aboutsummaryrefslogtreecommitdiffstatshomepage
Commit message (Collapse)AuthorAgeFilesLines
* ipc: linux: enforce IFNAMSIZ limitHEADmasterJason A. Donenfeld2023-08-041-0/+6
| | | | | | | libmnl doesn't check lengths, so do our own checking before copying the interface name to the netlink buffer. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* man: set private key in PreUp rather than PostUpJason A. Donenfeld2023-05-181-1/+1
| | | | | | | This is probably more sensible, since there's no point in letting traffic flow before the interface is configured. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: run PreUp hook after creating interfaceDaniel Gröber2023-05-184-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently PreUp hooks run before the interface is created. This is problematic for moving the device into a Linux VRFs as this will currently clear all assigned IPv6 addressess (possibly a bug), so if we did this in PostUp (i.e. before add_addr) we'll have to manually re-add all assigned addresses. This is obviously less than ideal. Instead create the wg device just before running PreUp hooks. We apply this to all platforms for consistency. Test case: $ ip link add vrf-test type vrf table 1234 $ ip link add wg-test type wireguard $ ip addr add dev wg-test 192.168.42.42/24 $ ip addr add dev wg-test fe80::/64 $ ip -br addr show wg-test wg-test DOWN 192.168.42.42/24 fe80::/64 $ ip link set dev wg-test master vrf-test $ ip -br addr show wg-test wg-test DOWN 192.168.42.42/32 Signed-off-by: Daniel Gröber <dxld@darkboxed.org> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* show: fix show all endpoints outputDmitry Selivanov2023-02-081-2/+2
| | | | | | | | Currently "wg show all endpoints" prints interface name only once while other "show all" commands print it on each line as man says. Signed-off-by: Dmitry Selivanov <dseliv@gmail.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ipc: freebsd: NULL out some freed memory in kernel_set_device()Kyle Evans2022-11-031-0/+3
| | | | | | | | | | | The `err` path in kernel_set_device() will attempt to free() allocated nvl_peers, but these two cases meant we could end up attempting a use after free or a double free, as we rely on nvlist_destroy(NULL) being a NOP as well as free(NULL). FreeBSD-Coverity: 1500421 Signed-off-by: Kyle Evans <kevans@FreeBSD.org> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ipc: freebsd: avoid leaking memory in kernel_get_device()Kyle Evans2022-11-031-6/+13
| | | | | | | | | | | | Primarily, front-load validation of an allowed-ip entry to before we allocate `aip`, so that we don't need to free() it if we end up skipping this entry. Assert that `aip` is NULL after we exit the loop, as we should have transfered ownership to the `peer` or freed it in all paths through the allowed-ip loop. FreeBSD-Coverity: 1500405 Signed-off-by: Kyle Evans <kevans@FreeBSD.org> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* show: apply const to right part of pointerJason A. Donenfeld2022-10-311-1/+1
| | | | | | | | | | | | Without this -Wcast-qual complains: show.c:30:43: warning: cast from 'const void *' to 'const void **' drops const qualifier [-Wcast-qual] const struct wgpeer *a = *(const void **)first, *b = *(const void **)second; ^ show.c:30:71: warning: cast from 'const void *' to 'const void **' drops const qualifier [-Wcast-qual] const struct wgpeer *a = *(const void **)first, *b = *(const void **)second; Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ipc: freebsd: move if_wg path to reflect new in-tree locationKyle Evans2022-10-292-1/+1
| | | | | | | | | | | When we re-added if_wg to the tree, we changed directories in dev to strip the if_ (we don't use this prefix for other interfaces' directories). Adjust it here as a convenience, so that when we import wireguard-tools to FreeBSD the path will just work as-is with our usual build. Signed-off-by: Kyle Evans <kevans@FreeBSD.org> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: linux: prevent traffic from momentarily leaking into tunnelTom Yan2022-06-171-1/+1
| | | | | | | | | | The wireguard route table ip rule should stay as a no-op until the `suppress_prefixlength 0 table main` rule is in effect. Therefore, add the wireguard default route to its route table after the latter rule is added. Signed-off-by: Tom Yan <tom.ty89@gmail.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: dual license core files as MIT for FreeBSDJason A. Donenfeld2022-06-1020-20/+20
| | | | | | | To make it easier for FreeBSD to import wg(8), dual license the core files as MIT, so that they don't have any trouble. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: android: use right regex for host-vs-IPJason A. Donenfeld2022-05-101-1/+1
