diff options
Diffstat (limited to '')
| -rw-r--r-- | .overlay/crypto/internal/boring/notboring.go | 26 | ||||
| -rw-r--r-- | .overlay/crypto/internal/fips140/check/check.go | 8 | ||||
| -rw-r--r-- | .overlay/crypto/internal/fips140/drbg/rand.go | 33 | ||||
| -rw-r--r-- | .overlay/crypto/internal/fips140/ecdh/ecdh.go | 24 | ||||
| -rw-r--r-- | .overlay/crypto/internal/fips140/ed25519/cast.go | 9 | ||||
| -rw-r--r-- | .overlay/crypto/internal/fips140/fips140.go | 43 | ||||
| -rw-r--r-- | .overlay/crypto/internal/fips140/sha512/sha512block_amd64.go | 20 | ||||
| -rw-r--r-- | .overlay/crypto/internal/fips140/sha512/sha512block_arm64.go | 20 | ||||
| -rw-r--r-- | .overlay/crypto/internal/fips140deps/cpu/cpu.go | 15 | ||||
| -rw-r--r-- | .overlay/crypto/internal/fips140only/fips140only.go | 11 | ||||
| -rw-r--r-- | .overlay/crypto/rand/rand.go | 24 | ||||
| -rw-r--r-- | .overlay/overlay.json | 24 | ||||
| -rw-r--r-- | Makefile | 5 | ||||
| -rw-r--r-- | build.bat | 2 | ||||
| -rw-r--r-- | embeddable-dll-service/build.bat | 2 |
15 files changed, 262 insertions, 4 deletions
diff --git a/.overlay/crypto/internal/boring/notboring.go b/.overlay/crypto/internal/boring/notboring.go new file mode 100644 index 00000000..4ea6a530 --- /dev/null +++ b/.overlay/crypto/internal/boring/notboring.go @@ -0,0 +1,26 @@ +//go:build !(boringcrypto && linux && (amd64 || arm64) && !android && !msan && cgo) + +/* SPDX-License-Identifier: MIT + * + * Copyright (C) 2019-2026 WireGuard LLC. All Rights Reserved. + */ + +package boring + +const available = false + +type randReader int + +const RandReader = randReader(0) + +func (randReader) Read([]byte) (int, error) { panic("") } + +type PublicKeyECDH struct{} +type PrivateKeyECDH struct{} + +func ECDH(*PrivateKeyECDH, *PublicKeyECDH) ([]byte, error) { panic("") } +func GenerateKeyECDH(string) (*PrivateKeyECDH, []byte, error) { panic("") } +func NewPrivateKeyECDH(string, []byte) (*PrivateKeyECDH, error) { panic("") } +func NewPublicKeyECDH(string, []byte) (*PublicKeyECDH, error) { panic("") } +func (*PublicKeyECDH) Bytes() []byte { panic("") } +func (*PrivateKeyECDH) PublicKey() (*PublicKeyECDH, error) { panic("") } diff --git a/.overlay/crypto/internal/fips140/check/check.go b/.overlay/crypto/internal/fips140/check/check.go new file mode 100644 index 00000000..82319e10 --- /dev/null +++ b/.overlay/crypto/internal/fips140/check/check.go @@ -0,0 +1,8 @@ +/* SPDX-License-Identifier: MIT + * + * Copyright (C) 2019-2026 WireGuard LLC. All Rights Reserved. + */ + +package check + +const Verified = false diff --git a/.overlay/crypto/internal/fips140/drbg/rand.go b/.overlay/crypto/internal/fips140/drbg/rand.go new file mode 100644 index 00000000..bd500845 --- /dev/null +++ b/.overlay/crypto/internal/fips140/drbg/rand.go @@ -0,0 +1,33 @@ +/* SPDX-License-Identifier: MIT + * + * Copyright (C) 2019-2026 WireGuard LLC. All Rights Reserved. + */ + +package drbg + +import ( + "crypto/internal/sysrand" + "io" +) + +func Read(b []byte) { + sysrand.Read(b) +} + +func SetTestingReader(io.Reader) { + panic("") +} + +type DefaultReader struct{} + +func (DefaultReader) defaultReader() {} + +func IsDefaultReader(r io.Reader) bool { + _, ok := r.