WireGuard Archive on lore.kernel.org
 help / color / Atom feed
From: "Jason A. Donenfeld" <Jason@zx2c4.com>
To: "WireGuard mailing list" <wireguard@lists.zx2c4.com>
Subject: [ANNOUNCE] wireguard-linux-compat v0.0.20200318 released
Date: Wed, 18 Mar 2020 23:23:12 -0600
Message-ID: <3882ea40964a09cf@frisell.zx2c4.com> (raw)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hello,

A new version, v0.0.20200318, of the backported WireGuard kernel module for
3.10 <= Linux <= 5.5.y has been tagged in the git repository.

Please note that until Linux 5.6 is released, this snapshot is a
snapshot rather than a secure final release.

== Changes ==

  WireGuard had a brief professional security audit. The auditors didn't find
  any vulnerabilities, but they did suggest one defense-in-depth suggestion to
  protect against potential API misuse down the road, mentioned below. This
  compat snapshot corresponds with the patches I just pushed to Dave for
  5.6-rc7.
  
  * compat: RHEL 7 backported skb_ensure_writable()
  * compat: RHEL 8.2 backported ipv6_dst_lookup_flow
  
  Usual set of fixes for the RHEL kernels.
  
  * curve25519-x86_64: avoid use of r12
  
  This buys us 100 extra cycles, which isn't much, but it winds up being even
  faster on PaX kernels, which use r12 as a RAP register.
  
  * wireguard: queueing: account for skb->protocol==0
  
  This is the defense-in-depth change. We deal with skb->protocol==0 just fine,
  but the advice to deal explicitly with it seems like a good idea.
  
  * receive: remove dead code from default packet type case
  
  A default case of a particular switch statement should never be hit, so
  instead of printing a pretty debug message there, we full-on WARN(), so that
  we get bug reports.
  
  * noise: error out precomputed DH during handshake rather than config
  
  All peer keys will now be addable, even if they're low order. However, no
  handshake messages will be produced successfully. This is a more consistent
  behavior with other low order keys, where the handshake just won't complete if
  they're being used anywhere.
  
  * send: use normaler alignment formula from upstream
  
  We're trying to keep a minimal delta with upstream for the compat backport.

This release contains commits from: Jason A. Donenfeld and Luis Ressel.

As always, the source is available at https://git.zx2c4.com/wireguard-linux-compat/
and information about the project is available at https://www.wireguard.com/ .

This snapshot is available in compressed tarball form here:
  https://git.zx2c4.com/wireguard-linux-compat/snapshot/wireguard-linux-compat-0.0.20200318.tar.xz
  SHA2-256: fa74a8627f731754fbf4ea7d6ae8f571a2cfe8cd4b744a5f165065619cb836a1

A PGP signature of that file decompressed is available here:
  https://git.zx2c4.com/wireguard-linux-compat/snapshot/wireguard-linux-compat-0.0.20200318.tar.asc
  Signing key: AB9942E6D4A4CFC3412620A749FC7012A5DE03AE
  Remember to unxz the tarball before verifying the signature.

If you're a package maintainer, please bump your package version. If you're a
user, the WireGuard team welcomes any and all feedback on this latest version.

Finally, WireGuard development thrives on donations. By popular demand, we
have a webpage for this: https://www.wireguard.com/donations/

Thank you,
Jason Donenfeld


-----BEGIN PGP SIGNATURE-----

iQJEBAEBCAAuFiEEq5lC5tSkz8NBJiCnSfxwEqXeA64FAl5zAa8QHGphc29uQHp4
MmM0LmNvbQAKCRBJ/HASpd4DrrYxEACi9sfH52BtJgCjyF+dTpM4fj/JsxTdS76K
3dE7YP4ML2UW3yGDwSRryeyW2LZnv7c9y0utSnjObp69uTTA0AvN70b1qjveFURk
bvI19FtuK5S8OrzPdlU+o3OVg3T+/7+LrVnJnI65NUddMZVwgBPFQJXEsmgymlZW
ULJO0D28S0K7dZAoKD8noAwqaMEKNE0R/e+QmP4F0JvaVWxNZFN6b5lj6HcRqqq8
zwOje/OBVTJqiiXPwUJrWn6t1ecDSgzHMdmUGV3znWHdfAxbRQpgZUdsGT0CPrOZ
+uR89rNIEn4GPGBC7uoFE2WjfEUphjo949JhIlQPZ7v8lAkMEPYZh9bcmSBecp/C
joptq/+FSImLUUXwbMPixs0CfSWwfga6o2YI237QWPc4kBj/VkAG9e3FVXtyI+6A
S+3IgiVlPMl5nZYSUz2HUDpELKoDl1EBdpNBxgAZ88/AUKNURpBdENWZ7S3mkjkR
Q0bLulcWnaiSxAd5sqW1COCkytNGpdRebzAxSlPXDw9SLMGTXvuesM3WqkPIYFr7
X8O6+n1r0/7q3dVoVUiy+zTJEp4kQ69CDEGGKERlRR4VqMGwgggnJdPCbw4W1xIk
5VDvG+d1S/n1ab68Ik4L+/827K+CHHem4MVDYNMn5PTMJb1ULduzt9/Bg80h/+Jo
I1eq24NntA==
=eef/
-----END PGP SIGNATURE-----

                 reply index

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=3882ea40964a09cf@frisell.zx2c4.com \
    --to=jason@zx2c4.com \
    --cc=wireguard@lists.zx2c4.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

WireGuard Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/wireguard/0 wireguard/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 wireguard wireguard/ https://lore.kernel.org/wireguard \
		wireguard@lists.zx2c4.com
	public-inbox-index wireguard

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/com.zx2c4.lists.wireguard


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git