aboutsummaryrefslogtreecommitdiffstatshomepage
path: root/tunnel (follow)
Commit message (Collapse)AuthorAgeFilesLines
* mod: bumpJason A. Donenfeld2021-01-241-4/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* winipcfg: cleanup netsh error reportingJason A. Donenfeld2020-11-271-7/+6
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* firewall: add allow rule for tunnel service process even when no blocking is requiredJason A. Donenfeld2020-11-232-38/+42
| | | | | | | This is essential for allowing incoming connections. Reported-by: /u/Julien_Madagascar on Reddit Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: set %WIREGUARD_INTERFACE_NAME% instead of expanding %iJason A. Donenfeld2020-11-221-2/+1
| | | | | | | | While this diverges from wg-quick(8), it's also much more Windows-friendly, considering that % is the prefix for expanding environment variables in cmd.exe. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: update headersJason A. Donenfeld2020-11-2231-31/+31
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: enable {Pre,Post}{Up,Down} scripts gated behind admin knobJason A. Donenfeld2020-11-222-8/+105
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: only enable DNS blocking for 0/0 configsJason A. Donenfeld2020-11-223-39/+28
| | | | | | This lets people use split tunnel DNS for the more common case. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: mask self before giving routes to windowsJason A. Donenfeld2020-11-181-0/+1
| | | | | | Otherwise Windows complains. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: do not return a nil error when adding routes failsJason A. Donenfeld2020-11-161-1/+1
| | | | | Reported-by: Michael Zhou <mzhou@cse.unsw.edu.au> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: go generateSimon Rozman2020-11-132-170/+130
| | | | Signed-off-by: Simon Rozman <simon@rozman.si>
* global: switch to using %w instead of %v for ErrorfJason A. Donenfeld2020-11-134-63/+63
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* manager: adopt new Wintun APISimon Rozman2020-11-131-2/+2
| | | | Signed-off-by: Simon Rozman <simon@rozman.si>
* firewall, winipcfg: add arm and arm64 build tagsJason A. Donenfeld2020-11-136-0/+12
| | | | | | | | The structs stay the same size for the respective 32bit and 64bit platforms, so split things into _32 and _64. Signed-off-by: Simon Rozman <simon@rozman.si> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* winipcfg, embeddable-dll-service, wintrust: fix Go 1.15 checkptr violationsBrad Fitzpatrick2020-10-212-35/+38
| | | | | | | | | | Avoids "converted pointer straddles allocation" failures at runtime when building binaries in race mode with Go 1.15, which enables checkptr: https://golang.org/doc/go1.15#windows Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> [Jason: Note Go 1.16/1.17 todo item.] Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel/winipcfg: set SysProcAttr.HideWindow when running netsh.shBrad Fitzpatrick2020-10-041-0/+3
| | | | | | | | Prevents cmd.exe window flashes when running binaries in elevated interactive contexts for debugging. Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: use conn.BindSocketToInterface typeDavid Crawshaw2020-07-141-3/+7
| | | | | Signed-off-by: David Crawshaw <crawshaw@tailscale.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* winipcfg: add missing error case to dns domain settingJason A. Donenfeld2020-06-091-1/+3
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: unset dns search if none is specifiedJason A. Donenfeld2020-06-071-7/+9
| | | | | | | This doesn't get automatically cleared in the same way that nameservers do. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: support setting dns domain suffixJason A. Donenfeld2020-06-052-0/+36
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* firewall: remove unused ExemptBuiltinAdministratorsJason A. Donenfeld2020-04-071-17/+0
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* updater: allow updating from the command lineJason A. Donenfeld2020-04-051-1/+1
| | | | | | | | | The administrator user may run `wireguard.exe /update`, which will check for updates and install it if available. A log file may be written using `wireguard.exe /update path\to\log\file.txt`. Requested-by: Elliot Saba <staticfloat@gmail.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: calculate the actual route metric by summing interface and route metricPhilipp Czerner2020-03-291-2/+8
| | | | | | | | | | | | | | | | I had some issues setting up WireGuard behind another VPN. Curiously, it bound the physical interface instead of the other VPN, which was the default route. According to MSDN "the actual route metric used to compute the route preference is the summation of interface metric specified in the Metric member of the MIB_IPINTERFACE_ROW structure and the route metric offset specified in this member" (documentation for MIB_IPFORWARD_ROW2), but the code did not seem to consider this. After I changed the calculation, I got the expected behaviour. Signed-off-by: Philipp Czerner <suyjuris.gi@nicze.de> Link: https://docs.microsoft.com/en-us/windows/win32/api/netioapi/ns-netioapi-mib_ipforward_row2 [zx2c4: fixed up commit message, removed semicolon] Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: deduplicate addresses from configJason A. Donenfeld2020-01-241-0/+1