| | | | | | | Looks like the "is valid ifname" regex was copy and pasted from wg-quick.bash instead of the "is valid IP" regex. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* reresolve-dns: use $EPOCHSECONDS instead of $(date +%s)Jason A. Donenfeld2022-01-041-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* embeddable-wg-library: add named wg_endpoint unionMikael Magnusson2021-10-221-5/+7
| | | | | | | | Define wg_endpoint as a named union to allow users of the emeddable library to use the type in function arguments, variables etc. Signed-off-by: Mikael Magnusson <mikma@users.sourceforge.net> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ipc: use more clever PnP enumeratorJason A. Donenfeld2021-10-063-60/+16
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* version: bumpv1.0.20210914Jason A. Donenfeld2021-09-141-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: openbsd: set DNS with resolvd(8)Matt Dunwoodie2021-09-141-4/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenBSD has introduced a new daemon named resolvd(8) to manage resolv.conf. This creates problems with the old "horrible way" of completely replacing resolv.conf. Resolvd will attempt to merge manual changes with DNS servers discovered through dhcpleased(8) and slaacd(8). Unfortunately, resolvd puts any manual modifications at the end of resolv.conf, meaning that the wg-quick name servers will be queried last. The process for handling multiple name servers (at least with libc) is to try a name server, and if the query times out, try the next, until out of name servers, then repeat trying all name servers until a maximum number of retries are performed. The name servers are queried in the order listed in resolv.conf and the timeout is 5 seconds. With this patch, we ensure the wg-quick name server is first in resolv.conf (as route creates the name server with "static" priority), but cannot ensure it is exclusive. Therfore, it may be possible that queries are leaked to other name servers if the wg-quick name server doesn't respond within 5 seconds. We have another problem however, and that is if resolvd detects unwind is running, it will set 127.0.0.1 as the only name server in resolv.conf. unwind does not have deterministic name server selection in the default configuration. This means, all a user would need to do to inadvertently cause persistent query leaks would be to run `rcctl enable unwind`. There are warnings added when these situations may occur. The next step is to add an exclusive flag and search to route and resolvd. Reported-by: Matthieu Herrb <matthieu@herrb.eu> Signed-off-by: Matt Dunwoodie <ncon@noconroy.net> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: android: adjust for android 12Jason A. Donenfeld2021-09-091-2/+8
| | | | | | | https://android-review.googlesource.com/c/platform/system/netd/+/1671532 Reported-by: engstk <eng.stk@sapo.pt> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: darwin: account for "link#XX" gatewaysLaura Hausmann2021-08-121-2/+2
| | | | | | | | On macOS, under specific configurations, the `netstat -nr -f inet` and `netstat -nr -f inet6` outputs break gateway collection. Signed-off-by: Laura Hausmann <laura@hausmann.dev> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ipc: windows: use devpkey instead of nci for nameJason A. Donenfeld2021-07-314-120/+41
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ipc: windows: don't display disabled adaptersJason A. Donenfeld2021-07-201-1/+4
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ipc: remove windows elevationJason A. Donenfeld2021-07-202-150/+36
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ipc: cache windows lookups to avoid O(n^2) with nested lookupsJason A. Donenfeld2021-07-203-4/+136
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ipc: add wireguard-nt supportJason A. Donenfeld2021-07-2010-9/+711
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* contrib/launchd: fix xml syntax errorHangbin Liu2021-05-171-1/+1
| | | | | | | | | | | | | The current plist xml gets error "DOCTYPE improperly terminated" with xml syntax checker[1]. The example in apple doc[2] also doesn't have semicolon at the end of DOCTYPE line. [1] https://www.w3schools.com/xml/xml_validator.asp [2] https://opensource.apple.com/source/launchd/launchd-257/launchd/doc/HOWTO.html Fixes: b30e74b5956a ("wg-quick: darwin: support being called from launchd") Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* man: mention BSD debuggingJason A. Donenfeld2021-05-061-0/+7
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* version: bumpv1.0.20210424Jason A. Donenfeld2021-04-241-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: kill route monitor when loop terminatesJason A. Donenfeld2021-04-203-10/+16
