Input Handling Robustness and Hardening - #29

Closed

aidangarske wants to merge 24 commits into

masterfrom

wolfguard-hardening

Commits on Jun 12, 2026

F-5162 F-5163 F-5165 F-5168 F-5262 F-5263 F-5457 F-5742 - Filter control bytes from untrusted names in terminal and error output
aidangarske
committed
934f6b9
F-5456 F-5897 - Reject trailing input after base64 decode in wg_from_base64
aidangarske
committed
8300ae9
F-5701 F-5839 - Zero netlink scratch buffer before free in mnlg_socket_close
aidangarske
committed
77a6371
F-5840 - Reject NUL byte in pubkey trailing-character validation
aidangarske
committed
645d80b
F-5700 - Parse IPC errno reply as bounded unsigned to avoid signed overflow
aidangarske
committed
b6ffe26
F-5161 F-5166 - Cap per-device allowed-IPs and yield during peer removal walk
aidangarske
committed
08d3710
F-5454 - Wipe ephemeral private key on handshake creation failure
aidangarske
committed
2442e97
F-5875 F-5876 - Detect ephemeral swap in consume_response and annotate keypair invalidation
aidangarske
committed
eeedaf5
F-5261 - Keep removed peer_list self-referential in wg_peer_remove_all
aidangarske
committed
1251362
F-5452 - Stop clobbering stored peer pointer on failed index lookup
aidangarske
committed
20ca774
F-5453 - Re-scan ratelimiter bucket before insert to avoid duplicate entries
aidangarske
committed
04aa885
F-5837 - Rate-limit cookie validation before make_cookie HMAC allocation
aidangarske
committed
d374f8e
F-5838 - Restrict netlink key generation commands to init-ns admin
aidangarske
committed
77e04c4
F-5164 F-5167 - Serialize bindv6only toggle and barrier encap_rcv in udp_tunnel compat
aidangarske
committed
da9fb41
F-5455 - Scrub netlink reply skb secrets on key generation error paths
aidangarske
committed
8e1e844

Navigation Menu

Uh oh!

Input Handling Robustness and Hardening - #29

Input Handling Robustness and Hardening#29
aidangarske wants to merge 24 commits into
masterfrom
wolfguard-hardening

Commits on Jun 12, 2026

F-5162 F-5163 F-5165 F-5168 F-5262 F-5263 F-5457 F-5742 - Filter control bytes from untrusted names in terminal and error output

F-5456 F-5897 - Reject trailing input after base64 decode in wg_from_base64

F-5701 F-5839 - Zero netlink scratch buffer before free in mnlg_socket_close

F-5840 - Reject NUL byte in pubkey trailing-character validation

F-5700 - Parse IPC errno reply as bounded unsigned to avoid signed overflow

F-5161 F-5166 - Cap per-device allowed-IPs and yield during peer removal walk

F-5454 - Wipe ephemeral private key on handshake creation failure

F-5875 F-5876 - Detect ephemeral swap in consume_response and annotate keypair invalidation

F-5261 - Keep removed peer_list self-referential in wg_peer_remove_all

F-5452 - Stop clobbering stored peer pointer on failed index lookup

F-5453 - Re-scan ratelimiter bucket before insert to avoid duplicate entries

F-5837 - Rate-limit cookie validation before make_cookie HMAC allocation

F-5838 - Restrict netlink key generation commands to init-ns admin

F-5164 F-5167 - Serialize bindv6only toggle and barrier encap_rcv in udp_tunnel compat

F-5455 - Scrub netlink reply skb secrets on key generation error paths

Commits on Jun 15, 2026

Add CI workflow and selftest runner

CI: point wolfguard.ko build at wolfSSL linuxkm install

CI: resolve wolfSSL headers from source root for kmod build

CI: matrix wolfSSL refs (latest-stable, v5.8.4-stable, master) for tools and kmod

CI: add sanitizers, valgrind, cppcheck, scan-build, checkpatch, codespell, CodeQL

CI: suppress cppcheck duplicateAssignExpression FP in constant-time encoding.c

CI: drop advanced CodeQL workflow in favor of repo default setup

cookie: rate-limit only cookie-verified senders to prevent spoofed-IP DoS

allowedips: enforce strict per-device node cap during prefix split