| | | | | | | Windows doesn't like it when passing these off to its config. Reported-by: Jonathan Tooker <jonathan.tooker@netprotect.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: use real on-link routesJason A. Donenfeld2019-12-161-21/+10
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* firewall: add escape hatch for same-process adminsJason A. Donenfeld2019-12-111-0/+17
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* firewall: fix urlsJason A. Donenfeld2019-12-113-9/+9
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: add wintun ordered unit testJason A. Donenfeld2019-12-111-0/+202
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: stop burst timer if we exceed 2 secondsJason A. Donenfeld2019-10-311-0/+1
| | | | | Reported-by: Odd Stranne <odd@mullvad.net> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: blackhole sockets when there's going to be a sure routing loopJason A. Donenfeld2019-10-212-9/+49
| | | | | | | | This prevents against common mishaps when changing from a wifi network that supports v6 to one that doesn't. Reported-by: Jonathan Tooker <jonathan.tooker@netprotect.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* mod: bumpJason A. Donenfeld2019-10-171-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* Revert "tunnel: check for endpoint interfaces and media connection state"Jason A. Donenfeld2019-10-091-3/+1
| | | | | | | | This reverts commit cf6f599a4a65e89929ffc12982346c8e9012552c. It broke people's setups. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: print wintun version in debug logJason A. Donenfeld2019-10-091-0/+6
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* mod: bump versionsJason A. Donenfeld2019-10-042-2/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: check for endpoint interfaces and media connection stateJason A. Donenfeld2019-10-011-1/+3
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: smooth bursts from windows network notifiersJason A. Donenfeld2019-10-011-5/+25
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: windows does not always add/remove routes with up/down interfaceJason A. Donenfeld2019-10-013-25/+45
| | | | | | | | | | | | | | | | On Linux, we're used to routes being added after an interface is up, and routes being removed as a consequence of an interface going down. On Windows, this isn't always the case, at least not from the perspective of the route notifiers. In order to work around this and make a multi-interface model coherent, we search for a new default route not only whenever the routing table changes but also whenever any interface link parameters change, such as up/down. The practical consequence is that now WireGuard connects properly when wifi is disconnected and then reconnected. Reported-by: Nenad Kozul <me@nenadkozul.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* winipcfg: make Unregister wait for callbacks to completeJason A. Donenfeld2019-09-274-31/+61
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* winipcfg: port more granular locking from route change to othersJason A. Donenfeld2019-09-272-22/+36
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* winipcfg: ensure we're passing copy to go routinesJason A. Donenfeld2019-09-273-3/+6
| | | | | | | The windows-allocated one gets freed. Reported-by: Odd Stranne <odd@mullvad.net> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* mod: bump versionsJason A. Donenfeld2019-09-272-2/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* global: use SECURITY_DESCRIPTOR apis from x/sys/windowsJason A. Donenfeld2019-09-237-99/+62
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* firewall: remove unused wrappersJason A. Donenfeld2019-09-232-32/+0
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: device->interfaceJason A. Donenfeld2019-09-131-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* winipcfg: launch callbacks in goroutines to prevent deadlockJason A. Donenfeld2019-09-013-3/+3
| | | | | | | | | | | | ret: setupLock interfaceChangeLock trigger: interfaceChangeLock setupLock Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* winipcfg: use upstream helper function for elevation testJason A. Donenfeld2019-08-301-16/+9
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* manager: fix nits in adapter cleanup logic and also handle ‘%s’ uniformlyJason A. Donenfeld2019-08-301-1/+1
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: allow disabling deterministic GUIDs for external consumersJason A. Donenfeld2019-08-301-21/+31
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* tunnel: do not query real interface nameJason A. Donenfeld2019-08-261-7/+0
| | | | | | | | | | | | We want to enforce the relation between the socket name and the service name, especially since the wintun adapter name might get a 1 or 2 appended depending on weird Nci duplication detection. So we just stick with the configuration-given name throughout. Also, the user can change the adapter name at runtime, which is all the more reason why maybe we shouldn't care about it so much. Reported-by: Nenad Kozul <me@nenadkozul.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* firewall: use RtlGetNtVersionNumbers for kernel compat checksJason A. Donenfeld2019-08-261-3/+2
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
* version: use upstream RtlGetVersionJason A. Donenfeld2019-08-241-7/+3
| | | | Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.