Commit Graph

473 Commits

Author SHA1 Message Date
Baptiste Fouques 87fbf37c8a Merge remote-tracking branch 'origin/master' 2023-07-18 16:28:10 +02:00
Jason A. Donenfeld 729242a114 man: set private key in PreUp rather than PostUp
This is probably more sensible, since there's no point in letting
traffic flow before the interface is configured.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2023-05-18 16:39:49 +02:00
Daniel Gröber e6888dd74e wg-quick: run PreUp hook after creating interface
Currently PreUp hooks run before the interface is created. This is
problematic for moving the device into a Linux VRFs as this will
currently clear all assigned IPv6 addressess (possibly a bug), so if we
did this in PostUp (i.e. before add_addr) we'll have to manually re-add
all assigned addresses. This is obviously less than ideal.

Instead create the wg device just before running PreUp hooks. We apply
this to all platforms for consistency.

Test case:

    $ ip link add vrf-test type vrf table 1234
    $ ip link add wg-test type wireguard
    $ ip addr add dev wg-test 192.168.42.42/24
    $ ip addr add dev wg-test fe80::/64

    $ ip -br addr show wg-test
    wg-test          DOWN           192.168.42.42/24 fe80::/64

    $ ip link set dev wg-test master vrf-test

    $ ip -br addr show wg-test
    wg-test          DOWN           192.168.42.42/32

Signed-off-by: Daniel Gröber <dxld@darkboxed.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2023-05-18 16:38:34 +02:00
Dmitry Selivanov b4f6b4f229 show: fix show all endpoints output
Currently "wg show all endpoints" prints interface name only once
while other "show all" commands print it on each line as man says.

Signed-off-by: Dmitry Selivanov <dseliv@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2023-02-08 13:47:47 -03:00
Kyle Evans 139aac59a5 ipc: freebsd: NULL out some freed memory in kernel_set_device()
The `err` path in kernel_set_device() will attempt to free() allocated
nvl_peers, but these two cases meant we could end up attempting a use
after free or a double free, as we rely on nvlist_destroy(NULL) being
a NOP as well as free(NULL).

FreeBSD-Coverity:	1500421
Signed-off-by: Kyle Evans <kevans@FreeBSD.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2022-11-03 19:57:26 +01:00
Kyle Evans dbf49a7d17 ipc: freebsd: avoid leaking memory in kernel_get_device()
Primarily, front-load validation of an allowed-ip entry to before we
allocate `aip`, so that we don't need to free() it if we end up skipping
this entry.  Assert that `aip` is NULL after we exit the loop, as we
should have transfered ownership to the `peer` or freed it in all paths
through the allowed-ip loop.

FreeBSD-Coverity:	1500405
Signed-off-by: Kyle Evans <kevans@FreeBSD.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2022-11-03 19:57:21 +01:00
Jason A. Donenfeld ca2e89ff21 show: apply const to right part of pointer
Without this -Wcast-qual complains:

show.c:30:43: warning: cast from 'const void *' to 'const void **' drops const qualifier [-Wcast-qual]
        const struct wgpeer *a = *(const void **)first, *b = *(const void **)second;
                                                 ^
show.c:30:71: warning: cast from 'const void *' to 'const void **' drops const qualifier [-Wcast-qual]
        const struct wgpeer *a = *(const void **)first, *b = *(const void **)second;

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2022-10-31 15:39:30 +01:00
Kyle Evans 7b2ae7aa2f ipc: freebsd: move if_wg path to reflect new in-tree location
When we re-added if_wg to the tree, we changed directories in dev to
strip the if_ (we don't use this prefix for other interfaces'
directories). Adjust it here as a convenience, so that when we import
wireguard-tools to FreeBSD the path will just work as-is with our usual
build.

Signed-off-by: Kyle Evans <kevans@FreeBSD.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2022-10-29 03:51:47 +02:00
Tom Yan 71799a8f6d wg-quick: linux: prevent traffic from momentarily leaking into tunnel
The wireguard route table ip rule should stay as a no-op until the
`suppress_prefixlength 0 table main` rule is in effect. Therefore, add
the wireguard default route to its route table after the latter rule is
added.

