aboutsummaryrefslogtreecommitdiffstatshomepage
Commit message (Collapse)AuthorAgeFilesLines
* driver: add new allowedip flagHEADmasterJason A. Donenfeld6 days2-2/+8
| | | | | | This also involves bumping wireguard-tools so that wg.exe is up to date. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* fetcher: account for potentially mangled title bar textJason A. Donenfeld7 days1-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: fix length calculation on rename operationJason A. Donenfeld7 days1-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This actually wasn't a problem before, because Windows ignores the length field when not renaming to an alternative data stream: FileName = lpFileInformation->FileName; if ( lpFileInformation->FileNameLength >= 2 && *FileName == ':' ) { FileNameLength = lpFileInformation->FileNameLength; Src.MaximumLength = FileNameLength; Src.Length = FileNameLength; Src.Buffer = lpFileInformation->FileName; } else { status = RtlDosPathNameToNtPathName_U_WithStatus(FileName, &Src, 0, 0); if ( status < 0 ) { v15 = status; LABEL_19: BaseSetLastNTError(v15); return 0; } FileNameLength = Src.Length; } Nonetheless, it's clear from this code (>=2) and the documentation that the length field is intended to be in bytes, not chars. So fix that. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* updater: do not verify EV statusJason A. Donenfeld7 days5-64/+5
| | | | | | | | | We'll keep signing with EV. But this is not a security check. Anybody can add an EV signature. It's not very expensive to do. And we've never checked that it's actually _our_ signature. For that, there's the normal ed25519-based mechanism, which is a lot nicer and faster. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* installer: forbid emulation of amd64 on arm64Jason A. Donenfeld8 days2-2/+21
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* Makefile: allow setting deployment architectureJason A. Donenfeld8 days1-1/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* firewall: fix formattingJason A. Donenfeld8 days2-4/+0
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: raise min windows version to 10Jason A. Donenfeld9 days18-189/+98
| | | | | | | | | | | | | | | Since we're also bumping the PE subsystem header to 10.0, this means we need a _load_config with the proper flags. So there's some work to be done here. This also means bumping LLVM and Go builds. In the case of Go, the patch is still pending: https://go-review.googlesource.com/c/go/+/756680 , so it's a custom build. Remove lots of compatibility code and hacks. Also update the installer to display a useful message. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: modernize go conventionsJason A. Donenfeld11 days16-54/+22
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: bump dateJason A. Donenfeld11 days144-147/+147
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* build: update go depsJason A. Donenfeld12 days4-33/+24
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* fetcher: cmdline option need not be volatileJason A. Donenfeld12 days1-3/+4
| | | | | | | | Also, make the name more confusing, no match the option, so that it can initialize to false. This might be controversial; there are arguments on both sides. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* build: bump to go 1.20.14Simon Rozman2025-03-185-6/+4
| | | | | | | | This fixes "Import tunnel(s) from file" and any other file open/save dialog popup crash on ARM64. Reported-by: Damjan Perenič <dperenic@connect.ust.hk> Signed-off-by: Simon Rozman <simon@rozman.si>
* build: make code signing method configurableSimon Rozman2024-10-174-9/+9
| | | | | | | | | | Existing code signing was hard-coded to use a locally installed certificate (hardware security dongles included). However, signtool.exe is extensible to allow any kind of digest signing plugin with /dlib and /dmdf switches. This is used for cloud-based code signing (e.g. Microsoft Trusted Signing). Signed-off-by: Simon Rozman <simon@rozman.si>
* installer: update WiX Toolset download URL and versionSimon Rozman2024-09-041-1/+1
| | | | | | | The version 3.14.0.4118 we were using is no longer available for download. Signed-off-by: Simon Rozman <simon@rozman.si>
* locales: sync with crowdinSimon Rozman2024-09-0423-3571/+18916
| | | | Signed-off-by: Simon Rozman <simon@rozman.si>
* fetcher: add /noprompt switchSimon Rozman2023-01-231-2/+18
| | | | | | | | | | | | | | Deploying WireGuard MSI using Microsoft Endpoint Manager (aka MS Intune) falls short with poor Microsoft Endpoint Manager support: no ARM64 support, requires multiple per-architecture deployments... Fetcher proves super-useful for automating WireGuard install. It contains platform selection logic, MSI download, integrity check... However, automated installation is an unattended process and the wireguard-installer.exe must not block the process for any user prompts. Signed-off-by: Simon Rozman <simon@rozman.si>
* embeddable-dll-service: build: .gitignore outputsSimon Rozman2022-03-281-0/+4
| | | | Signed-off-by: Simon Rozman <simon@rozman.si>
* embeddable-dll-service: build: integrate tunnel.dll signingSimon Rozman2022-03-281-0/+7
| | | | Signed-off-by: Simon Rozman <simon@rozman.si>
* embeddable-dll-service: csharp: ensure double \0 terminationSimon Rozman2022-03-281-4/+1
| | | | Signed-off-by: Simon Rozman <simon@rozman.si>
* embeddable-dll-service: correctness in READMESimon Rozman2022-03-281-2/+3
