aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/conf (follow)
Commit message (Collapse)AuthorAgeFilesLines
* conf: separate out migration and print errorsJason A. Donenfeld2020-11-272-76/+89
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* manager: move legacy store from confJason A. Donenfeld2020-11-273-137/+0
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: rework migration flows around a single Save()Jason A. Donenfeld2020-11-274-21/+14
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: when migrating, write out reserialized configJason A. Donenfeld2020-11-271-3/+4
| | | | | | This catches encoding gotchas earlier. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: open temporary file with read sharingJason A. Donenfeld2020-11-271-1/+1
| | | | | | | | | The reason we do the rename-in-place temporary file situation is to allow reads to be complete once renamed. But the rename takes place before the filehandle is closed, so make sure that the handle is opened with read sharing, in case this races. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: do exponential back off for sharing violation in hotfolderJason A. Donenfeld2020-11-273-12/+40
| | | | | | | | | | | | | | | | | Windows gives us notifications about writes to files in a directory, but it does not give us notifications on when file handles are closed and when we can expect to be able to grab a handle to it; this would be racey at best. So, there always exists a race between the writer's last call to WriteFile() and its eventual CloseHandle(). Work around this by implementing a basic exponential back off of retrying the open call. While we're at it, clean up the "file already exists" logic to remove a basic toctou situation, and switch to using random temp file names in order to handle better the case of saving a new file from two different administrators at once. Reported-by: Jim Salter <jim@jrs-s.net> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: update headersJason A. Donenfeld2020-11-2218-18/+18
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: always use 64-bit registry view on 64-bit machinesJason A. Donenfeld2020-11-221-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: enable {Pre,Post}{Up,Down} scripts gated behind admin knobJason A. Donenfeld2020-11-224-1/+26
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: allow administrators to add and remove configs easilyJason A. Donenfeld2020-11-224-21/+76
| | | | | | | | | | We loosen the permissions a little bit while tightening the restrictions on encrypted files. This should allow administrators to easily drop unencrypted files into Data\Configurations\ and get them encrypted and made read-only, while also allowing them to delete unwanted configurations. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* manager: allow S-1-5-32-556 users to launch a limited UIJason A. Donenfeld2020-11-222-1/+45
| | | | | | | | | | | | | | | | | I still have serious security reservations about this, both conceptually -- should users be allowed to do this stuff? -- and pratically -- there are issues with this implementation that need some examination. TODO: - Is that registry key a secure path? Should we double check it? - Are we leaking handles to the unpriv'd process from the manager? Audit this too. - IPC notifications are blocking. Should we move this to a go routine to mitigate DoS potential? - Is GOB deserialization secure? Can an NCO user crash or RCE the manager? Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: mask self before giving routes to windowsJason A. Donenfeld2020-11-181-0/+8
| | | | | | Otherwise Windows complains. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: do not remigrate configs that are pending deletionJason A. Donenfeld2020-11-181-6/+18
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: delay removal of old configs until next rebootJason A. Donenfeld2020-11-171-7/+15
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: do not attempt to create programfilesJason A. Donenfeld2020-11-171-1/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: cleanup final path buffer handlingJason A. Donenfeld2020-11-171-7/+12
| | | | | | And insist that CreateFile regard directories. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: do best-effort service argument migrationJason A. Donenfeld2020-11-161-0/+53
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* mod: bump for recent conf additionsJason A. Donenfeld2020-11-161-20/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: move configuration to C:\Program Files\WireGuard\DataJason A. Donenfeld2020-11-162-34/+163
| | | | | | It doesn't get wiped out on Windows upgrades. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: go generateSimon Rozman2020-11-132-32/+16
| | | | Signed-off-by: Simon Rozman <simon@rozman.si>
* global: go fmtJason A. Donenfeld2020-06-081-2/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: add support for search domains inside dns lineJason A. Donenfeld2020-06-053-6/+10
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: fix typo in error messageSimon Rozman2020-06-051-2/+2