Signed-off-by: Tom Yan <tom.ty89@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2022-06-17 13:53:43 +02:00
Jason A. Donenfeld 5b9c1d6d74 global: dual license core files as MIT for FreeBSD
To make it easier for FreeBSD to import wg(8), dual license the core
files as MIT, so that they don't have any trouble.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2022-06-10 19:35:38 +02:00
Jason A. Donenfeld c0b68d2eaf wg-quick: android: use right regex for host-vs-IP
Looks like the "is valid ifname" regex was copy and pasted from
wg-quick.bash instead of the "is valid IP" regex.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2022-05-10 12:40:49 +02:00
Baptiste Fouques 7efa6e75c1 Merge remote-tracking branch 'origin/master' 2022-01-19 14:47:42 +01:00
Baptiste Fouques bf8e5c968f Add Net Namespace support 2022-01-19 14:46:12 +01:00
Jason A. Donenfeld 1fd9570839 reresolve-dns: use $EPOCHSECONDS instead of $(date +%s)
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2022-01-04 13:07:49 +01:00
Mikael Magnusson b906ecb614 embeddable-wg-library: add named wg_endpoint union
Define wg_endpoint as a named union to allow users of the emeddable
library to use the type in function arguments, variables etc.

Signed-off-by: Mikael Magnusson <mikma@users.sourceforge.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-10-22 13:26:04 -06:00
Jason A. Donenfeld 1ee37b8e48 ipc: use more clever PnP enumerator
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-10-06 17:18:40 -06:00
Jason A. Donenfeld 3ba6527130 version: bump
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-09-14 00:43:31 +02:00
Matt Dunwoodie 84ac6add7e wg-quick: openbsd: set DNS with resolvd(8)
OpenBSD has introduced a new daemon named resolvd(8) to manage
resolv.conf. This creates problems with the old "horrible way" of
completely replacing resolv.conf. Resolvd will attempt to merge manual
changes with DNS servers discovered through dhcpleased(8) and slaacd(8).
Unfortunately, resolvd puts any manual modifications at the end of
resolv.conf, meaning that the wg-quick name servers will be queried
last.

The process for handling multiple name servers (at least with libc) is
to try a name server, and if the query times out, try the next, until
out of name servers, then repeat trying all name servers until a maximum
number of retries are performed. The name servers are queried in the
order listed in resolv.conf and the timeout is 5 seconds.

With this patch, we ensure the wg-quick name server is first in
resolv.conf (as route creates the name server with "static" priority),
but cannot ensure it is exclusive. Therfore, it may be possible that
queries are leaked to other name servers if the wg-quick name server
doesn't respond within 5 seconds.

We have another problem however, and that is if resolvd detects unwind
is running, it will set 127.0.0.1 as the only name server in
resolv.conf. unwind does not have deterministic name server selection in
the default configuration.  This means, all a user would need to do to
inadvertently cause persistent query leaks would be to run `rcctl enable
unwind`.

There are warnings added when these situations may occur.

The next step is to add an exclusive flag and search to route and
resolvd.

Reported-by: Matthieu Herrb <matthieu@herrb.eu>
Signed-off-by: Matt Dunwoodie <ncon@noconroy.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-09-14 00:40:51 +02:00
Jason A. Donenfeld af260d529e wg-quick: android: adjust for android 12
https://android-review.googlesource.com/c/platform/system/netd/+/1671532

Reported-by: engstk <eng.stk@sapo.pt>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-09-09 23:36:29 +02:00
Laura Hausmann b3aafa6103 wg-quick: darwin: account for "link#XX" gateways
On macOS, under specific configurations, the `netstat -nr -f inet` and
`netstat -nr -f inet6` outputs break gateway collection.

Signed-off-by: Laura Hausmann <laura@hausmann.dev>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-08-12 22:03:04 +02:00
Jason A. Donenfeld 52597c3515 ipc: windows: use devpkey instead of nci for name
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-07-31 01:01:53 +02:00
Jason A. Donenfeld fabe24df3a ipc: windows: don't display disabled adapters
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-07-20 13:24:18 +02:00
Jason A. Donenfeld c70bea7a31 ipc: remove windows elevation
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-07-20 13:24:18 +02:00
Jason A. Donenfeld d58df7ed10 ipc: cache windows lookups to avoid O(n^2) with nested lookups
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-07-20 13:24:18 +02:00
Jason A. Donenfeld f65c82456d ipc: add wireguard-nt support
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-07-20 13:24:18 +02:00
Hangbin Liu 9a7e4364b1 contrib/launchd: fix xml syntax error
The current plist xml gets error "DOCTYPE improperly terminated" with xml
syntax checker[1]. The example in apple doc[2] also doesn't have semicolon
at the end of DOCTYPE line.

