From 224336aa077020c35d3feb8a534f92c814b232e9 Mon Sep 17 00:00:00 2001 From: "Jason A. Donenfeld" Date: Sat, 21 Nov 2020 15:45:08 +0100 Subject: tunnel: enable {Pre,Post}{Up,Down} scripts gated behind admin knob Signed-off-by: Jason A. Donenfeld --- tunnel/scriptrunner.go | 78 ++++++++++++++++++++++++++++++++++++++++++++++++++ tunnel/service.go | 35 ++++++++++++++++------ 2 files changed, 105 insertions(+), 8 deletions(-) create mode 100644 tunnel/scriptrunner.go (limited to 'tunnel') diff --git a/tunnel/scriptrunner.go b/tunnel/scriptrunner.go new file mode 100644 index 00000000..d34947db --- /dev/null +++ b/tunnel/scriptrunner.go @@ -0,0 +1,78 @@ +/* SPDX-License-Identifier: MIT + * + * Copyright (C) 2020 WireGuard LLC. All Rights Reserved. + */ + +package tunnel + +import ( + "bufio" + "fmt" + "log" + "os" + "path/filepath" + "strings" + "syscall" + + "golang.org/x/sys/windows" + + "golang.zx2c4.com/wireguard/windows/conf" +) + +func runScriptCommand(command, interfaceName string) error { + if len(command) == 0 { + return nil + } + if !conf.AdminBool("DangerousScriptExecution") { + log.Printf("Skipping execution of script, because dangerous script execution is safely disabled: %#q", command) + return nil + } + command = strings.ReplaceAll(command, "%i", interfaceName) + log.Printf("Executing: %#q", command) + comspec, _ := os.LookupEnv("COMSPEC") + if len(comspec) == 0 { + system32, err := windows.GetSystemDirectory() + if err != nil { + return err + } + comspec = filepath.Join(system32, "cmd.exe") + } + + devNull, err := os.OpenFile(os.DevNull, os.O_RDWR, 0) + if err != nil { + return err + } + defer devNull.Close() + reader, writer, err := os.Pipe() + if err != nil { + return err + } + process, err := os.StartProcess(comspec, nil /* CmdLine below */, &os.ProcAttr{ + Files: []*os.File{devNull, writer, writer}, + Sys: &syscall.SysProcAttr{ + HideWindow: true, + CmdLine: fmt.Sprintf("cmd /c %s", command), + }, + }) + writer.Close() + if err != nil { + reader.Close() + return err + } + go func() { + scanner := bufio.NewScanner(reader) + for scanner.Scan() { + log.Printf("cmd> %s", scanner.Text()) + } + }() + state, err := process.Wait() + reader.Close() + if err != nil { + return err + } + if state.ExitCode() == 0 { + return nil + } + log.Printf("Command error exit status: %d", state.ExitCode()) + return windows.ERROR_GENERIC_COMMAND_FAILED +} diff --git a/tunnel/service.go b/tunnel/service.go index 33b5c116..e07fe139 100644 --- a/tunnel/service.go +++ b/tunnel/service.go @@ -41,6 +41,7 @@ func (service *tunnelService) Execute(args []string, r <-chan svc.ChangeRequest, var uapi net.Listener var watcher *interfaceWatcher var nativeTun *tun.NativeTun + var config *conf.Config var err error serviceError := services.ErrorSuccess @@ -84,6 +85,9 @@ func (service *tunnelService) Execute(args []string, r <-chan svc.ChangeRequest, } }() + if logErr == nil && dev != nil && config != nil { + logErr = runScriptCommand(config.Interface.PreDown, config.Name) + } if watcher != nil { watcher.Destroy() } @@ -93,6 +97,9 @@ func (service *tunnelService) Execute(args []string, r <-chan svc.ChangeRequest, if dev != nil { dev.Close() } + if logErr == nil && dev != nil && config != nil { + _ = runScriptCommand(config.Interface.PostDown, config.Name) + } stopIt <- true log.Println("Shutting down") }() @@ -113,19 +120,19 @@ func (service *tunnelService) Execute(args []string, r <-chan svc.ChangeRequest, } }() - conf, err := conf.LoadFromPath(service.Path) + config, err = conf.LoadFromPath(service.Path) if err != nil { serviceError = services.ErrorLoadConfiguration return } - conf.DeduplicateNetworkEntries() + config.DeduplicateNetworkEntries() err = CopyConfigOwnerToIPCSecurityDescriptor(service.Path) if err != nil { serviceError = services.ErrorLoadConfiguration return } - logPrefix := fmt.Sprintf("[%s] ", conf.Name) + logPrefix := fmt.Sprintf("[%s] ", config.Name) log.SetPrefix(logPrefix) log.Println("Starting", version.UserAgent()) @@ -151,14 +158,14 @@ func (service *tunnelService) Execute(args []string, r <-chan svc.ChangeRequest, } log.Println("Resolving DNS names") - uapiConf, err := conf.ToUAPI() + uapiConf, err := config.ToUAPI() if err != nil { serviceError = services.ErrorDNSLookup return } log.Println("Creating Wintun interface") - wintun, err := tun.CreateTUNWithRequestedGUID(conf.Name, deterministicGUID(conf), 0) + wintun, err := tun.CreateTUNWithRequestedGUID(config.Name, deterministicGUID(config), 0) if err != nil { serviceError = services.ErrorCreateWintun return @@ -171,7 +178,13 @@ func (service *tunnelService) Execute(args []string, r <-chan svc.ChangeRequest, log.Printf("Using Wintun/%d.%d", (wintunVersion>>16)&0xffff, wintunVersion&0xffff) } - err = enableFirewall(conf, nativeTun) + err = runScriptCommand(config.Interface.PreUp, config.Name) + if err != nil { + serviceError = services.ErrorRunScript + return + } + + err = enableFirewall(config, nativeTun) if err != nil { serviceError = services.ErrorFirewall return @@ -190,7 +203,7 @@ func (service *tunnelService) Execute(args []string, r <-chan svc.ChangeRequest, dev = device.NewDevice(wintun, logger) log.Println("Setting interface configuration") - uapi, err = ipc.UAPIListen(conf.Name) + uapi, err = ipc.UAPIListen(config.Name) if err != nil { serviceError = services.ErrorUAPIListen return @@ -205,7 +218,7 @@ func (service *tunnelService) Execute(args []string, r <-chan svc.ChangeRequest, log.Println("Bringing peers up") dev.Up() - watcher.Configure(dev, conf, nativeTun) + watcher.Configure(dev, config, nativeTun) log.Println("Listening for UAPI requests") go func() { @@ -218,6 +231,12 @@ func (service *tunnelService) Execute(args []string, r <-chan svc.ChangeRequest, } }() + err = runScriptCommand(config.Interface.PostUp, config.Name) + if err != nil { + serviceError = services.ErrorRunScript + return + } + changes <- svc.Status{State: svc.Running, Accepts: svc.AcceptStop | svc.AcceptShutdown} log.Println("Startup complete") -- cgit v1.2.3-59-g8ed1b