28 13:47       ` Jason A. Donenfeld
2018-09-28 13:52         ` Ard Biesheuvel
2018-09-28 13:59           ` Jason A. Donenfeld
2018-09-28 14:00             ` Ard Biesheuvel
2018-09-28 14:01               ` Jason A. Donenfeld
2018-09-30  4:20                 ` Joe Perches
2018-09-30  5:35                   ` Andy Lutomirski
2018-10-01  1:43                     ` Jason A. Donenfeld
2018-10-02  7:18                       ` Ard Biesheuvel
2018-09-28 13:45     ` Jason A. Donenfeld
2018-09-25 14:56 ` [PATCH net-next v6 02/23] zinc: introduce minimal cryptography library Jason A. Donenfeld
2018-09-25 18:33   ` Joe Perches
2018-09-25 19:43     ` Jason A. Donenfeld
2018-09-25 20:00       ` Andy Lutomirski
2018-09-25 20:02         ` Jason A. Donenfeld
2018-09-25 20:05       ` Joe Perches
2018-09-25 20:12         ` Jason A. Donenfeld
2018-09-25 20:21           ` Joe Perches
2018-09-25 20:54             ` Jason A. Donenfeld
2018-09-25 21:02               ` Joe Perches
2018-09-25 21:03                 ` Jason A. Donenfeld
2018-09-25 14:56 ` [PATCH net-next v6 03/23] zinc: ChaCha20 generic C implementation and selftest Jason A. Donenfeld
2018-09-28 15:40   ` Ard Biesheuvel
2018-09-29  1:53     ` Jason A. Donenfeld
2018-10-02  3:15   ` Herbert Xu
2018-10-02  3:18     ` Jason A. Donenfeld
2018-09-25 14:56 ` [PATCH net-next v6 04/23] zinc: ChaCha20 x86_64 implementation Jason A. Donenfeld
2018-09-28 15:47   ` Ard Biesheuvel
2018-09-29  2:01     ` Jason A. Donenfeld
2018-09-29  7:56       ` Borislav Petkov
2018-09-29  8:00         ` Ard Biesheuvel
2018-09-29  8:11           ` Borislav Petkov
2018-09-29  8:27             ` Abel Vesa
2018-10-02  1:09         ` Jason A. Donenfeld
2018-10-02  1:07     ` Jason A. Donenfeld
2018-10-02  3:18   ` Herbert Xu
2018-10-02  3:20     ` Jason A. Donenfeld
2018-09-25 14:56 ` [PATCH net-next v6 05/23] zinc: import Andy Polyakov's ChaCha20 ARM and ARM64 implementations Jason A. Donenfeld
2018-09-28 15:49   ` Ard Biesheuvel
2018-09-28 15:51     ` Ard Biesheuvel
2018-09-28 15:57     ` Jason A. Donenfeld
2018-09-25 14:56 ` [PATCH net-next v6 06/23] zinc: port " Jason A. Donenfeld
2018-09-25 14:56 ` [PATCH net-next v6 07/23] zinc: " Jason A. Donenfeld
2018-09-26  8:59   ` Ard Biesheuvel
2018-09-26 13:32     ` Jason A. Donenfeld
2018-09-26 14:02       ` Ard Biesheuvel
2018-09-26 15:41         ` Jason A. Donenfeld
2018-09-26 16:54           ` Ard Biesheuvel
2018-09-26 17:07             ` Jason A. Donenfeld
2018-09-26 17:37           ` Eric Biggers
2018-09-26 17:46             ` Jason A. Donenfeld
2018-09-26 15:41         ` Ard Biesheuvel
2018-09-26 15:45           ` Jason A. Donenfeld
2018-09-26 15:49             ` Jason A. Donenfeld
2018-09-26 15:51               ` Ard Biesheuvel
2018-09-26 15:58                 ` Jason A. Donenfeld
2018-09-27  0:04                 ` Jason A. Donenfeld
2018-09-27 13:26                   ` Jason A. Donenfeld
2018-09-27 15:19                     ` Jason A. Donenfeld
2018-09-27 16:26                       ` Andy Lutomirski
2018-09-27 17:06                         ` Jason A. Donenfeld
2018-09-26 16:21         ` Andy Lutomirski
2018-09-26 17:03           ` Jason A. Donenfeld
2018-09-26 17:08             ` Ard Biesheuvel
2018-09-26 17:23             ` Andy Lutomirski
2018-09-26 14:36       ` Andrew Lunn
2018-09-26 15:25         ` Jason A. Donenfeld
2018-09-28 16:01   ` Ard Biesheuvel
2018-09-29  2:20     ` Jason A. Donenfeld
2018-09-29  6:16       ` Ard Biesheuvel
2018-09-30  2:33         ` Jason A. Donenfeld
2018-09-25 14:56 ` [PATCH net-next v6 08/23] zinc: ChaCha20 MIPS32r2 implementation Jason A. Donenfeld
2018-09-25 14:56 ` [PATCH net-next v6 09/23] zinc: Poly1305 generic C implementations and selftest Jason A. Donenfeld
2018-09-25 14:56 ` [PATCH net-next v6 10/23] zinc: Poly1305 x86_64 implementation Jason A. Donenfeld
