linux-stable.git/tools/testing/selftests/wireguard, branch linux-5.6.y

wireguard: selftests: use newer iproute2 for gcc-10

2020-06-07T11:16:47+00:00

[ Upstream commit ee3c1aa3f34b7842c1557cfe5d8c3f7b8c692de8 ]

gcc-10 switched to defaulting to -fno-common, which broke iproute2-5.4.
This was fixed in iproute-5.6, so switch to that. Because we're after a
stable testing surface, we generally don't like to bump these
unnecessarily, but in this case, being able to actually build is a basic
necessity.

Signed-off-by: Jason A. Donenfeld 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

wireguard: socket: remove errant restriction on looping to self

2020-05-14T05:59:20+00:00

[ Upstream commit b673e24aad36981f327a6570412ffa7754de8911 ]

It's already possible to create two different interfaces and loop
packets between them. This has always been possible with tunnels in the
kernel, and isn't specific to wireguard. Therefore, the networking stack
already needs to deal with that. At the very least, the packet winds up
exceeding the MTU and is discarded at that point. So, since this is
already something that happens, there's no need to forbid the not very
exceptional case of routing a packet back to the same interface; this
loop is no different than others, and we shouldn't special case it, but
rather rely on generic handling of loops in general. This also makes it
easier to do interesting things with wireguard such as onion routing.

At the same time, we add a selftest for this, ensuring that both onion
routing works and infinite routing loops do not crash the kernel. We
also add a test case for wireguard interfaces nesting packets and
sending traffic between each other, as well as the loop in this case
too. We make sure to send some throughput-heavy traffic for this use
case, to stress out any possible recursion issues with the locks around
workqueues.

Fixes: e7096c131e51 ("net: WireGuard secure network tunnel")
Signed-off-by: Jason A. Donenfeld 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

wireguard: noise: error out precomputed DH during handshake rather than config

2020-03-19T01:51:43+00:00

We precompute the static-static ECDH during configuration time, in order
to save an expensive computation later when receiving network packets.
However, not all ECDH computations yield a contributory result. Prior,
we were just not letting those peers be added to the interface. However,
this creates a strange inconsistency, since it was still possible to add
other weird points, like a valid public key plus a low-order point, and,
like points that result in zeros, a handshake would not complete. In
order to make the behavior more uniform and less surprising, simply
allow all peers to be added. Then, we'll error out later when doing the
crypto if there's an issue. This also adds more separation between the
crypto layer and the configuration layer.

Discussed-with: Mathias Hall-Andersen 
Signed-off-by: Jason A. Donenfeld 
Signed-off-by: David S. Miller

wireguard: selftests: test using new 64-bit time_t

2020-03-19T01:51:43+00:00

In case this helps expose bugs with the newer 64-bit time_t types, we do
our testing with the newer musl that supports this as well as
CONFIG_COMPAT_32BIT_TIME=n. This matters to us, since wireguard does in
fact deal with timestamps.

Signed-off-by: Jason A. Donenfeld 
Signed-off-by: David S. Miller

wireguard: selftests: remove duplicated include

2020-03-19T01:51:43+00:00

This commit removes a duplicated include.

Signed-off-by: YueHaibing 
Signed-off-by: Jason A. Donenfeld 
Signed-off-by: David S. Miller

wireguard: selftests: reduce complexity and fix make races

2020-02-17T03:21:56+00:00

This gives us fewer dependencies and shortens build time, fixes up some
hash checking race conditions, and also fixes missing directory creation
that caused issues on massively parallel builds.

Signed-off-by: Jason A. Donenfeld 
Signed-off-by: David S. Miller

wireguard: device: use icmp_ndo_send helper

2020-02-13T22:19:00+00:00

Because wireguard is calling icmp from network device context, it should
use the ndo helper so that the rate limiting applies correctly.  This
commit adds a small test to the wireguard test suite to ensure that the
new functions continue doing the right thing in the context of
wireguard. It does this by setting up a condition that will definately
evoke an icmp error message from the driver, but along a nat'd path.

Signed-off-by: Jason A. Donenfeld 
Signed-off-by: David S. Miller

wireguard: selftests: tie socket waiting to target pid

2020-02-05T13:14:18+00:00

Without this, we wind up proceeding too early sometimes when the
previous process has just used the same listening port. So, we tie the
listening socket query to the specific pid we're interested in.

Signed-off-by: Jason A. Donenfeld 
Signed-off-by: David S. Miller

wireguard: selftests: cleanup CONFIG_ENABLE_WARN_DEPRECATED

2020-02-05T13:14:18+00:00

CONFIG_ENABLE_WARN_DEPRECATED is gone since commit 771c035372a0
("deprecate the '__deprecated' attribute warnings entirely and for
good").

Signed-off-by: Krzysztof Kozlowski 
Signed-off-by: Jason A. Donenfeld 
Signed-off-by: David S. Miller

wireguard: selftests: ensure non-addition of peers with failed precomputation

2020-02-05T13:14:18+00:00

Ensure that peers with low order points are ignored, both in the case
where we already have a device private key and in the case where we do
not. This adds points that naturally give a zero output.

Signed-off-by: Jason A. Donenfeld 
Signed-off-by: David S. Miller