aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/src/wg-quick (follow)
Commit message (Collapse)AuthorAgeFilesLines
* wg-quick: use addconf instead of setconfHEADmasterJason A. Donenfeld2025-06-195-5/+5
| | | | | | | | | | | | | | | The example in the man page at some point changed: - \fBPostUp = wg set %i private-key <(pass WireGuard/private-keys/%i)\fP + \fBPreUp = wg set %i private-key <(pass WireGuard/private-keys/%i)\fP This is actually wrong because PreUp is followed by set_config(), which calls `wg setconf`, which in turn deletes the private key from the interface because it is missing from the configuration. Replacing this with `wg addconf` is safe to do because the interface is newly created. Suggested-by: Matthias Dressel <code@deadcode.eu> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: linux: deal with resolvconf migration more gracefullyJason A. Donenfeld2025-05-231-1/+1
| | | | | | | | | | | | When Ubuntu systems upgrade from Debian's atrocious resolvconf to the systemd-resolve symlink, they sometimes leave around /etc/resolvconf/interface-order, which then winds up breaking the detection and passing the bogus 'tun.' prefix to systemd's resolvconf, resulting in failure. Work around this by only doing the 'tun.' prefix hack if resolvconf isn't a symlink. This is ugly but so it goes. Reported-by: Andrei Borzenkov <arvidjaar@gmail.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: pass on # comments to {Pre,Post}{Up,Down}Robyn Kosching2025-05-234-16/+20
| | | | | | | | | | | Currently commands in {Pre,Post}{Up,Down} are stripped of everything starting with the first #, even if the # is escaped or in a string. This patch leaves comment interpretation to the shell, as it can presumably already handle the difference between comments and escaped #. Signed-off-by: Robyn Kosching <robyn@kosching.me> [Jason: massage commit message, port to other platforms] Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: linux: use smallest mtu, not largestJason A. Donenfeld2025-05-211-5/+5
| | | | | | | | By accident, this function was looking at the endpoint with the largest MTU rather than the smallest one. Reported-by: Ismael Bouya <ismael@bouya.org> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: linux: add 'dev' to 'ip link add' to avoid keyword conflictsTriangleSnake2025-05-211-1/+1
| | | | | Signed-off-by: TriangleSnake <trianglesnake2002@gmail.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: run PreUp hook after creating interfaceDaniel Gröber2023-05-184-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently PreUp hooks run before the interface is created. This is problematic for moving the device into a Linux VRFs as this will currently clear all assigned IPv6 addressess (possibly a bug), so if we did this in PostUp (i.e. before add_addr) we'll have to manually re-add all assigned addresses. This is obviously less than ideal. Instead create the wg device just before running PreUp hooks. We apply this to all platforms for consistency. Test case: $ ip link add vrf-test type vrf table 1234 $ ip link add wg-test type wireguard $ ip addr add dev wg-test 192.168.42.42/24 $ ip addr add dev wg-test fe80::/64 $ ip -br addr show wg-test wg-test DOWN 192.168.42.42/24 fe80::/64 $ ip link set dev wg-test master vrf-test $ ip -br addr show wg-test wg-test DOWN 192.168.42.42/32 Signed-off-by: Daniel Gröber <dxld@darkboxed.org> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: linux: prevent traffic from momentarily leaking into tunnelTom Yan2022-06-171-1/+1
| | | | | | | | | | The wireguard route table ip rule should stay as a no-op until the `suppress_prefixlength 0 table main` rule is in effect. Therefore, add the wireguard default route to its route table after the latter rule is added. Signed-off-by: Tom Yan <tom.ty89@gmail.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: android: use right regex for host-vs-IPJason A. Donenfeld2022-05-101-1/+1
| | | | | | | Looks like the "is valid ifname" regex was copy and pasted from wg-quick.bash instead of the "is valid IP" regex. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: openbsd: set DNS with resolvd(8)Matt Dunwoodie2021-09-141-4/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenBSD has introduced a new daemon named resolvd(8) to manage resolv.conf. This creates problems with the old "horrible way" of completely replacing resolv.conf. Resolvd will attempt to merge manual changes with DNS servers discovered through dhcpleased(8) and slaacd(8). Unfortunately, resolvd puts any manual modifications at the end of resolv.conf, meaning that the wg-quick name servers will be queried last. The process for handling multiple name servers (at least with libc) is to try a name server, and if the query times out, try the next, until out of name servers, then repeat trying all name servers until a maximum number of retries are performed. The name servers are queried in the order listed in resolv.conf and the timeout is 5 seconds. With this patch, we ensure the wg-quick name server is first in resolv.conf (as route creates the name server with "static" priority), but cannot ensure it is exclusive. Therfore, it may be possible that queries are leaked to other name servers if the wg-quick name server doesn't respond within 5 seconds. We have another problem however, and that is if resolvd detects unwind is running, it will set 127.0.0.1 as the only name server in resolv.conf. unwind does not have deterministic name server selection in the default configuration. This means, all a user would need to do to inadvertently cause persistent query leaks would be to run `rcctl enable unwind`. There are warnings added when these situations may occur. The next step is to add an exclusive flag and search to route and resolvd. Reported-by: Matthieu Herrb <matthieu@herrb.eu> Signed-off-by: Matt Dunwoodie <ncon@noconroy.net> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: android: adjust for android 12Jason A. Donenfeld2021-09-091-2/+8
