• Jason A. Donenfeld's avatar
    wireguard: device: clear keys on VM fork · 2d6919c3
    Jason A. Donenfeld authored
    When a virtual machine forks, it's important that WireGuard clear
    existing sessions so that different plaintexts are not transmitted using
    the same key+nonce, which can result in catastrophic cryptographic
    failure. To accomplish this, we simply hook into the newly added vmfork
    notifier.
    
    As a bonus, it turns out that, like the vmfork registration function,
    the PM registration function is stubbed out when CONFIG_PM_SLEEP is not
    set, so we can actually just remove the maze of ifdefs, which makes it
    really quite clean to support both notifiers at once.
    
    Cc: Dominik Brodowski <linux@dominikbrodowski.net>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: Theodore Ts'o <tytso@mit.edu>
    Acked-by: default avatarJakub Kicinski <kuba@kernel.org>
    Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
    2d6919c3
device.c 13.1 KB