aboutsummaryrefslogtreecommitdiffstatshomepage
Commit message (Collapse)AuthorAgeFilesLines
* wg-quick: linux: check for CAP_NET_ADMIN and config file access before auto_sujd/capability-checkJason A. Donenfeld2020-08-281-1/+20
| | | | | | | | | This way people can use wg-quick in situations where they only have CAP_NET_ADMIN but not other capabilities, and are operating on writable files. Suggested-by: Jonny Fillmore <jonathon.fillmore@netprotect.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* version: bumpv1.0.20200827Jason A. Donenfeld2020-08-271-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* Revert "wg-quick: wait on process substitutions"Jason A. Donenfeld2020-08-274-49/+49
| | | | | | | | | | | | | | | | | | This reverts commit 26683f6c9ad18d9914b23312c221f27fd5ecab51, which means the old problem comes back. That's an issue. But waiting on process substitutions is not available with commonly used bash versions: # wg-quick up demo [#] ip link add demo type wireguard [#] wg setconf demo /dev/fd/63 /usr/bin/wg-quick: line 251: wait: pid 2955 is not a child of this shell [#] ip link delete dev demo This means we have to wait a few years before fixing this issue. IOW, bash limitation; can't fix. Reported-by: Theodore Mozzo <theodore.mozzo@gmail.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: android: use iproute2 to bring up interface instead of ndcJason A. Donenfeld2020-08-251-1/+1
| | | | | | | | | Android 11's ndc regresses even more, but it turns out that netd doesn't need to track up/down state via direct invocation, so just set the interface up by way of normal iproute2. Reported-by: Harsh Shandilya <me@msfjarvis.dev> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* version: bumpv1.0.20200820Jason A. Donenfeld2020-08-201-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: wait on process substitutionsJason A. Donenfeld2020-08-064-49/+49
| | | | | | | | | Bash does not propagate error values, which is a bummer, but process substitutions are a useful feature. Introduce a new idiom to deal with this: either "; wait $!" after the line to propagate the error, or "|| true" to indicate explicitly that we don't care about the error. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ctype: use non-locale-specific ctype.hJason A. Donenfeld2020-08-065-14/+43
| | | | | | | | | | | | We also make these constant time, even though we're never distinguishing between bits of a secret using them. From that perspective, though, this is markedly better than the locale-specific table lookups in glibc, even though base64 characters span two cache lines and valid private keys must hit both. Co-authored-by: Samuel Neves <sneves@dei.uc.pt> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Signed-off-by: Samuel Neves <sneves@dei.uc.pt>
* pubkey: isblank is a subset of isspaceJason A. Donenfeld2020-08-061-1/+1
| | | | | | Therefore, there's no need to test both. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* man: wg-quick: use syncconf instead of addconf for strip exampleJason A. Donenfeld2020-07-281-3/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* systemd: add reload target to systemd unitDomonkos P. Tomcsanyi2020-07-241-0/+1
| | | | | | | | | | | Users can now run `systemctl reload wg-quick@wgnet0`, as described in the wg-quick(8) man page. Note that this won't adjust Address=, DNS=, or the various other non-wg(8) fields. Signed-off-by: Domonkos P. Tomcsanyi <domi@tomcsanyi.net> [zx2c4: use exec for bash commands to reduce excess forks, and rewrite commit message] Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wincompat: fold random into genkeyJason A. Donenfeld2020-05-255-16/+6
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ipc: split into separate files per-platformJason A. Donenfeld2020-05-256-1152/+1201
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* version: bumpv1.0.20200513Jason A. Donenfeld2020-05-131-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ipc: openbsd: switch to array ioctl interfaceJason A. Donenfeld2020-05-132-89/+80
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* Makefile: remember to install all systemd unitsJason A. Donenfeld2020-05-111-1/+1
| | | | | Reported-by: Unit 193 <unit193@unit193.net> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* version: bumpv1.0.20200510Jason A. Donenfeld2020-05-101-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: cleanup openbsd supportJason A. Donenfeld2020-05-102-26/+35
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: add support for openbsd kernel implementationMatt Dunwoodie2020-05-101-4/+19
| | | | Signed-off-by: Matt Dunwoodie <ncon@noconroy.net>
* ipc: cleanup openbsd supportJason A. Donenfeld2020-05-105-94/+212
| | | | | | We also add a wg_if.h in the fallback include path. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ipc: add support for openbsd kernel implementationMatt Dunwoodie2020-05-101-3/+262
| | | | Signed-off-by: Matt Dunwoodie <ncon@noconroy.net>
* ipc: remove extra spaceJason A. Donenfeld2020-05-101-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: support dns search domainsJason A. Donenfeld2020-05-098-36/+88
| | | | | | | If DNS= has an IP in it, treat it as a DNS server. If DNS= has a non-IP in it, treat it as a DNS search domain. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* systemd: add wg-quick.targetMartin Hauke2020-05-012-0/+3