(interface{ defaultReader() }) + return ok +} + +func ReadWithReader(r io.Reader, b []byte) error { + Read(b) + return nil +} diff --git a/.overlay/crypto/internal/fips140/ecdh/ecdh.go b/.overlay/crypto/internal/fips140/ecdh/ecdh.go new file mode 100644 index 00000000..86406e4a --- /dev/null +++ b/.overlay/crypto/internal/fips140/ecdh/ecdh.go @@ -0,0 +1,24 @@ +/* SPDX-License-Identifier: MIT + * + * Copyright (C) 2019-2026 WireGuard LLC. All Rights Reserved. + */ + +package ecdh + +import "io" + +type PrivateKey struct{} +type PublicKey struct{} +type Curve struct{} + +func (*PrivateKey) Bytes() []byte { panic("") } +func (*PrivateKey) PublicKey() *PublicKey { panic("") } +func (*PublicKey) Bytes() []byte { panic("") } +func P224() *Curve { panic("") } +func P256() *Curve { panic("") } +func P384() *Curve { panic("") } +func P521() *Curve { panic("") } +func GenerateKey(*Curve, io.Reader) (*PrivateKey, error) { panic("") } +func NewPrivateKey(*Curve, []byte) (*PrivateKey, error) { panic("") } +func NewPublicKey(*Curve, []byte) (*PublicKey, error) { panic("") } +func ECDH(*Curve, *PrivateKey, *PublicKey) ([]byte, error) { panic("") } diff --git a/.overlay/crypto/internal/fips140/ed25519/cast.go b/.overlay/crypto/internal/fips140/ed25519/cast.go new file mode 100644 index 00000000..8ede70d7 --- /dev/null +++ b/.overlay/crypto/internal/fips140/ed25519/cast.go @@ -0,0 +1,9 @@ +/* SPDX-License-Identifier: MIT + * + * Copyright (C) 2019-2026 WireGuard LLC. All Rights Reserved. + */ + +package ed25519 + +func fipsSelfTest() {} +func fipsPCT(*PrivateKey) {} diff --git a/.overlay/crypto/internal/fips140/fips140.go b/.overlay/crypto/internal/fips140/fips140.go new file mode 100644 index 00000000..0e98ed5d --- /dev/null +++ b/.overlay/crypto/internal/fips140/fips140.go @@ -0,0 +1,43 @@ +/* SPDX-License-Identifier: MIT + * + * Copyright (C) 2019-2026 WireGuard LLC. All Rights Reserved. + */ + +package fips140 + +const ( + Enabled = false + debug = false +) + +func Supported() error { + panic("") +} + +func Name() string { + panic("") +} + +func Version() string { + panic("") +} + +func CAST(string, func() error) { + panic("") +} + +func PCT(string, func() error) { + panic("") +} + +func RecordApproved() {} + +func RecordNonApproved() {} + +func ResetServiceIndicator() { + panic("") +} + +func ServiceIndicator() bool { + panic("") +} diff --git a/.overlay/crypto/internal/fips140/sha512/sha512block_amd64.go b/.overlay/crypto/internal/fips140/sha512/sha512block_amd64.go new file mode 100644 index 00000000..6760eeb3 --- /dev/null +++ b/.overlay/crypto/internal/fips140/sha512/sha512block_amd64.go @@ -0,0 +1,20 @@ +//go:build !purego + +/* SPDX-License-Identifier: MIT + * + * Copyright (C) 2019-2026 WireGuard LLC. All Rights Reserved. + */ + +package sha512 + +import "crypto/internal/fips140deps/cpu" + +//go:noescape +func blockAVX2(dig *Digest, p []byte) +func block(dig *Digest, p []byte) { + if cpu.HasSHA512AVX2() { + blockAVX2(dig, p) + } else { + blockGeneric(dig, p) + } +} diff --git a/.overlay/crypto/internal/fips140/sha512/sha512block_arm64.go b/.overlay/crypto/internal/fips140/sha512/sha512block_arm64.go new file mode 100644 index 00000000..c4af4d07 --- /dev/null +++ b/.overlay/crypto/internal/fips140/sha512/sha512block_arm64.go @@ -0,0 +1,20 @@ +//go:build !purego + +/* SPDX-License-Identifier: MIT + * + * Copyright (C) 2019-2026 WireGuard LLC. All Rights Reserved. + */ + +package sha512 + +import "crypto/internal/fips140deps/cpu" + +//go:noescape +func blockSHA512(dig *Digest, p []byte) +func block(dig *Digest, p []byte) { + if cpu.HasSHA512ARM64() { + blockSHA512(dig, p) + } else { + blockGeneric(dig, p) + } +} diff --git a/.overlay/crypto/internal/fips140deps/cpu/cpu.go b/.overlay/crypto/internal/fips140deps/cpu/cpu.go new file mode 100644 index 00000000..8616d0b7 --- /dev/null +++ b/.overlay/crypto/internal/fips140deps/cpu/cpu.go @@ -0,0 +1,15 @@ +/* SPDX-License-Identifier: MIT + * + * Copyright (C) 2019-2026 WireGuard LLC. All Rights Reserved. + */ + +package cpu + +import "internal/cpu" + +func HasSHA512AVX2() bool { + return cpu.X86.HasAVX && cpu.X86.HasAVX2 && cpu.X86.HasBMI2 +} +func HasSHA512ARM64() bool { + return cpu.ARM64.HasSHA512 +} diff --git a/.overlay/crypto/internal/fips140only/fips140only.go b/.overlay/crypto/internal/fips140only/fips140only.go new file mode 100644 index 00000000..0027fa1e --- /dev/null +++ b/.overlay/crypto/internal/fips140only/fips140only.go @@ -0,0 +1,11 @@ +/* SPDX-License-Identifier: MIT + * + * Copyright (C) 2019-2026 WireGuard LLC. All Rights Reserved. + */ + +package fips140only + +import "hash" + +func Enforced() bool { return false } +func ApprovedHash(hash.Hash) bool { panic("") } diff --git a/.overlay/crypto/rand/rand.go b/.overlay/crypto/rand/rand.go new file mode 100644 index 00000000..03d083ad --- /dev/null +++ b/.overlay/crypto/rand/rand.go @@ -0,0 +1,24 @@ +/* SPDX-License-Identifier: MIT + * + * Copyright (C) 2019-2026 WireGuard LLC. All Rights Reserved. + */ + +package rand + +import ( + "crypto/internal/sysrand" + "io" +) + +func Read(b []byte) (n int, err error) { + sysrand.Read(b) // Should panic on failure or short read + return len(b), nil +} + +type reader struct{} + +func (r reader) Read(b []byte) (n int, err error) { + return Read(b) +} + +var Reader io.Reader = reader{} diff --git a/.overlay/overlay.json b/.overlay/overlay.json new file mode 100644 index 00000000..bf24ad63 --- /dev/null +++ b/.overlay/overlay.json @@ -0,0 +1,24 @@ +{ + "Replace": { + ".deps/go/src/crypto/internal/boring/notboring.go": ".overlay/crypto/internal/boring/notboring.go", + ".deps/go/src/crypto/internal/fips140/cast.go": "", + ".deps/go/src/crypto/internal/fips140/check/check.go": ".overlay/crypto/internal/fips140/check/check.go", + ".deps/go/src/crypto/internal/fips140/drbg/cast.go": "", + ".deps/go/src/crypto/internal/fips140/drbg/ctrdrbg.go": "", + ".deps/go/src/crypto/internal/fips140/drbg/entropy_fips140.go": "", + ".deps/go/src/crypto/internal/fips140/drbg/entropy_wasm.go": "", + ".deps/go/src/crypto/internal/fips140/drbg/rand.go": ".overlay/crypto/internal/fips140/drbg/rand.go", + ".deps/go/src/crypto/internal/fips140/ecdh/cast.go": "", + ".deps/go/src/crypto/internal/fips140/ecdh/ecdh.go": ".overlay/crypto/internal/fips140/ecdh/ecdh.go", + ".deps/go/src/crypto/internal/fips140/ed25519/cast.go": ".overlay/crypto/internal/fips140/ed25519/cast.go", + ".deps/go/src/crypto/internal/fips140/fips140.go": ".overlay/crypto/internal/fips140/