| | | | | | | https://android-review.googlesource.com/c/platform/system/netd/+/1671532 Reported-by: engstk <eng.stk@sapo.pt> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: darwin: account for "link#XX" gatewaysLaura Hausmann2021-08-121-2/+2
| | | | | | | | On macOS, under specific configurations, the `netstat -nr -f inet` and `netstat -nr -f inet6` outputs break gateway collection. Signed-off-by: Laura Hausmann <laura@hausmann.dev> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: kill route monitor when loop terminatesJason A. Donenfeld2021-04-203-10/+16
| | | | | | | | | | If the route monitor doesn't attempt to write more to stdout, then this leaves a process hanging around. Kill it explicitly. We also switch to using exec in the process substitution, to reduce a bash process. Closes: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=255286 Reported-by: Christos Chatzaras <chris@cretaforce.gr> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: freebsd: use ifconfig for determining if interface is upJason A. Donenfeld2021-04-181-16/+2
| | | | | | | | | We no longer need the arp hack, as these bugs have been fixed in the FreeBSD kernel. This partially reverts 090639ae90fb45ac05e3158e1e31e5bf15fd9559. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: freebsd: do not assume point-to-point interface flagJason A. Donenfeld2021-03-231-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: freebsd: check for socket using -S, not -fJason A. Donenfeld2021-03-211-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: freebsd: avoid writing private keys to /tmpJason A. Donenfeld2021-03-131-1/+1
| | | | | | | | FreeBSD's bash doesn't handle <(...) safely, creating a temporary file instead of using /proc/self/fd/N like on Linux. Work around this by using a simple pipeline with /dev/stdin. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: freebsd: add kernel supportJason A. Donenfeld2021-03-111-3/+17
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: openbsd: no use for userspace supportJason A. Donenfeld2020-10-191-41/+23
| | | | | | | | | | | With alignment between the kernel and userspace, along with userspace packages, we can now rely on the kernel in the future always having wg(4). This also simplifies the interface selection logic, and stores the wg-quick interface name as the description. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: android: do not free iterated pointerJason A. Donenfeld2020-09-151-7/+8
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* Revert "wg-quick: wait on process substitutions"Jason A. Donenfeld2020-08-274-49/+49
| | | | | | | | | | | | | | | | | | This reverts commit 26683f6c9ad18d9914b23312c221f27fd5ecab51, which means the old problem comes back. That's an issue. But waiting on process substitutions is not available with commonly used bash versions: # wg-quick up demo [#] ip link add demo type wireguard [#] wg setconf demo /dev/fd/63 /usr/bin/wg-quick: line 251: wait: pid 2955 is not a child of this shell [#] ip link delete dev demo This means we have to wait a few years before fixing this issue. IOW, bash limitation; can't fix. Reported-by: Theodore Mozzo <theodore.mozzo@gmail.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: android: use iproute2 to bring up interface instead of ndcJason A. Donenfeld2020-08-251-1/+1
| | | | | | | | | Android 11's ndc regresses even more, but it turns out that netd doesn't need to track up/down state via direct invocation, so just set the interface up by way of normal iproute2. Reported-by: Harsh Shandilya <me@msfjarvis.dev> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: wait on process substitutionsJason A. Donenfeld2020-08-064-49/+49
| | | | | | | | | Bash does not propagate error values, which is a bummer, but process substitutions are a useful feature. Introduce a new idiom to deal with this: either "; wait $!" after the line to propagate the error, or "|| true" to indicate explicitly that we don't care about the error. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: cleanup openbsd supportJason A. Donenfeld2020-05-102-26/+35
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: add support for openbsd kernel implementationMatt Dunwoodie2020-05-101-4/+19
| | | | Signed-off-by: Matt Dunwoodie <ncon@noconroy.net>
* wg-quick: support dns search domainsJason A. Donenfeld2020-05-095-28/+76
| | | | | | | If DNS= has an IP in it, treat it as a DNS server. If DNS= has a non-IP in it, treat it as a DNS search domain. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: android: support application whitelistJason A. Donenfeld2020-04-051-25/+48
| | | | | | | | | Prior we only supported a blacklist, but actually a whitelist is an easier algorithm because that's internally how netd considers it, so we don't need to find range spans. This commit adds an IncludedApplications key. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: android: split uids into multiple commandsJason A. Donenfeld2020-01-311-1/+8
| | | | | | | | Different versions of netd have different limits on how many can be passed at once. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Reported-by: Alexey <zaranecc@bk.ru>
