aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/mksyscall.go (unfollow)
Commit message (Collapse)AuthorFilesLines
2019-05-08service: make the generated bindings do the type forcingJason A. Donenfeld2-64/+56
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-08service: local system's token is a bit more locked down than elevatedJason A. Donenfeld2-6/+7
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-08service: give process elevated security attributes plus logon session ID with minimal permissionsJason A. Donenfeld5-42/+311
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-08installer: silence LGHT1056 warningSimon Rozman1-0/+1
> warning LGHT1056 : The Property table contains a row with primary key(s) 'MsiHiddenProperties' which cannot be merged from the merge module '.deps\wintun-amd64.msm'. This is likely due to collision of rows with the same primary key(s) (but other different values in other columns) between the database and the merge module. The warning is caused by Wintun MSM and WireGuard MSI both using MsiHiddenProperties property. This property is used by WiX to hide internal data passed to deferred actions from being output to the log. Signed-off-by: Simon Rozman <simon@rozman.si>
2019-05-08installer: silence ICE61 warningSimon Rozman1-1/+3
> ICE61: This product should remove only older versions of itself. The Maximum version is not less than the current product. The warning is caused by <MajorUpgrade AllowSameVersionUpgrades="yes"... For the time being, this is our design choice. We're shipping WireGuard with three-field versions 0.0.x. AllowSameVersionUpgrades="yes" avoids manual configuration of update path in the brain-dead-two-field-version- comparison-only Group Policy, but requires that the MSI packages are added to GPO in correct order. Signed-off-by: Simon Rozman <simon@rozman.si>
2019-05-08firewall: cleanupJason A. Donenfeld6-58/+59
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-08firewall: implode recurring address definitionsOdd Stranne1-14/+15
Signed-off-by: Odd Stranne <odd@mullvad.net> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-08firewall: remove unused codeOdd Stranne8-296/+44
Signed-off-by: Odd Stranne <odd@mullvad.net> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-08firewall: add permitHyperV()Odd Stranne3-0/+108
Signed-off-by: Odd Stranne <odd@mullvad.net> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-08firewall: implement permitNdp()Odd Stranne2-4/+222
Signed-off-by: Odd Stranne <odd@mullvad.net> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-08ui: remove a few DPI hacksJason A. Donenfeld3-9/+5
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-07attacksurface: update with latest infoJason A. Donenfeld1-10/+2
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-07conf: only retry on no internet if system just bootedJason A. Donenfeld2-3/+11
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-07installer: bump MSI database version to 4.0Simon Rozman1-1/+1
This resolves ICE66 warning regarding MSI 4.0 columns added to Shortcut table by WiX. Besides, Windows 7 has MSI 5.0 out of the box. Signed-off-by: Simon Rozman <simon@rozman.si>
2019-05-07updater: use hsm key and check header matchJason A. Donenfeld2-6/+4
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-07service: delay restart for one secondJason A. Donenfeld2-1/+5
This prevents a thundering herd. Also, we can now use the restart manager in the MSI because our walk fork handles the right window messages. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-07ui: defer update popup until 3 seconds after app startJason A. Donenfeld2-3/+15
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-07ui: select first tunnel even when showing updates tabJason A. Donenfeld1-1/+4
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-07conf: retry DNS resoluion when no internet presentJason A. Donenfeld4-22/+103
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-07installer: delete config file with custom actionJason A. Donenfeld2-7/+20
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-07ringlogger: export R/O handle for UI processJason A. Donenfeld4-24/+35
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-07installer: fix tag styleJason A. Donenfeld1-1/+1
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-07ui: remove setfocus hackJason A. Donenfeld1-3/+0
It introduces weird other problems. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-07ui: set global state before main state in trayJason A. Donenfeld1-1/+1
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-07ui: move things out of iconproviderJason A. Donenfeld5-126/+60
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-07ui: confview should be more picky about which tunnelJason A. Donenfeld1-13/+20
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-07ui: scale icons according to DPIJason A. Donenfeld2-2/+2
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-06installer: simplify tmpfile cleanupSimon Rozman1-21/+18
Signed-off-by: Simon Rozman <simon@rozman.si>
2019-05-06updater: move into managerJason A. Donenfeld14-289/+562
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-05ui: do tray click action when popup clickedJason A. Donenfeld1-0/+3
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-05ui: use natural sorting orderJason A. Donenfeld5-9/+70
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-05ui: attach shortcuts to their windowsJason A. Donenfeld3-0/+8
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-05ui: use context menus for all shortcutsJason A. Donenfeld2-21/+107
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-05ui: fix weird scrolling behavior in editorJason A. Donenfeld1-0/+8
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-05ui: check for duplicate names alwaysJason A. Donenfeld1-13/+9
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-05ui: improve update logging and tray logicJason A. Donenfeld5-5/+19
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-05ui: syntax: implement trafic blocking semanticsJason A. Donenfeld7-293/+256
This is our "auto kill switch". Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-04ui: use more windows iconsJason A. Donenfeld3-33/+17
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-04ui: embolden update tray itemJason A. Donenfeld1-5/+12
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-04service: temporarily disable security attributesJason A. Donenfeld1-1/+11
This must be reverted before we release! See big source code comment. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-04ui: show custom connected and disconnected icons in balloonJason A. Donenfeld1-2/+4
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-04firewall: do not add unused permit rules when !restrictAllJason A. Donenfeld1-16/+18
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-04ui: specify default action in trayJason A. Donenfeld2-2/+4
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-03version: expose OsVersion for firewallJason A. Donenfeld2-26/+37
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-03firewall: DNS is TCP and UDPJason A. Donenfeld1-3/+22
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-03firewall: block dns before allowing localhostJason A. Donenfeld3-38/+31
This prevents DNS leaks from people who have a localhost resolver doing something funky. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-03ui: fix thundering herd problem in importing/deletingJason A. Donenfeld4-117/+53
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-03firewall: only use one listJason A. Donenfeld2-230/+22
Unless you use complicated rights veto rules, WFP's policy is that between sublayers, block always outweighs allow. It's easier, therefore, to simply weight a single sublayer correctly, with allow rules having heavier weight than block rules. This basically means that we have to be careful that DNS isn't a subset of some allow rule. One place where this would be a problem are the permitLan* rules, which we don't use anyway, and so this commit nukes them. Another place would be if somebody is using a localhost/loopback resolver for whatever reason. This is probably a "low risk" sort of thing, but we may want to fix this by ordering the dns block just in front of the loopback permit. The other place is in the wireguard.exe tunnel service itself, which does DNS lookups. Since right now we mostly enforce one-tunnel-at-a- time, this isn't really a problem. But later if we allow nested tunneling, it means that the DNS lookup in a second tunnel can potentially escape the DNS server of the first tunnel. We can address this problem later, perhaps with fancier security descriptors that we shuffle around depending on which state the tunnel is in. And on the bright side, this change allows people to run WireGuard over port 53 itself, which is generally a desirable thing. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-03firewall: since DNS is a blacklist, we have to exclude our own interfaceJason A. Donenfeld2-6/+18
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-03firewall: pass blob of security descriptor instead of raw, and give daclJason A. Donenfeld5-30/+33
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.