aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* props: Opt-in for Hardware-enforced Stack Protectionsr/cetcompatSimon Rozman2021-09-221-0/+5
| | | | | | Reference: https://techcommunity.microsoft.com/t5/windows-kernel-internals/developer-guidance-for-hardware-enforced-stack-protection/ba-p/2163340 Reference: https://techcommunity.microsoft.com/t5/windows-kernel-internals/understanding-hardware-enforced-stack-protection/ba-p/1247815 Signed-off-by: Simon Rozman <simon@rozman.si>
* driver: allow userspace to write garbageJason A. Donenfeld2021-09-161-2/+3
| | | | | | | | Not discouraging userspace from skipping checking IP packets seems like a bad thing, but they skip it anyway, so at least avoid the DoS due to API misuse. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: Replace depreciated ExAllocatePoolWithTagSimon Rozman2021-09-131-1/+1
| | | | | | | | CodeQL with Windows-Driver-Developer-Supplemental-Tools suggests the ExAllocatePoolWithTag() should no longer be used. The Static Tools Logo Test in HLK spots this in the DVL log and fails. Signed-off-by: Simon Rozman <simon@rozman.si>
* example: disable dad for faster startupJason A. Donenfeld2021-09-091-0/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* props: inverse SDVHacks logicSimon Rozman2021-08-251-2/+2
| | | | | | | SDV is allergic to code analysis. So, when we're doing SDV (SDVHacks is "true"), we need to turn the code analysis off. Signed-off-by: Simon Rozman <simon@rozman.si>
* .gitignore: ignore CodeQL outputSimon Rozman2021-08-251-0/+4
| | | | Signed-off-by: Simon Rozman <simon@rozman.si>
* props: unify import .lib of DLLsSimon Rozman2021-08-102-1/+1
| | | | | | | This moves downlevelshim.lib and those .lib from any future DLLs in this repo to the matching IntDir. Signed-off-by: Simon Rozman <simon@rozman.si>
* api: rundll32: make empty string if no instance idJason A. Donenfeld2021-08-081-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: mark as network driver rather than system driverJason A. Donenfeld2021-08-071-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* props: tie code analysis to sdv hacks rather than debug buildsJason A. Donenfeld2021-08-042-3/+3
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* version: bump0.13Jason A. Donenfeld2021-08-021-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* proj: fix header linesJason A. Donenfeld2021-08-022-2/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* api: incorporate new win7 code signing techniqueJason A. Donenfeld2021-08-027-4/+160
| | | | | | https://git.zx2c4.com/downlevel-driver-enabler/about/ Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* proj: clean up loose endsJason A. Donenfeld2021-08-022-3/+3
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* api: remove authenticode supportJason A. Donenfeld2021-08-023-103/+5
| | | | | | Certificates are no longer valid. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* props: use ForcedTargetVersion for overrideJason A. Donenfeld2021-07-302-5/+8
| | | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Signed-off-by: Simon Rozman <simon@rozman.si>
* editorconfig: farewell wixJason A. Donenfeld2021-07-301-1/+1
| | | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Signed-off-by: Simon Rozman <simon@rozman.si>
* driver: remove useless defines from resourceJason A. Donenfeld2021-07-301-3/+0
| | | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Signed-off-by: Simon Rozman <simon@rozman.si>
* api: upgradeSimon Rozman2021-07-2820-1383/+1539
| | | | Signed-off-by: Simon Rozman <simon@rozman.si>
* example: resolve signed/unsigned code analysis warningSimon Rozman2021-07-281-1/+1
| | | | Signed-off-by: Simon Rozman <simon@rozman.si>
* global: upgrade clang-formatSimon Rozman2021-07-281-24/+41
| | | | Signed-off-by: Simon Rozman <simon@rozman.si>
* vs: move shared configuration to wintun.props and upgradeSimon Rozman2021-07-2818-391/+229
| | | | | | | Remember to rename wintun.vcxproj.user file in your local working folder to wintun.props.user manually. Signed-off-by: Simon Rozman <simon@rozman.si>
* driver: workaround SDV failure with code analysisSimon Rozman2021-07-272-7/+9
| | | | | | | | | | | | | | SDV is using own CL.EXE which returns error code 2 when code analysis is turned on. However, we need code analysis results for DVL. While we could use a new "ReleaseSDV" configuration, we don't really require limited code analysis in Release builds, as long as we address all full code analysis warnings in Debug builds. To make DVL happier, an intermediate Release build was injected with code analysis turned on. Signed-off-by: Simon Rozman <simon@rozman.si>
* api: build with WDKJason A. Donenfeld2021-07-239-4/+33