* global: bump copyrightJason A. Donenfeld2020-01-025-5/+5
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: linux: quote ifname for nftJason A. Donenfeld2019-12-281-1/+1
| | | | | | | Otherwise nft(8) has strange ideas of what a string is. Suggested-by: RistiCore <RistiCore@mail.ee> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: linux: use already configured addresses instead of in-memoryJason A. Donenfeld2019-12-171-6/+6
| | | | | | | | | | | The ADDRESSES array might not have addresses added during PreUp. But moreover, nft(8) and iptables(8) don't like ip addresses in the form somev6prefix::someipv4suffix, such as fd00::1.2.3.4, while ip(8) can handle it. So by adding these first and then asking for them back, we always get normalized addresses suitable for nft(8) and iptables(8). Reported-by: Silvan Nagl <mail@53c70r.de> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: linux: try both iptables(8) and nft(8) on teardownJason A. Donenfeld2019-12-121-1/+2
| | | | | | | | Daniel argues that technically a package manager could install nft(8) after previously having started wg-quick(8) using iptables(8). Suggested-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: linux: support older nft(8)Jason A. Donenfeld2019-12-121-5/+5
| | | | | | | | Older nft(8), such as that on Ubuntu, does not accept the - parameter to the -f argument and doesn't accept symbolic priority names. So instead use the canonical numeric priority forms and use <(echo) instead of -. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: fix up spellingJosh Soref2019-12-121-2/+2
| | | | | Signed-off-by: Josh Soref <jsoref@gmail.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: linux: add support for nft and prefer itJason A. Donenfeld2019-12-121-20/+39
| | | | | | | | If nft(8) is installed, use it. These rules should be identical to the iptables-restore(8) ones, with the advantage that cleanup is easy because we use custom table names. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: linux: ignore save warnings for iptables-nftJason A. Donenfeld2019-12-061-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: linux: suppress more warnings on weird kernelsJason A. Donenfeld2019-12-061-4/+4
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: linux: some iptables don't like empty linesJason A. Donenfeld2019-12-051-6/+6
| | | | | Reported-by: Kenneth R. Crudup <kenny@panix.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: linux: iptables-* -w is not widely supportedJason A. Donenfeld2019-12-051-2/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: linux: have remove_iptables return trueJason A. Donenfeld2019-12-051-1/+1
| | | | | Reported-by: Thomas Sattler <sattler@med.uni-frankfurt.de> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: linux: ensure postdown hooks executeJason A. Donenfeld2019-12-051-2/+2
| | | | | Reported-by: Thomas Sattler <sattler@med.uni-frankfurt.de> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: linux: suppress error when finding unused tableJason A. Donenfeld2019-11-271-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: linux: filter bogus injected packets and don't disable rpfilterJason A. Donenfeld2019-11-271-8/+29
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: linux: only touch net.ipv4 for v4Jason A. Donenfeld2019-11-261-3/+5
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: android: check for null in binder cleanup functionsJason A. Donenfeld2019-10-161-3/+6
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: android: use Binder for setting DNS on Android 10Nicolas Douma2019-10-121-7/+429
| | | | | Signed-off-by: Nicolas Douma <nicolas@serveur.io> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: linux: don't fail down when using systemd-resolvedRonan Pigott2019-08-271-1/+1
| | | | | | | | | | | | | | | | | systemd-resolved has a compatibility interface for use with resolvconf scripts when resolvectl is called from a symlink from resolvconf. However, when tearing down the interface, cmd_down calls del_if and then unset_dns. In the case of systemd-resolved, deleting the interface also removes the systemd-resolved entry and causes resolvconf -d to fail when resolvconf really is a symlink to resolvectl. This causes `wg-quick down` and 'wg-quick@.service' to exit with failure. Instead we use the resolvconf '-f' flag to ignore non-existent interfaces, supported by both openresolv and sd-resolved resolvconf. Signed-off-by: Ronan Pigott <rpigott@berkeley.edu> [zx2c4: moved -f argument to end to remain compatible with Debian's resolvconf] Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: openbsd: fix alternate routing table syntaxAnkur Kothari2019-08-071-1/+1
| | | | | | | | route(8) has always used the `-T` option to specify the routing table; there is no `rdomain` option. Signed-off-by: Ankur Kothari <ankur@lipidity.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: android: refactor and add incoming allow rulesJason A. Donenfeld2019-07-081-65/+73
| | | | | Suggested-by: Yağmur Oymak <yagmur.oymak@gmail.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: darwin: support being called from launchdJason A. Donenfeld2019-06-241-1/+16
| | | | | | | | This causes wg-quick up to wait for the monitor to exit before it exits, so that launchd can correctly wait on it. Reported-by: Cameron Palmer <cameron@promon.no> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* wg-quick: specify protocol to ip(8), because of inconsistenciesJason A. Donenfeld2019-05-291-3/+7
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.