wireguard-tools, branch jd/capability-check

wg-quick: linux: check for CAP_NET_ADMIN and config file access before auto_su

2020-08-28T09:04:21Z

This way people can use wg-quick in situations where they only have CAP_NET_ADMIN but not other capabilities, and are operating on writable files. Suggested-by: Jonny Fillmore Signed-off-by: Jason A. Donenfeld

version: bump

2020-08-27T08:22:09Z

Signed-off-by: Jason A. Donenfeld

Revert "wg-quick: wait on process substitutions"

2020-08-27T08:19:31Z

This reverts commit 26683f6c9ad18d9914b23312c221f27fd5ecab51, which means the old problem comes back. That's an issue. But waiting on process substitutions is not available with commonly used bash versions: # wg-quick up demo [#] ip link add demo type wireguard [#] wg setconf demo /dev/fd/63 /usr/bin/wg-quick: line 251: wait: pid 2955 is not a child of this shell [#] ip link delete dev demo This means we have to wait a few years before fixing this issue. IOW, bash limitation; can't fix. Reported-by: Theodore Mozzo Signed-off-by: Jason A. Donenfeld

wg-quick: android: use iproute2 to bring up interface instead of ndc

2020-08-25T19:54:22Z

Android 11's ndc regresses even more, but it turns out that netd doesn't need to track up/down state via direct invocation, so just set the interface up by way of normal iproute2. Reported-by: Harsh Shandilya Signed-off-by: Jason A. Donenfeld

version: bump

2020-08-20T10:06:22Z

Signed-off-by: Jason A. Donenfeld

wg-quick: wait on process substitutions

2020-08-06T15:47:14Z

Bash does not propagate error values, which is a bummer, but process substitutions are a useful feature. Introduce a new idiom to deal with this: either "; wait $!" after the line to propagate the error, or "|| true" to indicate explicitly that we don't care about the error. Signed-off-by: Jason A. Donenfeld

ctype: use non-locale-specific ctype.h

2020-08-06T15:47:14Z

We also make these constant time, even though we're never distinguishing between bits of a secret using them. From that perspective, though, this is markedly better than the locale-specific table lookups in glibc, even though base64 characters span two cache lines and valid private keys must hit both. Co-authored-by: Samuel Neves Signed-off-by: Jason A. Donenfeld Signed-off-by: Samuel Neves

pubkey: isblank is a subset of isspace

2020-08-06T15:47:14Z

Therefore, there's no need to test both. Signed-off-by: Jason A. Donenfeld

man: wg-quick: use syncconf instead of addconf for strip example

2020-07-28T12:19:10Z

Signed-off-by: Jason A. Donenfeld

systemd: add reload target to systemd unit

2020-07-24T14:23:47Z

Users can now run `systemctl reload wg-quick@wgnet0`, as described in the wg-quick(8) man page. Note that this won't adjust Address=, DNS=, or the various other non-wg(8) fields. Signed-off-by: Domonkos P. Tomcsanyi [zx2c4: use exec for bash commands to reduce excess forks, and rewrite commit message] Signed-off-by: Jason A. Donenfeld