fips140.go", + ".deps/go/src/crypto/internal/fips140/indicator.go": "", + ".deps/go/src/crypto/internal/fips140/sha512/cast.go": "", + ".deps/go/src/crypto/internal/fips140/sha512/sha512block_amd64.go": ".overlay/crypto/internal/fips140/sha512/sha512block_amd64.go", + ".deps/go/src/crypto/internal/fips140/sha512/sha512block_arm64.go": ".overlay/crypto/internal/fips140/sha512/sha512block_arm64.go", + ".deps/go/src/crypto/internal/fips140deps/cpu/cpu.go": ".overlay/crypto/internal/fips140deps/cpu/cpu.go", + ".deps/go/src/crypto/internal/fips140only/fips140only.go": ".overlay/crypto/internal/fips140only/fips140only.go", + ".deps/go/src/crypto/rand/rand.go": ".overlay/crypto/rand/rand.go", + ".deps/go/src/crypto/rand/util.go": "" + } +} @@ -1,5 +1,6 @@ -GOFLAGS := -tags load_wgnt_from_rsrc -ldflags="-H windowsgui -s -w" -trimpath -buildvcs=false -v +GOFLAGS := -overlay .overlay/overlay.json -tags load_wgnt_from_rsrc -ldflags="-H windowsgui -s -w" -trimpath -buildvcs=false -v export GOOS := windows +export PWD := $(CURDIR) export PATH := $(CURDIR)/.deps/go/bin:$(PATH) VERSION := $(shell sed -n 's/^\s*Number\s*=\s*"\([0-9.]\+\)"$$/\1/p' version/version.go) @@ -9,7 +10,7 @@ comma := , RCFLAGS := -DWIREGUARD_VERSION_ARRAY=$(subst $(space),$(comma),$(wordlist 1,4,$(subst .,$(space),$(VERSION)) 0 0 0 0)) -DWIREGUARD_VERSION_STR=$(VERSION) -O coff -c 65001 rwildcard=$(foreach d,$(filter-out .deps,$(wildcard $1*)),$(call rwildcard,$d/,$2) $(filter $(subst *,%,$2),$d)) -SOURCE_FILES := $(call rwildcard,,*.go) .deps/go/prepared go.mod go.sum +SOURCE_FILES := $(call rwildcard,,*.go) $(call rwildcard,.overlay/,*) .deps/go/prepared go.mod go.sum RESOURCE_FILES := resources.rc version/version.go manifest.xml $(patsubst %.svg,%.ico,$(wildcard ui/icon/*.svg)) .deps/wireguard-nt/prepared DEPLOYMENT_HOST ?= winvm @@ -73,7 +73,7 @@ if exist .deps\prepared goto :render echo [+] Assembling resources %1 %~2-w64-mingw32-windres -I ".deps\wireguard-nt\bin\%~1" -DWIREGUARD_VERSION_ARRAY=%WIREGUARD_VERSION_ARRAY% -DWIREGUARD_VERSION_STR=%WIREGUARD_VERSION% -i resources.rc -o "resources_%~3.syso" -O coff -c 65001 || exit /b %errorlevel% echo [+] Building program %1 - go build -tags load_wgnt_from_rsrc -ldflags="-H windowsgui -s -w" -trimpath -buildvcs=false -v -o "%~1\wireguard.exe" || exit /b 1 + go build -overlay .overlay/overlay.json -tags load_wgnt_from_rsrc -ldflags="-H windowsgui -s -w" -trimpath -buildvcs=false -v -o "%~1\wireguard.exe" || exit /b 1 if not exist "%~1\wg.exe" ( echo [+] Building command line tools %1 del .deps\src\*.exe .deps\src\*.o .deps\src\wincompat\*.o .deps\src\wincompat\*.lib 2> NUL diff --git a/embeddable-dll-service/build.bat b/embeddable-dll-service/build.bat index aa3cdfea..6f7e339a 100644 --- a/embeddable-dll-service/build.bat +++ b/embeddable-dll-service/build.bat @@ -39,7 +39,7 @@ if exist ..\.deps\prepared goto :build set GOARCH=%~3 mkdir %1 >NUL 2>&1 echo [+] Building library %1 - go build -buildmode c-shared -ldflags="-w -s" -trimpath -v -o "%~1/tunnel.dll" || exit /b 1 + go -C .. build -overlay .overlay/overlay.json -buildmode c-shared -ldflags="-w -s" -trimpath -v -o "%BUILDDIR%%~1/tunnel.dll" ./embeddable-dll-service || exit /b 1 del "%~1\tunnel.h" goto :eof |