tunnel: enable {Pre,Post}{Up,Down} scripts gated behind admin knob

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

2 files changed, 105 insertions, 8 deletions

diff --git a/tunnel/scriptrunner.go b/tunnel/scriptrunner.go
new file mode 100644
index 00000000..d34947db
--- /dev/null
+++ b/tunnel/scriptrunner.go
@@ -0,0 +1,78 @@
+/* SPDX-License-Identifier: MIT
+ *
+ * Copyright (C) 2020 WireGuard LLC. All Rights Reserved.
+ */
+
+package tunnel
+
+import (
+	"bufio"
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+
+	"golang.org/x/sys/windows"
+
+	"golang.zx2c4.com/wireguard/windows/conf"
+)
+
+func runScriptCommand(command, interfaceName string) error {
+	if len(command) == 0 {
+		return nil
+	}
+	if !conf.AdminBool("DangerousScriptExecution") {
+		log.Printf("Skipping execution of script, because dangerous script execution is safely disabled: %#q", command)
+		return nil
+	}
+	command = strings.ReplaceAll(command, "%i", interfaceName)
+	log.Printf("Executing: %#q", command)
+	comspec, _ := os.LookupEnv("COMSPEC")
+	if len(comspec) == 0 {
+		system32, err := windows.GetSystemDirectory()
+		if err != nil {
+			return err
+		}
+		comspec = filepath.Join(system32, "cmd.exe")
+	}
+
+	devNull, err := os.OpenFile(os.DevNull, os.O_RDWR, 0)
+	if err != nil {
+		return err
+	}
+	defer devNull.Close()
+	reader, writer, err := os.Pipe()
+	if err != nil {
+		return err
+	}
+	process, err := os.StartProcess(comspec, nil /* CmdLine below */, &os.ProcAttr{
+		Files: []*os.File{devNull, writer, writer},
+		Sys: &syscall.SysProcAttr{
+			HideWindow: true,
+			CmdLine:    fmt.Sprintf("cmd /c %s", command),
+		},
+	})
+	writer.Close()
+	if err != nil {
+		reader.Close()
+		return err
+	}
+	go func() {
+		scanner := bufio.NewScanner(reader)
+		for scanner.Scan() {
+			log.Printf("cmd> %s", scanner.Text())
+		}
+	}()
+	state, err := process.Wait()
+	reader.Close()
+	if err != nil {
+		return err
+	}
+	if state.ExitCode() == 0 {
+		return nil
+	}
+	log.Printf("Command error exit status: %d", state.ExitCode())
+	return windows.ERROR_GENERIC_COMMAND_FAILED
+}
diff --git a/tunnel/service.go b/tunnel/service.go
index 33b5c116..e07fe139 100644
--- a/tunnel/service.go
+++ b/tunnel/service.go
@@ -41,6 +41,7 @@ func (service *tunnelService) Execute(args []string, r <-chan svc.ChangeRequest,
 	var uapi net.Listener
 	var watcher *interfaceWatcher
 	var nativeTun *tun.NativeTun
+	var config *conf.Config
 	var err error
 	serviceError := services.ErrorSuccess
 
@@ -84,6 +85,9 @@ func (service *tunnelService) Execute(args []string, r <-chan svc.ChangeRequest,
 			}
 		}()
 
+		if logErr == nil && dev != nil && config != nil {
+			logErr = runScriptCommand(config.Interface.PreDown, config.Name)
+		}
 		if watcher != nil {
 			watcher.Destroy()
 		}
@@ -93,6 +97,9 @@ func (service *tunnelService) Execute(args []string, r <-chan svc.ChangeRequest,
 		if dev != nil {
 			dev.Close()
 		}
+		if logErr == nil && dev != nil && config != nil {
+			_ = runScriptCommand(config.Interface.PostDown, config.Name)
+		}
 		stopIt <- true
 		log.Println("Shutting down")
 	}()
@@ -113,19 +120,19 @@ func (service *tunnelService) Execute(args []string, r <-chan svc.ChangeRequest,
 		}
 	}()
 
-	conf, err := conf.LoadFromPath(service.Path)
+	config, err = conf.LoadFromPath(service.Path)
 	if err != nil {
 		serviceError = services.ErrorLoadConfiguration
 		return
 	}
-	conf.DeduplicateNetworkEntries()
+	config.DeduplicateNetworkEntries()
 	err = CopyConfigOwnerToIPCSecurityDescriptor(service.Path)
 	if err != nil {
 		serviceError = services.ErrorLoadConfiguration
 		return
 	}
 
-	logPrefix := fmt.Sprintf("[%s] ", conf.Name)
+	logPrefix := fmt.Sprintf("[%s] ", config.Name)
 	log.SetPrefix(logPrefix)
 
 	log.Println("Starting", version.UserAgent())
@@ -151,14 +158,14 @@ func (service *tunnelService) Execute(args []string, r <-chan svc.ChangeRequest,
 	}
 
 	log.Println("Resolving DNS names")
-	uapiConf, err := conf.ToUAPI()
+	uapiConf, err := config.ToUAPI()
 	if err != nil {
 		serviceError = services.ErrorDNSLookup
 		return
 	}
 
 	log.Println("Creating Wintun interface")
-	wintun, err := tun.CreateTUNWithRequestedGUID(conf.Name, deterministicGUID(conf), 0)
+	wintun, err := tun.CreateTUNWithRequestedGUID(config.Name, deterministicGUID(config), 0)
 	if err != nil {
 		serviceError = services.ErrorCreateWintun
 		return
@@ -171,7 +178,13 @@ func (service *tunnelService) Execute(args []string, r <-chan svc.ChangeRequest,
 		log.Printf("Using Wintun/%d.%d", (wintunVersion>>16)&0xffff, wintunVersion&0xffff)
 	}
 
-	err = enableFirewall(conf, nativeTun)
+	err = runScriptCommand(config.Interface.PreUp, config.Name)
+	if err != nil {
+		serviceError = services.ErrorRunScript
+		return
+	}
+
+	err = enableFirewall(config, nativeTun)
 	if err != nil {
 		serviceError = services.ErrorFirewall
 		return
@@ -190,7 +203,7 @@ func (service *tunnelService) Execute(args []string, r <-chan svc.ChangeRequest,
 	dev = device.NewDevice(wintun, logger)
 
 	log.Println("Setting interface configuration")
-	uapi, err = ipc.UAPIListen(conf.Name)
+	uapi, err = ipc.UAPIListen(config.Name)
 	if err != nil {
 		serviceError = services.ErrorUAPIListen
 		return
@@ -205,7 +218,7 @@ func (service *tunnelService) Execute(args []string, r <-chan svc.ChangeRequest,
 	log.Println("Bringing peers up")
 	dev.Up()
 
-	watcher.Configure(dev, conf, nativeTun)
+	watcher.Configure(dev, config, nativeTun)
 
 	log.Println("Listening for UAPI requests")
 	go func() {
@@ -218,6 +231,12 @@ func (service *tunnelService) Execute(args []string, r <-chan svc.ChangeRequest,
 		}
 	}()
 
+	err = runScriptCommand(config.Interface.PostUp, config.Name)
+	if err != nil {
+		serviceError = services.ErrorRunScript
+		return
+	}
+
 	changes <- svc.Status{State: svc.Running, Accepts: svc.AcceptStop | svc.AcceptShutdown}
 	log.Println("Startup complete")