| | | | Signed-off-by: Simon Rozman <simon@rozman.si>
* build: bump to go1.18Jason A. Donenfeld2022-03-164-15/+15
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* Makefile: choose newest version of GoJason A. Donenfeld2022-01-181-1/+1
| | | | | | | | | | | | | Now that these are sorted properly, we can rely on the top one being the newest. Before, we assumed the last one was the newest, which was only true during betas and rcs, which required us to swap back and forth between the first one and the last one. But even then, the last one wouldn't always be the latest beta! So sometimes we had to change it to the second to last one. And on and on with madness. In other words, before the list was basically unsorted. But now that it's sorted, we can just use the top one always, which is what we want. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* dpapi: remove stray test exeJason A. Donenfeld2022-01-171-0/+0
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: do not examine connectivity state at bootJason A. Donenfeld2022-01-173-65/+4
| | | | | | | | | | | | | It turns out that checking for internet connectivity is not really a reliable way of knowing whether the WSAHOST_NOT_FOUND is legitimate or not. So just give up on that approach, assume WSAHOST_NOT_FOUND is always illegitimate at boot, and loop for a long time. This might induce annoyances for admins who want to kill legitimate WSAHOST_NOT_FOUND services that keep trying again, but they'll just have to wait for two minutes. Reported-by: Simon Rozman <simon@rozman.si> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: bump dateJason A. Donenfeld2022-01-06143-146/+146
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* fetcher: only write 32 bytes to hash outputJason A. Donenfeld2022-01-062-3/+3
| | | | | | | Current binaries overflow into `wchar_t total_bytes_str[22]`, which is not used anywhere after the overflow, so no harm done thankfully. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: use strings.Cut where possibleJason A. Donenfeld2021-12-234-12/+9
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* version: bumpv0.5.3Jason A. Donenfeld2021-12-221-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* docs: new code signing certificateJason A. Donenfeld2021-12-221-2/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: use syscall.SyscallNJason A. Donenfeld2021-12-164-19/+19
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ringlogger: have caller cleanup inherited handle on failureJason A. Donenfeld2021-12-161-4/+1
| | | | | Reported-by: shuaidonga <1181157720@qq.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: interface{} -> anyJason A. Donenfeld2021-12-167-13/+13
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* build: omit build info from binaryJason A. Donenfeld2021-12-162-2/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: update to go 1.18 beta1Jason A. Donenfeld2021-12-1623-551/+27
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* build: remove patcherJason A. Donenfeld2021-12-142-6/+1
| | | | | | This should be easy to revert when we want to add it back. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: apply gofumptJason A. Donenfeld2021-12-0941-125/+140
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* build: update to go 1.17.4 and drop upstreamed patchesJason A. Donenfeld2021-12-028-288/+7
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* ui: only set "(out of date)" window title if admin userJason A. Donenfeld2021-11-261-1/+3
| | | | | | | | | Hopefully this scares users less, while keeping the update tab so that they still annoy their sysadmins to update. Reported-by: Bruno Andry <bandry@ut1.org> Discussed-with: Diab Neiroukh <lazerl0rd@thezest.dev> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* build: switch to go.devJason A. Donenfeld2021-11-252-3/+3
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* go-patches: support non-cooperative preemption on arm and arm64Jason A. Donenfeld2021-11-252-0/+124
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* mod: remove x/sys forkJason A. Donenfeld2021-11-245-20/+20
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: backout AddrFromSlice signature changeJason A. Donenfeld2021-11-114-11/+11
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* version: bumpv0.5.2Jason A. Donenfeld2021-11-081-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: check for WeakHostSend/Forwarding in pitfallsJason A. Donenfeld2021-11-084-3/+88
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* build: bump to go 1.17.3Jason A. Donenfeld2021-11-062-2/+3
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* go-patches: return correct nanosec param on arm64Jason A. Donenfeld2021-11-061-0/+81
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* go-patches: read nanotime in 1 instruction on 64bitJason A. Donenfeld2021-11-063-6/+200
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: add routes even when no corresponding addressJason A. Donenfeld2021-11-061-16/+3
| | | | | | | Apparently this works now, but it didn't used to. Reported-by: Christoph Loesch <wireguard-mail@chil.at> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* winipcfg: handle zones and make things use itJason A. Donenfeld2021-11-062-15/+23
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Copyright © 1996 – 2026 Jason A. Donenfeld. All Rights Reverse Engineered.