wintun/api, branch 0.13Layer 3 TUN Driver for Windowshttps://git.zx2c4.com/wintun/atom/api?h=0.132021-08-02T02:49:13Zapi: incorporate new win7 code signing technique2021-08-02T02:49:13ZJason A. DonenfeldJason@zx2c4.com2021-08-01T23:05:02Zurn:sha1:21d8e66e04fedf66aef7188f22b32c3b126e8911
https://git.zx2c4.com/downlevel-driver-enabler/about/
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
proj: clean up loose ends2021-08-01T23:04:35ZJason A. DonenfeldJason@zx2c4.com2021-08-01T23:04:35Zurn:sha1:8967516baff344255b6cf9dcb7b8d903c402a19e
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
api: remove authenticode support2021-08-01T22:24:10ZJason A. DonenfeldJason@zx2c4.com2021-08-01T22:24:10Zurn:sha1:acc9ee7f3450132e15442f871d4b864d7cadc973
Certificates are no longer valid.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
api: upgrade2021-07-28T18:25:27ZSimon Rozmansimon@rozman.si2021-07-28T18:20:09Zurn:sha1:d675646ab8df227ba39c9d0160d0ba77e8f85479
Signed-off-by: Simon Rozman <simon@rozman.si>
vs: move shared configuration to wintun.props and upgrade2021-07-28T18:22:18ZSimon Rozmansimon@rozman.si2021-07-28T11:50:40Zurn:sha1:7dffa4be72c77bd7322039ffdc558a842abba8af
Remember to rename wintun.vcxproj.user file in your local working folder
to wintun.props.user manually.
Signed-off-by: Simon Rozman <simon@rozman.si>
api: build with WDK2021-07-23T18:20:43ZJason A. DonenfeldJason@zx2c4.com2021-07-23T16:19:00Zurn:sha1:899e085a913fe114c72929a91338629128f517a2
Makes builds more reproducable, as we can do our next release using the
EWDK, an all-in-one ISO of build tools from Microsoft.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
api: remove unused pch file2021-07-13T13:48:45ZJason A. DonenfeldJason@zx2c4.com2021-07-13T13:48:45Zurn:sha1:af83574b344fba9657b78040acb2b32c240b7082
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
api: use SuggestedInstanceId instead of NetSetupAnticipatedInstanceId2021-07-09T15:08:28ZJason A. DonenfeldJason@zx2c4.com2021-07-08T14:59:43Zurn:sha1:005af4a9c788dab2646fa115cda3cbe0c51089bd
All was well with NetSetupAnticipatedInstanceId, until a bug crept into
recent Windows builds that caused old GUIDs not to be properly removed,
resulting in subsequent adapter creations to fail, because NetSetup
AnticipatedInstanceId considers it fatal when the target GUID
already exists, even if in diminished form.
The initial solution was to detect cruft, and then steal a
TrustedInstaller token and sleuth around the registry cleaning things
up. The horror!
Uncomfortable with this, I reopened IDA and had a look around with fresh
eyes, three years after the original discovery of NetSetupAnticipated
InstanceId. There, I found some interesting behavior in
NetSetupSvcDeviceManager::InstallNetworkInterfaces, which amounts to
something like:
if (IsSet("RetiredNetCfgInstanceId") {
if (IsSet("NetSetupAnticipatedInstanceId")
DeleteAdapter(GetValue("RetiredNetCfgInstanceId"));
else
Set("NetSetupAnticipatedInstanceId", GetValue("RetiredNetCfgInstanceId"));
Delete("RetiredNetCfgInstanceId");
}
CreateAdapter = TRUE;
if (IsSet("NetSetupAnticipatedInstanceId")) {
Guid = GetValue("NetSetupAnticipatedInstanceId");
if (AdapterAlreadyExists(Guid))
CreateAdapter = FALSE;
else
SetGuidOfNewAdapter(Guid);
Delete("NetSetupAnticipatedInstanceId");
} else if (IsSet("SuggestedInstanceId")) {
Guid = GetValue("SuggestedInstanceId");
if (!AdapterAlreadyExists(Guid))
SetGuidOfNewAdapter(Guid);
Delete("SuggestedInstanceId");
}
Thus, one appealing strategy would be to set both NetSetupAnticipated
InstanceId and RetiredInstanceId to the same value, and let the service
handle deleting the old one for us before creating the new one.
However, the cleanup of the old adapter winds up being quasi-
asynchronous, and thus we still wind up in the CreateAdapter = FALSE
case.
So, the remaining strategy is to simply use SuggestedInstanceId instead.
This has the behavior that if there's an adapter already in use, it'll
use a new random GUID. The result is that adapter creation won't fail.
That's not great, but the docs have always made it clear that
"requested" is a best-effort sort of thing. Plus, hopefully the creation
of the new adapter will help nudge the bug a bit and cleanup the old
cruft. In some ways, transitioning from our old strategy of "cudgel the
registry until we get the GUID we want" to "ask politely and accept no
for an answer" is a disappointing regression in functionality. But it
also means we don't need to keep crazy token stealing code around, or
fish around in the registry dangerously. This probably also increases
the likelihood that an adapter will be created during edge cases, which
means fewer errors for users, which could be a good thing. On the
downside, we have the perpetual tensions caused by a system that now
"fails open" instead of "fails closed". But so it goes in Windows land.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
api: log instance id when object file name is empty2021-07-08T01:13:14ZJason A. DonenfeldJason@zx2c4.com2021-07-08T01:13:14Zurn:sha1:cf6e441ff5ad87670ba97aa8d5cbcd9a7cfaa68b
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
api: print correct last error when failing2021-07-08T00:50:57ZJason A. DonenfeldJason@zx2c4.com2021-07-08T00:50:06Zurn:sha1:bf5b170101b287082637ef729feee983f8cda36a
Prior to the conversion, LastError is ERROR_SUCCESS, so move the logging
to be after the conversion.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>