Post #4429066

Wow: ~~~ Missing MAC validation in wg(4) packet decryption After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step succeeded. The driver thus silently accepted packets with an invalid Poly1305 authentication tag. ~~~ https://www.freebsd.org/security/advisories/FreeBSD-SA-26:52.if_wg.asc Wasn't WireGuard rewritten after the first failed attempt in FreeBSD? Looks like it was caused by result confusion: crypto_dispatch returns errors in two different ways.