WireGuard Archive on lore.kernel.org
 help / color / Atom feed
From: "Jason A. Donenfeld" <Jason@zx2c4.com>
To: "WireGuard mailing list" <wireguard@lists.zx2c4.com>
Subject: [ANNOUNCE] wireguard-linux-compat v0.0.20200318 released
Date: Wed, 18 Mar 2020 23:23:12 -0600
Message-ID: <3882ea40964a09cf@frisell.zx2c4.com> (raw)

Hash: SHA256


A new version, v0.0.20200318, of the backported WireGuard kernel module for
3.10 <= Linux <= 5.5.y has been tagged in the git repository.

Please note that until Linux 5.6 is released, this snapshot is a
snapshot rather than a secure final release.

== Changes ==

  WireGuard had a brief professional security audit. The auditors didn't find
  any vulnerabilities, but they did suggest one defense-in-depth suggestion to
  protect against potential API misuse down the road, mentioned below. This
  compat snapshot corresponds with the patches I just pushed to Dave for
  * compat: RHEL 7 backported skb_ensure_writable()
  * compat: RHEL 8.2 backported ipv6_dst_lookup_flow
  Usual set of fixes for the RHEL kernels.
  * curve25519-x86_64: avoid use of r12
  This buys us 100 extra cycles, which isn't much, but it winds up being even
  faster on PaX kernels, which use r12 as a RAP register.
  * wireguard: queueing: account for skb->protocol==0
  This is the defense-in-depth change. We deal with skb->protocol==0 just fine,
  but the advice to deal explicitly with it seems like a good idea.
  * receive: remove dead code from default packet type case
  A default case of a particular switch statement should never be hit, so
  instead of printing a pretty debug message there, we full-on WARN(), so that
  we get bug reports.
  * noise: error out precomputed DH during handshake rather than config
  All peer keys will now be addable, even if they're low order. However, no
  handshake messages will be produced successfully. This is a more consistent
  behavior with other low order keys, where the handshake just won't complete if
  they're being used anywhere.
  * send: use normaler alignment formula from upstream
  We're trying to keep a minimal delta with upstream for the compat backport.

This release contains commits from: Jason A. Donenfeld and Luis Ressel.

As always, the source is available at https://git.zx2c4.com/wireguard-linux-compat/
and information about the project is available at https://www.wireguard.com/ .

This snapshot is available in compressed tarball form here:
  SHA2-256: fa74a8627f731754fbf4ea7d6ae8f571a2cfe8cd4b744a5f165065619cb836a1

A PGP signature of that file decompressed is available here:
  Signing key: AB9942E6D4A4CFC3412620A749FC7012A5DE03AE
  Remember to unxz the tarball before verifying the signature.

If you're a package maintainer, please bump your package version. If you're a
user, the WireGuard team welcomes any and all feedback on this latest version.

Finally, WireGuard development thrives on donations. By popular demand, we
have a webpage for this: https://www.wireguard.com/donations/

Thank you,
Jason Donenfeld



                 reply index

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=3882ea40964a09cf@frisell.zx2c4.com \
    --to=jason@zx2c4.com \
    --cc=wireguard@lists.zx2c4.com \


* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

WireGuard Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/wireguard/0 wireguard/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 wireguard wireguard/ https://lore.kernel.org/wireguard \
	public-inbox-index wireguard

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone https://public-inbox.org/public-inbox.git