[1] https://www.w3schools.com/xml/xml_validator.asp
[2] https://opensource.apple.com/source/launchd/launchd-257/launchd/doc/HOWTO.html

Fixes: b30e74b595 ("wg-quick: darwin: support being called from launchd")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-05-17 11:43:06 +02:00
Jason A. Donenfeld 197689a3cd man: mention BSD debugging
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-05-06 12:54:29 +02:00
Jason A. Donenfeld ecb1ea29d7 version: bump
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-04-24 16:43:19 -04:00
Jason A. Donenfeld 96e42feb3f wg-quick: kill route monitor when loop terminates
If the route monitor doesn't attempt to write more to stdout, then this
leaves a process hanging around. Kill it explicitly. We also switch to
using exec in the process substitution, to reduce a bash process.

Closes: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=255286
Reported-by: Christos Chatzaras <chris@cretaforce.gr>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-04-20 21:36:19 -06:00
Jason A. Donenfeld 3124afbea3 wg-quick: freebsd: use ifconfig for determining if interface is up
We no longer need the arp hack, as these bugs have been fixed in the
FreeBSD kernel.

This partially reverts 090639ae90.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-04-18 20:40:02 -06:00
Jason A. Donenfeld 163cef8b90 wg-quick: freebsd: do not assume point-to-point interface flag
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-03-23 12:29:33 -06:00
Jason A. Donenfeld a43f0b634e wg-quick: freebsd: check for socket using -S, not -f
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-03-21 10:15:53 -06:00
Jason A. Donenfeld 622408872f version: bump
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-03-15 08:04:02 -06:00
Jason A. Donenfeld 9c811e0f2d wg-quick: freebsd: avoid writing private keys to /tmp
FreeBSD's bash doesn't handle <(...) safely, creating a temporary file
instead of using /proc/self/fd/N like on Linux. Work around this by
using a simple pipeline with /dev/stdin.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-03-13 21:20:19 -07:00
Jason A. Donenfeld 4e4867dc95 ipc: uniformly ignore preshared keys that are zero
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-03-11 15:35:15 -07:00
Jason A. Donenfeld f51349c52b ipc: freebsd: add initial FreeBSD support
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-03-11 15:02:07 -07:00
Jason A. Donenfeld 576e40056d wg-quick: freebsd: add kernel support
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-03-11 09:05:14 -07:00
Kyle Evans 396b85280a wireguard-tools: drag in headers for prototypes
ipc.c and terminal.c provide definitions for prototypes in their
respective headers, drag those in.

Signed-off-by: Kyle Evans <kevans@FreeBSD.org>
2021-03-10 17:35:20 -07:00
Kyle Evans 88bc64366e wireguard-tools: const correctness
Fixes much of the noise from a FreeBSD WARNS=6 build of wg(8)

Signed-off-by: Kyle Evans <kevans@FreeBSD.org>
2021-03-10 17:35:18 -07:00
Florian Eckert 957702af94 Makefile: fix version indicator
If we execute `wg --version` we get a different version string that does
not match with the version string in the openwrt makefile.

Current version string:
`wireguard-tools vreboot-13159-gac5caa2718 -https://git.zx2c4.com/wireguard-tools/`

Corrected versions string:
`wireguard-tools v1.0.20200319 -https://git.zx2c4.com/wireguard-tools/`

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-03-05 14:37:11 -07:00
Jason A. Donenfeld 6d3b876492 version: bump
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-02-23 19:32:18 +01:00
Jason A. Donenfeld e8fa0f662f ipc: read trailing responses after set operation
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-01-27 15:22:20 +01:00
Jason A. Donenfeld f97e81c094 man: LOG_LEVEL variables changed nae
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-01-26 23:02:37 +01:00
Jason A. Donenfeld 457f96b65e ipc: do not use fscanf with trailing \n
If the stream is not closed, then this winds up hanging forever. So
remove the trailing \n\n and check manually after.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2021-01-25 21:22:36 +01:00
Jason A. Donenfeld 66ed611bd0 sticky-sockets: do not use SO_REUSEADDR
This makes little sense for unicast UDP sockets.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-12-18 23:40:15 +01:00
Jason A. Donenfeld 7e506135f7 completion: add help and syncconf completions
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-12-13 22:29:09 +01:00
Jason A. Donenfeld 5e24780d4c wincompat: do not elevate by default
Elevation makes it detach from the console, which means the results are
hidden.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-12-11 14:17:27 +01:00
Jason A. Donenfeld 843a256697 wincompat: add resource and manifest and enable lto
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-12-11 13:59:14 +01:00
Jason A. Donenfeld 66714e2c47 wincompat: recent mingw has inet_ntop/inet_pton
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-11-09 11:46:01 +01:00
Jason A. Donenfeld b637db4692 embeddable-wg-library: sync latest from netlink.h
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2020-10-29 12:44:47 +01:00