| | | | | | | Makes builds more reproducable, as we can do our next release using the EWDK, an all-in-one ISO of build tools from Microsoft. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* api: remove unused pch fileJason A. Donenfeld2021-07-131-6/+0
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: switch to MS-recommended memory allocSimon Rozman2021-07-132-3/+5
| | | | | Suggested-by: Static Driver Verifier Signed-off-by: Simon Rozman <simon@rozman.si>
* driver: cleanup project fileSimon Rozman2021-07-121-155/+132
| | | | Signed-off-by: Simon Rozman <simon@rozman.si>
* driver: remove excessive media connection reporting on adapter initSimon Rozman2021-07-121-4/+1
| | | | | | | | The initial adapter state (including media connection) is provided by the NDIS_MINIPORT_ADAPTER_GENERAL_ATTRIBUTES. Additional NdisMIndicateStatusEx() call seems excessive. Signed-off-by: Simon Rozman <simon@rozman.si>
* api: use SuggestedInstanceId instead of NetSetupAnticipatedInstanceIdJason A. Donenfeld2021-07-097-466/+158
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | All was well with NetSetupAnticipatedInstanceId, until a bug crept into recent Windows builds that caused old GUIDs not to be properly removed, resulting in subsequent adapter creations to fail, because NetSetup AnticipatedInstanceId considers it fatal when the target GUID already exists, even if in diminished form. The initial solution was to detect cruft, and then steal a TrustedInstaller token and sleuth around the registry cleaning things up. The horror! Uncomfortable with this, I reopened IDA and had a look around with fresh eyes, three years after the original discovery of NetSetupAnticipated InstanceId. There, I found some interesting behavior in NetSetupSvcDeviceManager::InstallNetworkInterfaces, which amounts to something like: if (IsSet("RetiredNetCfgInstanceId") { if (IsSet("NetSetupAnticipatedInstanceId") DeleteAdapter(GetValue("RetiredNetCfgInstanceId")); else Set("NetSetupAnticipatedInstanceId", GetValue("RetiredNetCfgInstanceId")); Delete("RetiredNetCfgInstanceId"); } CreateAdapter = TRUE; if (IsSet("NetSetupAnticipatedInstanceId")) { Guid = GetValue("NetSetupAnticipatedInstanceId"); if (AdapterAlreadyExists(Guid)) CreateAdapter = FALSE; else SetGuidOfNewAdapter(Guid); Delete("NetSetupAnticipatedInstanceId"); } else if (IsSet("SuggestedInstanceId")) { Guid = GetValue("SuggestedInstanceId"); if (!AdapterAlreadyExists(Guid)) SetGuidOfNewAdapter(Guid); Delete("SuggestedInstanceId"); } Thus, one appealing strategy would be to set both NetSetupAnticipated InstanceId and RetiredInstanceId to the same value, and let the service handle deleting the old one for us before creating the new one. However, the cleanup of the old adapter winds up being quasi- asynchronous, and thus we still wind up in the CreateAdapter = FALSE case. So, the remaining strategy is to simply use SuggestedInstanceId instead. This has the behavior that if there's an adapter already in use, it'll use a new random GUID. The result is that adapter creation won't fail. That's not great, but the docs have always made it clear that "requested" is a best-effort sort of thing. Plus, hopefully the creation of the new adapter will help nudge the bug a bit and cleanup the old cruft. In some ways, transitioning from our old strategy of "cudgel the registry until we get the GUID we want" to "ask politely and accept no for an answer" is a disappointing regression in functionality. But it also means we don't need to keep crazy token stealing code around, or fish around in the registry dangerously. This probably also increases the likelihood that an adapter will be created during edge cases, which means fewer errors for users, which could be a good thing. On the downside, we have the perpetual tensions caused by a system that now "fails open" instead of "fails closed". But so it goes in Windows land. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* api: log instance id when object file name is emptyJason A. Donenfeld2021-07-081-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* api: print correct last error when failingJason A. Donenfeld2021-07-081-1/+1
| | | | | | | Prior to the conversion, LastError is ERROR_SUCCESS, so move the logging to be after the conversion. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* version: bump0.12Jason A. Donenfeld2021-06-251-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* api: don't auto-elevateJason A. Donenfeld2021-06-258-161/+69
