freebsd-dev/etc
Kyle Evans 74ae3f3e33 if_wg: import latest fixup work from the wireguard-freebsd project
This is the culmination of about a week of work from three developers to
fix a number of functional and security issues.  This patch consists of
work done by the following folks:

- Jason A. Donenfeld <Jason@zx2c4.com>
- Matt Dunwoodie <ncon@noconroy.net>
- Kyle Evans <kevans@FreeBSD.org>

Notable changes include:
- Packets are now correctly staged for processing once the handshake has
  completed, resulting in less packet loss in the interim.
- Various race conditions have been resolved, particularly w.r.t. socket
  and packet lifetime (panics)
- Various tests have been added to assure correct functionality and
  tooling conformance
- Many security issues have been addressed
- if_wg now maintains jail-friendly semantics: sockets are created in
  the interface's home vnet so that it can act as the sole network
  connection for a jail
- if_wg no longer fails to remove peer allowed-ips of 0.0.0.0/0
- if_wg now exports via ioctl a format that is future proof and
  complete.  It is additionally supported by the upstream
  wireguard-tools (which we plan to merge in to base soon)
- if_wg now conforms to the WireGuard protocol and is more closely
  aligned with security auditing guidelines

Note that the driver has been rebased away from using iflib.  iflib
poses a number of challenges for a cloned device trying to operate in a
vnet that are non-trivial to solve and adds complexity to the
implementation for little gain.

The crypto implementation that was previously added to the tree was a
super complex integration of what previously appeared in an old out of
tree Linux module, which has been reduced to crypto.c containing simple
boring reference implementations.  This is part of a near-to-mid term
goal to work with FreeBSD kernel crypto folks and take advantage of or
improve accelerated crypto already offered elsewhere.

There's additional test suite effort underway out-of-tree taking
advantage of the aforementioned jail-friendly semantics to test a number
of real-world topologies, based on netns.sh.

Also note that this is still a work in progress; work going further will
be much smaller in nature.

MFC after:	1 month (maybe)
2021-03-14 23:52:04 -05:00
..
gss
mail pkgbase: resolve mailer.conf conflict WITHOUT_SENDMAIL 2020-06-02 02:38:54 +00:00
mtree if_wg: import latest fixup work from the wireguard-freebsd project 2021-03-14 23:52:04 -05:00
root Finish moving dot.cshrc and dot.profile to bin/csh/ and bin/sh/. 2018-08-29 16:59:19 +00:00
sendmail Merge sendmail 8.16.1 to HEAD: See contrib/sendmail/RELEASE_NOTES for details 2020-07-15 18:28:54 +00:00
group Create and use a tests group for the tests user. 2020-03-27 16:05:37 +00:00
Makefile pkgbase: resolve mailer.conf conflict WITHOUT_SENDMAIL 2020-06-02 02:38:54 +00:00
Makefile.depend META MODE: Update dependencies with 'the-lot' and add missing directories. 2015-12-01 05:23:19 +00:00
master.passwd Create and use a tests group for the tests user. 2020-03-27 16:05:37 +00:00
shells etc/shells: Add a reference to the ftpd manpage 2021-02-26 14:09:19 +01:00