fully functioning wolfcrypt shim for Wireguard

.gitignore

@@ -3,6 +3,7 @@ cscope.out
 *.d
 *.dwo
 *.ko
+*.mod
 *.mod.c
 *.a
 Module.symvers

src/Kbuild

@@ -10,7 +10,18 @@ ccflags-$(if $(WIREGUARD_VERSION),y,) += -D'WIREGUARD_VERSION="$(WIREGUARD_VERSI
 
 wireguard-y := main.o noise.o device.o peer.o timers.o queueing.o send.o receive.o socket.o peerlookup.o allowedips.o ratelimiter.o cookie.o netlink.o
 
+ifndef WOLFCRYPT
 include $(src)/crypto/Kbuild.include
+endif
 include $(src)/compat/Kbuild.include
 
 obj-$(if $(KBUILD_EXTMOD),m,$(CONFIG_WIREGUARD)) := wireguard.o
+
+ifdef WOLFCRYPT
+ifndef WOLFSSL_ROOT
+WOLFSSL_ROOT = $(src)/../../../../wolfssl
+endif
+ccflags-y += -DUSE_WOLFCRYPT -I$(shell $(CC) -print-file-name=include) -I$(WOLFSSL_ROOT) -include $(src)/wolfcrypto_shim.h
+wireguard-y += wolfcrypto_shim.o
+KBUILD_EXTRA_SYMBOLS := $(WOLFSSL_ROOT)/linuxkm/Module.symvers
+endif

src/Makefile

@@ -32,7 +32,11 @@ clean:
 	@$(MAKE) -C $(KERNELDIR) M=$(PWD) clean
 
 module-install:
+ifdef WOLFCRYPT
+	@$(MAKE) -C $(KERNELDIR) M=$(PWD) WIREGUARD_VERSION="$(WIREGUARD_VERSION)" INSTALL_MOD_DIR=wolfssl modules_install
+else
 	@$(MAKE) -C $(KERNELDIR) M=$(PWD) WIREGUARD_VERSION="$(WIREGUARD_VERSION)" modules_install
+endif
 	$(DEPMOD) -b "$(DEPMODBASEDIR)" -a $(KERNELRELEASE)
 
 install: module-install

src/compat/Kbuild.include

@@ -2,7 +2,8 @@
 #
 # Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
 
-kbuild-dir := $(if $(filter /%,$(src)),$(src),$(srctree)/$(src))
+#kbuild-dir := $(if $(filter /%,$(src)),$(src),$(srctree)/$(src))
+kbuild-dir := $(src)
 
 ccflags-y += -include $(kbuild-dir)/compat/compat.h
 asflags-y += -include $(kbuild-dir)/compat/compat-asm.h
@@ -42,7 +43,7 @@ ccflags-y += -I$(kbuild-dir)/compat/udp_tunnel/include
 wireguard-y += compat/udp_tunnel/udp_tunnel.o
 endif
 
-ifeq ($(shell grep -s -F "int crypto_memneq" "$(srctree)/include/crypto/algapi.h"),)
+ifeq ($(shell grep -s -F "int crypto_memneq" "$(srctree)/include/crypto/algapi.h" "$(srctree)/include/crypto/utils.h"),)
 ccflags-y += -include $(kbuild-dir)/compat/memneq/include.h
 wireguard-y += compat/memneq/memneq.o
 endif

src/compat/compat.h

@@ -42,9 +42,9 @@
 #error "WireGuard requires Linux >= 3.10"
 #endif
 
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0)
-#error "WireGuard has been merged into Linux >= 5.6 and therefore this compatibility module is no longer required."
-#endif
+/* #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0) */
+/* #error "WireGuard has been merged into Linux >= 5.6 and therefore this compatibility module is no longer required." */
+/* #endif */
 
 #if defined(ISRHEL7)
 #include <linux/skbuff.h>
@@ -872,7 +872,7 @@ static inline void skb_mark_not_on_list(struct sk_buff *skb)
 #endif
 #endif
 
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 5, 0)
+#if !defined(USE_WOLFCRYPT) && (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 5, 0))
 #define blake2s_init zinc_blake2s_init
 #define blake2s_init_key zinc_blake2s_init_key
 #define blake2s_update zinc_blake2s_update
@@ -1043,7 +1043,8 @@ static inline void skb_reset_redirect(struct sk_buff *skb)
 #define pre_exit exit
 #endif
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 8, 0)
+/* note, somewhere >5.4.0 and <=5.4.72, ip_tunnel_parse_protocol() was backported to the 5.4-LTS kernel. */
+#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 8, 0) && ! (LINUX_VERSION_CODE < KERNEL_VERSION(5, 5, 0) && (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 72)))
 #include <linux/skbuff.h>
 #include <linux/ip.h>
 #include <linux/ipv6.h>

src/cookie.c

@@ -10,8 +10,10 @@
 #include "ratelimiter.h"
 #include "timers.h"
 