| | | | | | | There's no longer a need to do this for every API call. This only exists now for the pnp guid reuse workaround hack. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: hard code security descriptor bytesJason A. Donenfeld2021-06-251-18/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is compatible with old Windows. Generated by: #include <stdio.h> #include <windows.h> #include <sddl.h> int main(int argc, char *argv[]) { PSECURITY_DESCRIPTOR sd; ULONG sd_len; if (!ConvertStringSecurityDescriptorToSecurityDescriptorA("O:SYD:P(A;;FA;;;SY)(A;;FA;;;BA)S:(ML;;NWNRNX;;;HI)", SDDL_REVISION_1, &sd, &sd_len)) return 1; for (ULONG i = 0; i < sd_len; ++i) printf("0x%02x%s%s", ((unsigned char *)sd)[i], i == sd_len - 1 ? "" : ",", i == sd_len -1 || i % 8 == 7 ? "\n": " "); return 0; } This can be easily checked from kernel space with this ugly snippet: UNICODE_STRING Func; RtlInitUnicodeString(&Func, L"SeConvertSecurityDescriptorToStringSecurityDescriptor"); WCHAR *Str = NULL; ((NTSTATUS(NTAPI *)(PSECURITY_DESCRIPTOR, DWORD, DWORD, WCHAR **, DWORD *))MmGetSystemRoutineAddress(&Func))( TunDispatchSecurityDescriptor, 1, 0x14, &Str, NULL); DbgPrint("Did it work? %ls\n", Str); Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: build security descriptor from sddlJason A. Donenfeld2021-06-253-100/+10
| | | | | | This is a bit easier to read. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: allow admins but require high integrity labelJason A. Donenfeld2021-06-253-8/+70
| | | | | | Might be more reasonable. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: specify pnplockdown in infJason A. Donenfeld2021-06-251-0/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: formatJason A. Donenfeld2021-06-251-5/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* api: only mark GUID as in-use if Status != NotPresentJason A. Donenfeld2021-05-111-13/+16
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* version: bump0.11Jason A. Donenfeld2021-05-101-2/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: do not assume aligned addresses when allocating MDLsJason A. Donenfeld2021-05-101-2/+4
| | | | | | | | | | | IoAllocateMdl allocates a different size structure depending on the bottom in-page bits of the address. By passing null, it assumes that the address is aligned within the page, which it might not be. Fix this by passing the eventual virtual address to the allocation function so that the right amount is always allocated. Reported-by: Oleksandr Muzychuk <oleksandr.muzychuk@apriorit.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* driver: move init-only functions into INIT segmentSimon Rozman2021-05-101-0/+9
| | | | | Reference: https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/writing-a-driverentry-routine Signed-off-by: Simon Rozman <simon@rozman.si>
* driver: fix memory leak on pre-Windows 7Simon Rozman2021-05-101-3/+2
| | | | | | | Should NDIS version check fail the DriverEntry() bailed out without releasing the TunDispatchSecurityDescriptor. Signed-off-by: Simon Rozman <simon@rozman.si>
* driver: cleanup unused DBG defineSimon Rozman2021-05-101-6/+0
| | | | Signed-off-by: Simon Rozman <simon@rozman.si>
* version: bump0.10.5Jason A. Donenfeld2021-05-101-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* api: use simpler problem status checkingJason A. Donenfeld2021-05-101-12/+13
| | | | | | | | This reworks commit e51b49604b5d00a641b698e7c40d4d46a06644c9. Link: https://www.reddit.com/r/WireGuard/comments/n6yocf/unable_to_create_wintun_on_windows_7_laptop_with/ Reported-by: Alirz Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* api: check that GUID is valid before assuming it's in useJason A. Donenfeld2021-05-101-2/+7
| | | | | | | | | ROOT/NET/000X could have been claimed by a different driver, so we want to double check. Link: https://lists.zx2c4.com/pipermail/wireguard/2021-May/006716.html Reported-by: Piotr Sobczak <piotrs@glosol.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* api: discourage UaF on teardownJason A. Donenfeld2021-05-101-1/+0
| | | | | | | | | | | | | | | | | | | | | | While it does make sense to make readers unblock by setting the read event on teardown, this is something that consumers of the library should do _before_ calling EndSession, not something that makes sense for the library to do itself. The reason is that, in the hypothetical case in which this makes sense, immediately after unblocking the reader via SetEvent, the function goes on to free all of the memory that that reader might want to use. So, rather, the proper shutdown flow is from the application side, and looks like: Closing = true; SetEvent(WintunGetReadWaitEvent()); WaitForReadersToReturn(); WintunEndSession(); Alternatively, rather than using WaitForSingleObject on the read event, consumers can WaitForMultipleObjects and include a shutdown event, which is what the example code does. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* version: bump0.10.4Jason A. Donenfeld2021-05-051-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* api: skip requested GUID if !win10Jason A. Donenfeld2021-05-051-5/+12
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.