74ae3f3e33
This is the culmination of about a week of work from three developers to fix a number of functional and security issues. This patch consists of work done by the following folks: - Jason A. Donenfeld <Jason@zx2c4.com> - Matt Dunwoodie <ncon@noconroy.net> - Kyle Evans <kevans@FreeBSD.org> Notable changes include: - Packets are now correctly staged for processing once the handshake has completed, resulting in less packet loss in the interim. - Various race conditions have been resolved, particularly w.r.t. socket and packet lifetime (panics) - Various tests have been added to assure correct functionality and tooling conformance - Many security issues have been addressed - if_wg now maintains jail-friendly semantics: sockets are created in the interface's home vnet so that it can act as the sole network connection for a jail - if_wg no longer fails to remove peer allowed-ips of 0.0.0.0/0 - if_wg now exports via ioctl a format that is future proof and complete. It is additionally supported by the upstream wireguard-tools (which we plan to merge in to base soon) - if_wg now conforms to the WireGuard protocol and is more closely aligned with security auditing guidelines Note that the driver has been rebased away from using iflib. iflib poses a number of challenges for a cloned device trying to operate in a vnet that are non-trivial to solve and adds complexity to the implementation for little gain. The crypto implementation that was previously added to the tree was a super complex integration of what previously appeared in an old out of tree Linux module, which has been reduced to crypto.c containing simple boring reference implementations. This is part of a near-to-mid term goal to work with FreeBSD kernel crypto folks and take advantage of or improve accelerated crypto already offered elsewhere. There's additional test suite effort underway out-of-tree taking advantage of the aforementioned jail-friendly semantics to test a number of real-world topologies, based on netns.sh. Also note that this is still a work in progress; work going further will be much smaller in nature. MFC after: 1 month (maybe)
319 lines
3.6 KiB
Plaintext
319 lines
3.6 KiB
Plaintext
# $FreeBSD$
|
|
#
|
|
# Please see the file src/etc/mtree/README before making changes to this file.
|
|
#
|
|
|
|
/set type=dir uname=root gname=wheel mode=0755
|
|
.
|
|
arpa
|
|
..
|
|
atf-c
|
|
..
|
|
atf-c++
|
|
..
|
|
bsm
|
|
..
|
|
bsnmp
|
|
..
|
|
c++
|
|
v1
|
|
experimental
|
|
..
|
|
ext
|
|
..
|
|
tr1
|
|
..
|
|
..
|
|
..
|
|
cam
|
|
ata
|
|
..
|
|
mmc
|
|
..
|
|
nvme
|
|
..
|
|
scsi
|
|
..
|
|
..
|
|
casper
|
|
..
|
|
crypto
|
|
..
|
|
dev
|
|
acpica
|
|
..
|
|
agp
|
|
..
|
|
an
|
|
..
|
|
ciss
|
|
..
|
|
evdev
|
|
..
|
|
filemon
|
|
..
|
|
firewire
|
|
..
|
|
hid
|
|
..
|
|
hwpmc
|
|
..
|
|
hyperv
|
|
..
|
|
ic
|
|
..
|
|
iicbus
|
|
..
|
|
if_wg
|
|
..
|
|
io
|
|
..
|
|
mfi
|
|
..
|
|
mlx5
|
|
..
|
|
mmc
|
|
..
|
|
mpt
|
|
mpilib
|
|
..
|
|
..
|
|
nvme
|
|
..
|
|
ofw
|
|
..
|
|
pbio
|
|
..
|
|
pci
|
|
..
|
|
powermac_nvram
|
|
..
|
|
ppbus
|
|
..
|
|
pwm
|
|
..
|
|
smbus
|
|
..
|
|
speaker
|
|
..
|
|
tcp_log
|
|
..
|
|
usb
|
|
..
|
|
veriexec
|
|
..
|
|
vkbd
|
|
..
|
|
wi
|
|
..
|
|
..
|
|
devdctl
|
|
..
|
|
edit
|
|
readline
|
|
..
|
|
..
|
|
fs
|
|
cuse
|
|
..
|
|
devfs
|
|
..
|
|
fdescfs
|
|
..
|
|
msdosfs
|
|
..
|
|
nfs
|
|
..
|
|
nullfs
|
|
..
|
|
procfs
|
|
..
|
|
smbfs
|
|
..
|
|
udf
|
|
..
|
|
unionfs
|
|
..
|
|
..
|
|
gcc
|
|
4.2
|
|
..
|
|
..
|
|
geom
|
|
cache
|
|
..
|
|
concat
|
|
..
|
|
eli
|
|
..
|
|
gate
|
|
..
|
|
journal
|
|
..
|
|
label
|
|
..
|
|
mirror
|
|
..
|
|
mountver
|
|
..
|
|
multipath
|
|
..
|
|
nop
|
|
..
|
|
raid
|
|
..
|
|
raid3
|
|
..
|
|
shsec
|
|
..
|
|
stripe
|
|
..
|
|
virstor
|
|
..
|
|
..
|
|
gssapi
|
|
..
|
|
infiniband
|
|
complib
|
|
..
|
|
iba
|
|
..
|
|
opensm
|
|
..
|
|
vendor
|
|
..
|
|
..
|
|
isofs
|
|
cd9660
|
|
..
|
|
..
|
|
kadm5
|
|
..
|
|
krb5
|
|
..
|
|
lib80211
|
|
..
|
|
lib9p
|
|
..
|
|
libipt
|
|
..
|
|
libmilter
|
|
..
|
|
libxo
|
|
..
|
|
lzma
|
|
..
|
|
machine
|
|
pc
|
|
..
|
|
..
|
|
net
|
|
altq
|
|
..
|
|
route
|
|
..
|
|
..
|
|
net80211
|
|
..
|
|
netgraph
|
|
atm
|
|
..
|
|
bluetooth
|
|
include
|
|
..
|
|
..
|
|
netflow
|
|
..
|
|
..
|
|
netinet
|
|
cc
|
|
..
|
|
netdump
|
|
..
|
|
tcp_stacks
|
|
..
|
|
..
|
|
netinet6
|
|
..
|
|
netipsec
|
|
..
|
|
netnatm
|
|
api
|
|
..
|
|
msg
|
|
..
|
|
saal
|
|
..
|
|
sig
|
|
..
|
|
..
|
|
netpfil
|
|
pf
|
|
..
|
|
..
|
|
netsmb
|
|
..
|
|
nfs
|
|
..
|
|
nfsclient
|
|
..
|
|
nfsserver
|
|
..
|
|
opencsd
|
|
c_api
|
|
..
|
|
etmv3
|
|
..
|
|
etmv4
|
|
..
|
|
ptm
|
|
..
|
|
stm
|
|
..
|
|
..
|
|
openssl
|
|
..
|
|
pcap
|
|
..
|
|
protocols
|
|
..
|
|
rdma
|
|
..
|
|
rpc
|
|
..
|
|
rpcsvc
|
|
..
|
|
security
|
|
audit
|
|
..
|
|
mac_biba
|
|
..
|
|
mac_bsdextended
|
|
..
|
|
mac_lomac
|
|
..
|
|
mac_mls
|
|
..
|
|
mac_partition
|
|
..
|
|
mac_veriexec
|
|
..
|
|
..
|
|
sys
|
|
disk
|
|
..
|
|
..
|
|
teken
|
|
..
|
|
ufs
|
|
ffs
|
|
..
|
|
ufs
|
|
..
|
|
..
|
|
vm
|
|
..
|
|
xlocale
|
|
..
|
|
..
|