| | | | | | | | | | If the route monitor doesn't attempt to write more to stdout, then this leaves a process hanging around. Kill it explicitly. We also switch to using exec in the process substitution, to reduce a bash process. Closes: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=255286 Reported-by: Christos Chatzaras <chris@cretaforce.gr> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: freebsd: use ifconfig for determining if interface is upJason A. Donenfeld2021-04-181-16/+2
| | | | | | | | | We no longer need the arp hack, as these bugs have been fixed in the FreeBSD kernel. This partially reverts 090639ae90fb45ac05e3158e1e31e5bf15fd9559. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: freebsd: do not assume point-to-point interface flagJason A. Donenfeld2021-03-231-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: freebsd: check for socket using -S, not -fJason A. Donenfeld2021-03-211-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* version: bumpv1.0.20210315Jason A. Donenfeld2021-03-151-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: freebsd: avoid writing private keys to /tmpJason A. Donenfeld2021-03-131-1/+1
| | | | | | | | FreeBSD's bash doesn't handle <(...) safely, creating a temporary file instead of using /proc/self/fd/N like on Linux. Work around this by using a simple pipeline with /dev/stdin. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ipc: uniformly ignore preshared keys that are zeroJason A. Donenfeld2021-03-112-2/+4
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ipc: freebsd: add initial FreeBSD supportJason A. Donenfeld2021-03-114-0/+370
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: freebsd: add kernel supportJason A. Donenfeld2021-03-111-3/+17
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wireguard-tools: drag in headers for prototypesKyle Evans2021-03-102-0/+2
| | | | | | | ipc.c and terminal.c provide definitions for prototypes in their respective headers, drag those in. Signed-off-by: Kyle Evans <kevans@FreeBSD.org>
* wireguard-tools: const correctnessKyle Evans2021-03-1010-19/+19
| | | | | | Fixes much of the noise from a FreeBSD WARNS=6 build of wg(8) Signed-off-by: Kyle Evans <kevans@FreeBSD.org>
* Makefile: fix version indicatorFlorian Eckert2021-03-051-1/+1
| | | | | | | | | | | | | | If we execute `wg --version` we get a different version string that does not match with the version string in the openwrt makefile. Current version string: `wireguard-tools vreboot-13159-gac5caa2718 -https://git.zx2c4.com/wireguard-tools/` Corrected versions string: `wireguard-tools v1.0.20200319 -https://git.zx2c4.com/wireguard-tools/` Signed-off-by: Florian Eckert <fe@dev.tdt.de> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* version: bumpv1.0.20210223Jason A. Donenfeld2021-02-231-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ipc: read trailing responses after set operationJason A. Donenfeld2021-01-271-5/+28
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* man: LOG_LEVEL variables changed naeJason A. Donenfeld2021-01-261-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ipc: do not use fscanf with trailing \nJason A. Donenfeld2021-01-251-1/+3
| | | | | | | If the stream is not closed, then this winds up hanging forever. So remove the trailing \n\n and check manually after. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* sticky-sockets: do not use SO_REUSEADDRJason A. Donenfeld2020-12-181-8/+0
| | | | | | This makes little sense for unicast UDP sockets. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* completion: add help and syncconf completionsJason A. Donenfeld2020-12-131-3/+3
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wincompat: do not elevate by defaultJason A. Donenfeld2020-12-111-1/+1
| | | | | | | Elevation makes it detach from the console, which means the results are hidden. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wincompat: add resource and manifest and enable ltoJason A. Donenfeld2020-12-113-3/+70
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wincompat: recent mingw has inet_ntop/inet_ptonJason A. Donenfeld2020-11-092-38/+0
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* embeddable-wg-library: sync latest from netlink.hJason A. Donenfeld2020-10-291-32/+35
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: openbsd: no use for userspace supportJason A. Donenfeld2020-10-191-41/+23
| | | | | | | | | | | With alignment between the kernel and userspace, along with userspace packages, we can now rely on the kernel in the future always having wg(4). This also simplifies the interface selection logic, and stores the wg-quick interface name as the description. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: android: do not free iterated pointerJason A. Donenfeld2020-09-151-7/+8
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.