+#ifndef WOLFCRYPTO_SHIM_H
 #include <zinc/blake2s.h>
 #include <zinc/chacha20poly1305.h>
+#endif
 
 #include <net/ipv6.h>
 #include <crypto/algapi.h>

src/crypto/Kbuild.include

@@ -45,7 +45,8 @@ kbuild-dir := $(if $(filter /%,$(src)),$(src),$(srctree)/$(src))
 targets := $(patsubst $(kbuild-dir)/%.pl,%.S,$(wildcard $(patsubst %.o,$(kbuild-dir)/crypto/zinc/%.pl,$(zinc-y) $(zinc-m) $(zinc-))))
 
 # Old kernels don't set this, which causes trouble.
-.SECONDARY:
+# breaks "make clean" on kernel 6.4 with ".NOTINTERMEDIATE and .SECONDARY are mutually exclusive."
+# .SECONDARY:
 
 wireguard-y += $(addprefix crypto/zinc/,$(zinc-y))
 ccflags-y += -I$(kbuild-dir)/crypto/include

src/device.c

@@ -11,6 +11,11 @@
 #include "peer.h"
 #include "messages.h"
 
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 12, 0)
+    /* kludge to work around broken pagemap.h, re min() and max(), due to 84429b675bcfd */
+    #define _LINUX_PAGEMAP_H
+#endif /* >= 6.12.0 */
+
 #include <linux/module.h>
 #include <linux/rtnetlink.h>
 #include <linux/inet.h>
@@ -23,6 +28,16 @@
 #include <net/rtnetlink.h>
 #include <net/ip_tunnels.h>
 #include <net/addrconf.h>
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 4, 10)) || \
+    (defined(RHEL_MAJOR) && ((RHEL_MAJOR > 9) || ((RHEL_MAJOR == 9) && (RHEL_MINOR >= 5))))
+#include <net/gso.h>
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0)
+    /* see linux 326534e837 and 8fa7292fee */
+    #define del_timer timer_delete
+    #define del_timer_sync timer_delete_sync
+#endif
 
 static LIST_HEAD(device_list);
 
@@ -219,6 +234,15 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev)
 	return ret;
 }
 
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
+static void ip_tunnel_get_stats64(struct net_device *dev,
+			   struct rtnl_link_stats64 *tot)
+{
+	netdev_stats_to_stats64(tot, &dev->stats);
+	dev_fetch_sw_netstats(tot, dev->tstats);
+}
+#endif
+
 static const struct net_device_ops netdev_ops = {
 	.ndo_open		= wg_open,
 	.ndo_stop		= wg_stop,
@@ -282,7 +306,11 @@ static void wg_setup(struct net_device *dev)
 #else
 	dev->tx_queue_len = 0;
 #endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 12, 0)
+        dev->lltx = true;
+#else
 	dev->features |= NETIF_F_LLTX;
+#endif
 	dev->features |= WG_NETDEV_FEATURES;
 	dev->hw_features |= WG_NETDEV_FEATURES;
 	dev->hw_enc_features |= WG_NETDEV_FEATURES;
@@ -300,14 +328,27 @@ static void wg_setup(struct net_device *dev)
 	wg->dev = dev;
 }
 
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0)
+static int wg_newlink(struct net_device *dev,
+                      struct rtnl_newlink_params *params,
+                      struct netlink_ext_ack *extack)
+#else
 static int wg_newlink(struct net *src_net, struct net_device *dev,
 		      struct nlattr *tb[], struct nlattr *data[],
 		      struct netlink_ext_ack *extack)
+#endif
 {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0)
+	struct net *link_net = rtnl_newlink_link_net(params);
+#endif
 	struct wg_device *wg = netdev_priv(dev);
 	int ret = -ENOMEM;
 
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0)
+	rcu_assign_pointer(wg->creating_net, link_net);
+#else
 	rcu_assign_pointer(wg->creating_net, src_net);
+#endif
 	init_rwsem(&wg->static_identity.lock);
 	mutex_init(&wg->socket_update_lock);
 	mutex_init(&wg->device_update_lock);

src/main.c

@@ -14,17 +14,19 @@
 
 #include <linux/init.h>
 #include <linux/module.h>
-#include <linux/genetlink.h>
+#include <net/genetlink.h>
 #include <net/rtnetlink.h>
 
 static int __init mod_init(void)
 {
 	int ret;
 
