Re: syzkaller wireguard key situation [was: Re: [PATCH net-next v2] net: WireGuard secure network tunnel]

2020-02-20 Thread Jason A. Donenfeld
On Thu, Feb 20, 2020 at 5:45 PM Dmitry Vyukov wrote: > If it's aimed only at, say, wireguard netlink interface, then it's not > distracted by bugs in other parts. But as you add some ipv4/6 tcp/udp > sockets, more netlink to change these net namespaces, namespaces > related syscalls, packet inject

Re: syzkaller wireguard key situation [was: Re: [PATCH net-next v2] net: WireGuard secure network tunnel]

2020-02-20 Thread Dmitry Vyukov
On Thu, Feb 20, 2020 at 5:34 PM Jason A. Donenfeld wrote: > > Hi Dmitry, > > On Thu, Feb 20, 2020 at 5:14 PM Dmitry Vyukov wrote: > > I got some coverage in wg_netdevice_notification: > > https://imgur.com/a/1sJZKtp > > > > Or you mean the parts that are still red? > > Yes, it's the red parts tha

Re: syzkaller wireguard key situation [was: Re: [PATCH net-next v2] net: WireGuard secure network tunnel]

2020-02-20 Thread Jason A. Donenfeld
Hi Dmitry, On Thu, Feb 20, 2020 at 5:14 PM Dmitry Vyukov wrote: > I got some coverage in wg_netdevice_notification: > https://imgur.com/a/1sJZKtp > > Or you mean the parts that are still red? Yes, it's the red parts that interest me. Intermixing those with various wireguard-specific netlink call

Re: syzkaller wireguard key situation [was: Re: [PATCH net-next v2] net: WireGuard secure network tunnel]

2020-02-20 Thread Dmitry Vyukov
On Wed, Feb 19, 2020 at 11:23 AM Jason A. Donenfeld wrote: > > On Tue, Feb 18, 2020 at 11:00 AM Dmitry Vyukov wrote: > > I've added descriptions for wireguard packets: > > https://github.com/google/syzkaller/commit/012fbc3229ebef871a201ea431b16610e6e0d345 > > It gives all reachable coverage (with

Re: syzkaller wireguard key situation [was: Re: [PATCH net-next v2] net: WireGuard secure network tunnel]

2020-02-19 Thread Jason A. Donenfeld
On Tue, Feb 18, 2020 at 11:00 AM Dmitry Vyukov wrote: > I've added descriptions for wireguard packets: > https://github.com/google/syzkaller/commit/012fbc3229ebef871a201ea431b16610e6e0d345 > It gives all reachable coverage (without breaking crypto). Oh, great, that looks really good. It now fails

Re: syzkaller wireguard key situation [was: Re: [PATCH net-next v2] net: WireGuard secure network tunnel]

2020-02-18 Thread Dmitry Vyukov
On Mon, Feb 17, 2020 at 8:24 PM Dmitry Vyukov wrote: > > On Mon, Feb 17, 2020 at 4:42 PM Dmitry Vyukov wrote: > > > > > > > > Observation: > > > > > > > > It seems to be starting to synthesize packets sent to the wireguard > > > > socket. These aren't the proper handshake packets generated intern

Re: syzkaller wireguard key situation [was: Re: [PATCH net-next v2] net: WireGuard secure network tunnel]

2020-02-17 Thread Dmitry Vyukov
On Mon, Feb 17, 2020 at 4:42 PM Dmitry Vyukov wrote: > > > > > > Observation: > > > > > > It seems to be starting to synthesize packets sent to the wireguard > > > socket. These aren't the proper handshake packets generated internally > > > by that triangle commit, but rather ones that syzkaller c

Re: syzkaller wireguard key situation [was: Re: [PATCH net-next v2] net: WireGuard secure network tunnel]

2020-02-17 Thread Dmitry Vyukov
On Mon, Feb 17, 2020 at 4:19 PM Dmitry Vyukov wrote: > > On Mon, Feb 17, 2020 at 12:44 PM Jason A. Donenfeld wrote: > > > > Observation: > > > > It seems to be starting to synthesize packets sent to the wireguard > > socket. These aren't the proper handshake packets generated internally > > by th

Re: syzkaller wireguard key situation [was: Re: [PATCH net-next v2] net: WireGuard secure network tunnel]

2020-02-17 Thread Dmitry Vyukov
On Mon, Feb 17, 2020 at 12:44 PM Jason A. Donenfeld wrote: > > Observation: > > It seems to be starting to synthesize packets sent to the wireguard > socket. These aren't the proper handshake packets generated internally > by that triangle commit, but rather ones that syzkaller creates > itself. T

Re: syzkaller wireguard key situation [was: Re: [PATCH net-next v2] net: WireGuard secure network tunnel]

2020-02-17 Thread Jason A. Donenfeld
Observation: It seems to be starting to synthesize packets sent to the wireguard socket. These aren't the proper handshake packets generated internally by that triangle commit, but rather ones that syzkaller creates itself. That's why we have coverage on wg_receive, which otherwise wouldn't be cal

Re: syzkaller wireguard key situation [was: Re: [PATCH net-next v2] net: WireGuard secure network tunnel]

2020-02-17 Thread Jason A. Donenfeld
Hey Dmitry, Yes! Our side discussions wound up getting everything pretty squared away, and coverage on syzkaller looks pretty good to me. By inference, I think we're hitting most code paths in WireGuard. Syzkaller, though, is missing non-userspace-process coverage from: - workqueues - napi callba

Re: syzkaller wireguard key situation [was: Re: [PATCH net-next v2] net: WireGuard secure network tunnel]

2020-02-17 Thread Dmitry Vyukov
On Tue, Feb 4, 2020 at 10:39 PM Jason A. Donenfeld wrote: > > Hey Dmitry, > > I see you got wireguard's netlink stuff hooked up to syzkaller. > Excellent work, and thanks! It's already finding bugs. > > Right now it seems to know about 5 different keys you've come up with, > and not much in the wa

syzkaller wireguard key situation [was: Re: [PATCH net-next v2] net: WireGuard secure network tunnel]

2020-02-04 Thread Jason A. Donenfeld
Hey Dmitry, I see you got wireguard's netlink stuff hooked up to syzkaller. Excellent work, and thanks! It's already finding bugs. Right now it seems to know about 5 different keys you've come up with, and not much in the way of endpoints. I think we can improve this. For keys, there are a few c