• Jason A. Donenfeld's avatar
    wireguard: noise: separate receive counter from send counter · a9e90d99
    Jason A. Donenfeld authored
    In "wireguard: queueing: preserve flow hash across packet scrubbing", we
    were required to slightly increase the size of the receive replay
    counter to something still fairly small, but an increase nonetheless.
    It turns out that we can recoup some of the additional memory overhead
    by splitting up the prior union type into two distinct types. Before, we
    used the same "noise_counter" union for both sending and receiving, with
    sending just using a simple atomic64_t, while receiving used the full
    replay counter checker. This meant that most of the memory being
    allocated for the sending counter was being wasted. Since the old
    "noise_counter" type increased in size in the prior commit, now is a
    good time to split up that union type into a distinct "noise_replay_
    counter" for receiving and a boring atomic64_t for sending, each using
    neither more nor less memory than required.
    
    Also, since sometimes the replay counter is accessed without
    necessitating additional accesses to the bitmap, we can reduce cache
    misses by hoisting the always-necessary lock above the bitmap in the
    struct layout. We also change a "noise_replay_counter" stack allocation
    to kmalloc in a -DDEBUG selftest so that KASAN doesn't trigger a stack
    frame warning.
    
    All and all, removing a bit of abstraction in this commit makes the code
    simpler and smaller, in addition to the motivating memory usage
    recuperation. For example, passing around raw "noise_symmetric_key"
    structs is something that really only makes sense within noise.c, in the
    one place where the sending and receiving keys can safely be thought of
    as the same type of object; subsequent to that, it's important that we
    uniformly access these through keypair->{sending,receiving}, where their
    distinct roles are always made explicit. So this patch allows us to draw
    that distinction clearly as well.
    
    Fixes: e7096c13 ("net: WireGuard secure network tunnel")
    Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    a9e90d99
send.c 12.9 KB