| | | | | | | | Add file wg-quick.target, which allows starting and stopping all wg-quick@.service instances at once. Signed-off-by: Martin Hauke <mardnh@gmx.de> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* terminal: specialize color_mode to stdout onlyJason A. Donenfeld2020-04-202-17/+7
| | | | | | By specializing this to stdout, we can cache the isatty result. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* git: add gitattributes so tarball doesn't have gitignore filesJason A. Donenfeld2020-04-081-0/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: android: support application whitelistJason A. Donenfeld2020-04-051-25/+48
| | | | | | | | | Prior we only supported a blacklist, but actually a whitelist is an easier algorithm because that's internally how netd considers it, so we don't need to find range spans. This commit adds an IncludedApplications key. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* highlighter: insist on 256-bit keys, not 257-bit or 258-bitJason A. Donenfeld2020-04-031-1/+22
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* Makefile: simplify silent cleaningJason A. Donenfeld2020-03-231-6/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* version: bumpv1.0.20200319Jason A. Donenfeld2020-03-191-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wincompat: use new protected prefix on WindowsJason A. Donenfeld2020-03-191-2/+3
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wincompat: use string_list instead of inflatable_bufferJason A. Donenfeld2020-03-191-4/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* man: add a warning to the SaveConfig descriptionLuis Ressel2020-03-051-1/+2
| | | | | | Signed-off-by: Luis Ressel <aranea@aixah.de> [zx2c4: slightly adjusted wording] Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* man: backlink wg-quick(8) in wg(8)Jason A. Donenfeld2020-02-121-0/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* man: fix grammar in wg(8) and wg-quick(8)Kai Haberzettl2020-02-082-3/+3
| | | | | | | This fixes a few grammatical errors. Signed-off-by: Kai Haberzettl <khaberz@gmail.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* curve25519: squelch warnings on clangJason A. Donenfeld2020-02-071-15/+19
| | | | | | | These are generic helper functions we don't want to move into the actual implementations, so that it's easy to keep parity with the kernel code. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* netlink: initialize mostly unused fieldJason A. Donenfeld2020-02-061-0/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* version: bumpv1.0.20200206Jason A. Donenfeld2020-02-061-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* netlink: don't pretend that sysconf isn't a functionJason A. Donenfeld2020-02-052-4/+15
| | | | | | We can cache the value of this instead of evaluating every time. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* netlink: remove libmnl requirementJason A. Donenfeld2020-02-039-375/+792
| | | | | | | | It turns out that the binary actually gets smaller if we simply inline the very small parts of libmnl that we need. Since we wind up needing the mnlg bits anyway, there's little benefit in linking to libmnl. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* embeddable-wg-library: use newer string_listJason A. Donenfeld2020-02-032-58/+42
| | | | | | This ports 1d2d6200b8ff517db0f7530645180df3cc4afa74. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* extract-{handshakes,keys}: rework for upstream kernelJason A. Donenfeld2020-02-014-16/+6
| | | | | | | Now that WireGuard has been upstreamed and the repos split, we have to look elsewhere for these headers. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* man: document dynamic debug trick for LinuxJason A. Donenfeld2020-01-311-0/+9
| | | | | | | | This comes up occasionally, so it may be useful to mention its possibility in the man page. At least the Arch Linux and Ubuntu kernels support dynamic debugging, so this advise will at least help somebody. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: android: split uids into multiple commandsJason A. Donenfeld2020-01-311-1/+8
| | | | | | | | Different versions of netd have different limits on how many can be passed at once. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Reported-by: Alexey <zaranecc@bk.ru>
* version: bumpv1.0.20200121Jason A. Donenfeld2020-01-211-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* Makefile: sort inputs to linker so that build is reproducibleJason A. Donenfeld2020-01-211-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* netlink: make sure to clear return value when trying againJason A. Donenfeld2020-01-111-1/+2
| | | | | | | Otherwise this runs in an infinite loop if at some point a dump was interrupted. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* fuzz: add set and setconf fuzzersJason A. Donenfeld2020-01-114-2/+123
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* Makefile: evaluate git version lazilyJason A. Donenfeld2020-01-081-3/+3
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* fuzz: add generic command argument fuzzerJason A. Donenfeld2020-01-045-5/+82
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ipc: simplify inflatable buffer and add fuzzerJason A. Donenfeld2020-01-045-65/+109
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.