wireguard-windows/conf, branch masterWireGuard client for Windowshttps://git.zx2c4.com/wireguard-windows/atom/conf?h=master2026-05-19T15:37:20Zconf: flush file buffers before atomically renaming into place2026-05-19T15:37:20ZJason A. DonenfeldJason@zx2c4.com2026-05-18T14:00:16Zurn:sha1:f9fccd8266d2116d7ed8f1fa73be155115cb050f
NTFS journals the rename's metadata change but does not journal user
data. Without an explicit flush a power loss between the cache
manager publishing the rename and writing back the file's pages can
leave the destination at its final name with zero or partial
contents, while the prior file is gone.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
conf: keep retrying when the config-directory watcher fails to start2026-05-19T15:37:20ZJason A. DonenfeldJason@zx2c4.com2026-05-14T07:49:09Zurn:sha1:b1867964b43c760e5163ed54cd6e288ca6d6d387
The watcher's setup is guarded by sync.Once, which is consumed the
moment the goroutine is spawned. If tunnelConfigurationsDirectory or
FindFirstChangeNotification fails on the first attempt the goroutine
exits, but every subsequent RegisterStoreChangeCallback sees the Once
already done and skips the spawn, so changes are silently never
reported again. Retry these initial failures on the existing
startover loop instead of bailing out.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
conf: don't strip '#' from PreUp/PreDown/PostUp/PostDown values2026-05-19T15:37:20ZJason A. DonenfeldJason@zx2c4.com2026-05-18T07:33:05Zurn:sha1:138fc54288b54e13d657ff635f6592af304fc476
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
conf: reject reserved names with any extension2026-05-19T15:37:20ZJason A. DonenfeldJason@zx2c4.com2026-05-18T13:56:17Zurn:sha1:7358663109ca3da16c1358a0bb0137a161b2a9ea
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
conf: prevent directory traversal on bare tunnel names2026-05-03T19:06:48ZJason A. DonenfeldJason@zx2c4.com2026-05-03T19:06:21Zurn:sha1:b1b1bfee5dd393332976f2f200151838a3e242ef
Not really reachable, but still this seems wrong not to check.
DeleteName checks it.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
global: format code2026-04-16T14:21:33ZJason A. DonenfeldJason@zx2c4.com2026-04-13T01:34:48Zurn:sha1:9bc76016ccb54ebec3503d4a88017eec8ac2925a
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
conf: properly deduplicate peers2026-04-16T13:26:26ZJason A. DonenfeldJason@zx2c4.com2026-04-11T17:42:45Zurn:sha1:25a936475fa09aa714e13930cb57b5ef8f5b746a
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
conf: reject tunnel names with leading or trailing dots2026-04-16T13:26:26ZJason A. DonenfeldJason@zx2c4.com2026-04-16T01:15:35Zurn:sha1:3bee7974fa7603b07e54862d721b004762298d5c
Windows is weird about these.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
conf: redact scripts for limited operators2026-04-16T13:26:26ZJason A. DonenfeldJason@zx2c4.com2026-04-16T01:08:54Zurn:sha1:e932cce4f23fe66d89cf1ba32238cfd0b7bb47b8
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
conf: give redacted peers distinct public keys2026-04-16T13:26:26ZJason A. DonenfeldJason@zx2c4.com2026-04-11T22:53:47Zurn:sha1:d6796ab72c58a04676c2e7285d7adf56ff084799
ConfView keys its peer map by pubkey. Redact() zeros every peer's pubkey
for non-admin callers, so a multi-peer config got collapsed into a
single map entry, hiding all but one peer. Fix this by just encoding an
index into each redacted pubkey.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>