+#ifndef WOLFCRYPTO_SHIM_H
 	if ((ret = chacha20_mod_init()) || (ret = poly1305_mod_init()) ||
 	    (ret = chacha20poly1305_mod_init()) || (ret = blake2s_mod_init()) ||
 	    (ret = curve25519_mod_init()))
 		return ret;
+#endif
 
 #ifdef DEBUG
 	if (!wg_allowedips_selftest() || !wg_packet_counter_selftest() ||
@@ -67,3 +69,11 @@ MODULE_VERSION(WIREGUARD_VERSION);
 MODULE_ALIAS_RTNL_LINK(KBUILD_MODNAME);
 MODULE_ALIAS_GENL_FAMILY(WG_GENL_NAME);
 MODULE_INFO(intree, "Y");
+
+#if defined(WOLFCRYPTO_SHIM_H) && defined(MODULE_IMPORT_NS)
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 13, 0))
+MODULE_IMPORT_NS("WOLFSSL");
+#else
+MODULE_IMPORT_NS(WOLFSSL);
+#endif
+#endif

src/messages.h

@@ -6,9 +6,11 @@
 #ifndef _WG_MESSAGES_H
 #define _WG_MESSAGES_H
 
+#ifndef WOLFCRYPTO_SHIM_H
 #include <zinc/curve25519.h>
 #include <zinc/chacha20poly1305.h>
 #include <zinc/blake2s.h>
+#endif
 
 #include <linux/kernel.h>
 #include <linux/param.h>

src/netlink.c

@@ -198,7 +198,12 @@ static int wg_get_device_start(struct netlink_callback *cb)
 {
 	struct wg_device *wg;
 
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 6, 0)) || \
+    (defined(RHEL_MAJOR) && ((RHEL_MAJOR > 9) || ((RHEL_MAJOR == 9) && (RHEL_MINOR >= 5))))
+	wg = lookup_interface(genl_info_dump(cb)->attrs, cb->skb);
+#else
 	wg = lookup_interface(genl_dumpit_info(cb)->attrs, cb->skb);
+#endif
 	if (IS_ERR(wg))
 		return PTR_ERR(wg);
 	DUMP_CTX(cb)->wg = wg;

src/peer.c

@@ -58,8 +58,14 @@ struct wg_peer *wg_peer_create(struct wg_device *wg,
 	skb_queue_head_init(&peer->staged_packet_queue);
 	wg_noise_reset_last_sent_handshake(&peer->last_sent_handshake);
 	set_bit(NAPI_STATE_NO_BUSY_POLL, &peer->napi.state);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 1, 0)) || \
+    (defined(RHEL_MAJOR) && ((RHEL_MAJOR > 9) || ((RHEL_MAJOR == 9) && (RHEL_MINOR >= 5))))
+	netif_napi_add_weight(wg->dev, &peer->napi, wg_packet_rx_poll,
+		       NAPI_POLL_WEIGHT);
+#else
 	netif_napi_add(wg->dev, &peer->napi, wg_packet_rx_poll,
 		       NAPI_POLL_WEIGHT);
+#endif
 	napi_enable(&peer->napi);
 	list_add_tail(&peer->peer_list, &wg->peer_list);
 	INIT_LIST_HEAD(&peer->allowedips_list);

src/queueing.h

@@ -80,9 +80,17 @@ static inline void wg_reset_packet(struct sk_buff *skb, bool encapsulating)
 	u8 sw_hash = skb->sw_hash;
 
 	skb_scrub_packet(skb, true);
+
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 17, 0)) || \
+    (defined(RHEL_MAJOR) && ((RHEL_MAJOR > 9) || ((RHEL_MAJOR == 9) && (RHEL_MINOR >= 5))))
+	memset(&skb->headers, 0,
+               sizeof skb->headers);
+#else
 	memset(&skb->headers_start, 0,
 	       offsetof(struct sk_buff, headers_end) -
 		       offsetof(struct sk_buff, headers_start));
+#endif
+
 	skb->pfmemalloc = pfmemalloc;
 	if (encapsulating) {
 		skb->hash = hash;

src/receive.c

@@ -24,8 +24,14 @@ static void update_rx_stats(struct wg_peer *peer, size_t len)
 		get_cpu_ptr(peer->device->dev->tstats);
 
 	u64_stats_update_begin(&tstats->syncp);
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)) || \
+    (defined(RHEL_MAJOR) && ((RHEL_MAJOR > 9) || ((RHEL_MAJOR == 9) && (RHEL_MINOR >= 5))))
+        u64_stats_inc(&tstats->rx_packets);
+        u64_stats_add(&tstats->rx_bytes, len);
+#else
 	++tstats->rx_packets;
 	tstats->rx_bytes += len;
+#endif
 	peer->rx_bytes += len;
 	u64_stats_update_end(&tstats->syncp);
 	put_cpu_ptr(tstats);