| Commit message (Collapse) | Author | Files | Lines |
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
> warning LGHT1056 : The Property table contains a row with primary
key(s) 'MsiHiddenProperties' which cannot be merged from the merge
module '.deps\wintun-amd64.msm'. This is likely due to collision of
rows with the same primary key(s) (but other different values in other
columns) between the database and the merge module.
The warning is caused by Wintun MSM and WireGuard MSI both using
MsiHiddenProperties property. This property is used by WiX to hide
internal data passed to deferred actions from being output to the log.
Signed-off-by: Simon Rozman <simon@rozman.si>
|
|
> ICE61: This product should remove only older versions of itself. The
Maximum version is not less than the current product.
The warning is caused by <MajorUpgrade AllowSameVersionUpgrades="yes"...
For the time being, this is our design choice. We're shipping WireGuard
with three-field versions 0.0.x. AllowSameVersionUpgrades="yes" avoids
manual configuration of update path in the brain-dead-two-field-version-
comparison-only Group Policy, but requires that the MSI packages are
added to GPO in correct order.
Signed-off-by: Simon Rozman <simon@rozman.si>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Odd Stranne <odd@mullvad.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Odd Stranne <odd@mullvad.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Odd Stranne <odd@mullvad.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Odd Stranne <odd@mullvad.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
This resolves ICE66 warning regarding MSI 4.0 columns added to Shortcut
table by WiX.
Besides, Windows 7 has MSI 5.0 out of the box.
Signed-off-by: Simon Rozman <simon@rozman.si>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
This prevents a thundering herd. Also, we can now use the restart
manager in the MSI because our walk fork handles the right window
messages.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
It introduces weird other problems.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Simon Rozman <simon@rozman.si>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
This is our "auto kill switch".
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
This must be reverted before we release! See big source code comment.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
This prevents DNS leaks from people who have a localhost resolver doing
something funky.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Unless you use complicated rights veto rules, WFP's policy is that
between sublayers, block always outweighs allow. It's easier, therefore,
to simply weight a single sublayer correctly, with allow rules having
heavier weight than block rules.
This basically means that we have to be careful that DNS isn't a subset
of some allow rule. One place where this would be a problem are the
permitLan* rules, which we don't use anyway, and so this commit nukes
them.
Another place would be if somebody is using a localhost/loopback resolver
for whatever reason. This is probably a "low risk" sort of thing, but we
may want to fix this by ordering the dns block just in front of the
loopback permit.
The other place is in the wireguard.exe tunnel service itself, which
does DNS lookups. Since right now we mostly enforce one-tunnel-at-a-
time, this isn't really a problem. But later if we allow nested
tunneling, it means that the DNS lookup in a second tunnel can
potentially escape the DNS server of the first tunnel. We can address
this problem later, perhaps with fancier security descriptors that we
shuffle around depending on which state the tunnel is in. And on the
bright side, this change allows people to run WireGuard over port 53
itself, which is generally a desirable thing.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
|