| | | | | Reported-by: KolinPower@Crowdin Signed-off-by: Simon Rozman <simon@rozman.si>
* l18n: disambiguate enumeration and unit concatenation separatorsSimon Rozman2020-03-151-1/+1
| | | | | | | | | In Japanese, "1分、5秒 前" is a little strange. It should be "1分 5秒 前". After consulting Slovenian linguist, I've learned the same applies to Slovenian as well. Reported-by: Eiji Tanioka <tanioka404@gmail.com> Signed-off-by: Simon Rozman <simon@rozman.si>
* l18n: add localization supportSimon Rozman2020-03-152-58/+49
| | | | | | | | | | | | | | | | | | | | | Revise the messages to make them localizable. Note: The log messages are not marked for localization. Probably, we want to keep log files in English for easier global troubleshooting. Having a user run `go generate` requires a valid and up-to-date Go environment. Rather than instructing users how to setup the environment correctly, the `go generate` was integrated into build.bat. This reuses the Go building environment downloaded and prepared by build.bat to provide controllable and consistent result. Use `make generate` on Linux. As the zgotext.go output varies for GOARCH=386 and amd64, one had to be chosen to provide stable output. The former is the first one to build in build.bat. Signed-off-by: Simon Rozman <simon@rozman.si>
* tunnel: deduplicate addresses from configJason A. Donenfeld2020-01-241-0/+43
| | | | | | | Windows doesn't like it when passing these off to its config. Reported-by: Jonathan Tooker <jonathan.tooker@netprotect.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: migrate when windows.old is S-1-5-32-544Jason A. Donenfeld2019-12-111-2/+2
| | | | | Reported-by: Mantas Mikulėnas <grawity@gmail.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* mod: bump versionsJason A. Donenfeld2019-10-042-2/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: do not create config folder and migrate if presetJason A. Donenfeld2019-09-233-1/+9
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: use SECURITY_DESCRIPTOR apis from x/sys/windowsJason A. Donenfeld2019-09-232-49/+5
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* manager: fix nits in adapter cleanup logic and also handle ‘%s’ uniformlyJason A. Donenfeld2019-08-301-5/+5
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* version: hard code name and version at compile timeJason A. Donenfeld2019-08-301-4/+8
| | | | | | | | | We really do want the true name and version in logs so that external consumers have a good reference point for helping us debug. We can then do the log file directory explicitly. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* version: use ProductName and ProductVersion as stringsJason A. Donenfeld2019-08-301-1/+4
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: extract owner of config file for pipe daclJason A. Donenfeld2019-07-191-0/+4
| | | | | | | | If the config file is unencrypted and its owner is not Local System, then we allow the runtime named pipe to be accessed by that owner, since generally the private key is already stored in the config file. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: dnsresolver: try harder at bootupJason A. Donenfeld2019-06-141-1/+4
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: check for file not found in addition to pathJason A. Donenfeld2019-06-131-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: separate out migrationJason A. Donenfeld2019-06-133-53/+65
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: known folder path is upstreamJason A. Donenfeld2019-06-132-32/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: grammarJason A. Donenfeld2019-06-131-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: don't crash when config directory is removedJason A. Donenfeld2019-06-132-6/+21
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: safely escape weird input charactersJason A. Donenfeld2019-06-131-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: manually migrate from windows.oldJason A. Donenfeld2019-06-133-10/+83
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: tick count is upstream nowJason A. Donenfeld2019-06-072-10/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: read files potentially with UTF16Jason A. Donenfeld2019-05-222-2/+21
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: correct names and patterns for go lintJason A. Donenfeld2019-05-161-2/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: change acronyms to uppercaseSimon Rozman2019-05-164-17/+17
| | | | Signed-off-by: Simon Rozman <simon@rozman.si>
* global: use tab after //sysJason A. Donenfeld2019-05-144-8/+8
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: regroup all importsJason A. Donenfeld2019-05-146-6/+12
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: don't verify scope as part of ip checkingJason A. Donenfeld2019-05-091-1/+5
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* conf: read presharedkey as a hexstring when converting to uapiSteven Honson2019-05-081-1/+1
| | | | | Signed-off-by: Steven Honson <steven@honson.id.au> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.