2018-09-25 14:56 ` [PATCH net-next v6 11/23] zinc: import Andy Polyakov's Poly1305 ARM and ARM64 implementations Jason A. Donenfeld
2018-10-03  6:12   ` Eric Biggers
2018-10-03  7:58     ` Ard Biesheuvel
2018-10-03 14:08       ` Jason A. Donenfeld
2018-10-03 14:45         ` Jason A. Donenfeld
2018-09-25 14:56 ` [PATCH net-next v6 12/23] zinc: " Jason A. Donenfeld
2018-09-25 14:56 ` [PATCH net-next v6 13/23] zinc: Poly1305 MIPS32r2 and MIPS64 implementations Jason A. Donenfeld
2018-09-25 14:56 ` [PATCH net-next v6 14/23] zinc: ChaCha20Poly1305 construction and selftest Jason A. Donenfeld
2018-09-25 14:56 ` [PATCH net-next v6 15/23] zinc: BLAKE2s generic C implementation " Jason A. Donenfeld
2018-09-25 14:56 ` [PATCH net-next v6 16/23] zinc: BLAKE2s x86_64 implementation Jason A. Donenfeld
2018-09-25 14:56 ` [PATCH net-next v6 17/23] zinc: Curve25519 generic C implementations and selftest Jason A. Donenfeld
2018-09-25 18:38   ` Joe Perches
2018-09-25 14:56 ` [PATCH net-next v6 18/23] zinc: Curve25519 x86_64 implementation Jason A. Donenfeld
2018-09-25 14:56 ` [PATCH net-next v6 19/23] zinc: Curve25519 ARM implementation Jason A. Donenfeld
2018-10-02 16:59   ` Ard Biesheuvel
2018-10-02 21:35     ` Richard Weinberger
2018-10-03  1:03     ` Jason A. Donenfeld
2018-10-05 15:05       ` D. J. Bernstein
2018-10-05 15:16         ` Ard Biesheuvel
2018-10-05 18:40         ` Jason A. Donenfeld
2018-10-03  3:10     ` Jason A. Donenfeld
2018-09-25 14:56 ` [PATCH net-next v6 20/23] crypto: port Poly1305 to Zinc Jason A. Donenfeld
2018-09-25 14:56 ` [PATCH net-next v6 21/23] crypto: port ChaCha20 " Jason A. Donenfeld
2018-10-02  3:26   ` Herbert Xu
2018-10-02  3:31     ` Jason A. Donenfeld
2018-10-03  5:56   ` Eric Biggers
2018-10-03 14:01     ` Jason A. Donenfeld
2018-09-25 14:56 ` [PATCH net-next v6 22/23] security/keys: rewrite big_key crypto to use Zinc Jason A. Donenfeld
2018-09-25 14:56 ` [PATCH net-next v6 23/23] net: WireGuard secure network tunnel Jason A. Donenfeld
2018-09-26 16:00   ` Ivan Labáth
2018-09-26 16:04     ` Jason A. Donenfeld
2018-11-05 13:06       ` Ivan Labáth
2018-11-12 23:53         ` Jason A. Donenfeld
2018-11-13  0:10           ` Dave Taht
2018-11-13  0:13             ` Jason A. Donenfeld
2018-09-27  1:15   ` Andrew Lunn
2018-09-27 22:37     ` Jason A. Donenfeld
2018-09-28  1:09       ` Jason A. Donenfeld
2018-09-28 15:01       ` Andrew Lunn
2018-09-28 15:04         ` Jason A. Donenfeld
2018-10-03 11:15   ` Ard Biesheuvel
2018-10-03 14:12     ` Jason A. Donenfeld
2018-10-03 14:13       ` Ard Biesheuvel
2018-10-03 14:25         ` Ard Biesheuvel
2018-10-03 14:28           ` Jason A. Donenfeld
2018-09-27 18:29 ` [PATCH net-next v6 00/23] WireGuard: Secure Network Tunnel Eric Biggers
2018-09-27 21:35   ` Jason A. Donenfeld
2018-09-28  1:17     ` Eric Biggers
2018-09-28  2:35       ` Jason A. Donenfeld
2018-09-28  4:55         ` Eric Biggers
2018-09-28  5:46           ` Jason A. Donenfeld
2018-09-28  7:52             ` Ard Biesheuvel
2018-09-28 13:40               ` Jason A. Donenfeld
2018-10-02  3:39               ` Herbert Xu
2018-10-02  3:45                 ` Jason A. Donenfeld
2018-10-02  3:49                   ` Herbert Xu
2018-10-02  6:04                   ` Ard Biesheuvel
2018-10-02  6:43                     ` Richard Weinberger
2018-10-02 12:22                     ` Jason A. Donenfeld
2018-10-03  6:49                       ` Eric Biggers
2018-10-05 13:13                         ` Jason A. Donenfeld
2018-10-05 13:37                           ` Richard Weinberger
2018-10-05 13:46                             ` Jason A. Donenfeld
2018-10-05 13:53                               ` Richard Weinberger
2018-10-05 17:50                             ` David Miller
2018-09-28 17:47             ` Ard Biesheuvel
2018-09-29  2:40               ` Jason A. Donenfeld
2018-09-29  5:35                 ` Willy Tarreau

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).