The example in the man page at some point changed:
- \fBPostUp = wg set %i private-key <(pass WireGuard/private-keys/%i)\fP
+ \fBPreUp = wg set %i private-key <(pass WireGuard/private-keys/%i)\fP
This is actually wrong because PreUp is followed by set_config(), which
calls `wg setconf`, which in turn deletes the private key from the
interface because it is missing from the configuration. Replacing this
with `wg addconf` is safe to do because the interface is newly created.
Suggested-by: Matthias Dressel <code@deadcode.eu>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
When Ubuntu systems upgrade from Debian's atrocious resolvconf to the
systemd-resolve symlink, they sometimes leave around
/etc/resolvconf/interface-order, which then winds up breaking the
detection and passing the bogus 'tun.' prefix to systemd's resolvconf,
resulting in failure. Work around this by only doing the 'tun.' prefix
hack if resolvconf isn't a symlink. This is ugly but so it goes.
Reported-by: Andrei Borzenkov <arvidjaar@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Otherwise removing a psk from a config file wouldn't reflect on the
runtime state.
Note that this could have been implemented more simply, by just setting
WGPEER_HAS_PRESHARED_KEY on all of the file's peers, since the psk slot
is zeroed by calloc in config.c, and this way ones with no set key will
be cleared. The downside is that this means every peer update will take
the handshake lock in the kernel, creating more work and possibly
contention:
if (preshared_key) {
down_write(&peer->handshake.lock);
memcpy(&peer->handshake.preshared_key, preshared_key,
NOISE_SYMMETRIC_KEY_LEN);
up_write(&peer->handshake.lock);
}
Avoid this by only setting it if there's a mismatch between the runtime
and the file. Computationally this shouldn't make much of a difference
because we can do it in the same iteration as the peer removal
detection.
Reported-by: Patrick Havelange <patrick.havelange_ext@softathome.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
By accident, this function was looking at the endpoint with the largest
MTU rather than the smallest one.
Reported-by: Ismael Bouya <ismael@bouya.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
libmnl doesn't check lengths, so do our own checking before copying the
interface name to the netlink buffer.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
This is probably more sensible, since there's no point in letting
traffic flow before the interface is configured.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
To make it easier for FreeBSD to import wg(8), dual license the core
files as MIT, so that they don't have any trouble.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Looks like the "is valid ifname" regex was copy and pasted from
wg-quick.bash instead of the "is valid IP" regex.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
If the route monitor doesn't attempt to write more to stdout, then this
leaves a process hanging around. Kill it explicitly. We also switch to
using exec in the process substitution, to reduce a bash process.
Closes: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=255286
Reported-by: Christos Chatzaras <chris@cretaforce.gr>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
We no longer need the arp hack, as these bugs have been fixed in the
FreeBSD kernel.
This partially reverts 090639ae90.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
FreeBSD's bash doesn't handle <(...) safely, creating a temporary file
instead of using /proc/self/fd/N like on Linux. Work around this by
using a simple pipeline with /dev/stdin.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
If the stream is not closed, then this winds up hanging forever. So
remove the trailing \n\n and check manually after.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
With alignment between the kernel and userspace, along with userspace
packages, we can now rely on the kernel in the future always having
wg(4).
This also simplifies the interface selection logic, and stores the
wg-quick interface name as the description.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
This reverts commit 26683f6c9a, which
means the old problem comes back. That's an issue. But waiting on
process substitutions is not available with commonly used bash versions:
# wg-quick up demo
[#] ip link add demo type wireguard
[#] wg setconf demo /dev/fd/63
/usr/bin/wg-quick: line 251: wait: pid 2955 is not a child of this shell
[#] ip link delete dev demo
This means we have to wait a few years before fixing this issue. IOW,
bash limitation; can't fix.
Reported-by: Theodore Mozzo <theodore.mozzo@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Android 11's ndc regresses even more, but it turns out that netd doesn't
need to track up/down state via direct invocation, so just set the
interface up by way of normal iproute2.
Reported-by: Harsh Shandilya <me@msfjarvis.dev>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Bash does not propagate error values, which is a bummer, but process
substitutions are a useful feature. Introduce a new idiom to deal with
this: either "; wait $!" after the line to propagate the error, or "||
true" to indicate explicitly that we don't care about the error.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
We also make these constant time, even though we're never distinguishing
between bits of a secret using them. From that perspective, though, this
is markedly better than the locale-specific table lookups in glibc, even
though base64 characters span two cache lines and valid private keys
must hit both.
Co-authored-by: Samuel Neves <sneves@dei.uc.pt>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Samuel Neves <sneves@dei.uc.pt>
If DNS= has an IP in it, treat it as a DNS server. If DNS= has a non-IP
in it, treat it as a DNS search domain.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Prior we only supported a blacklist, but actually a whitelist is an
easier algorithm because that's internally how netd considers it, so we
don't need to find range spans. This commit adds an IncludedApplications
key.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
These are generic helper functions we don't want to move into the actual
implementations, so that it's easy to keep parity with the kernel code.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
It turns out that the binary actually gets smaller if we simply inline
the very small parts of libmnl that we need. Since we wind up needing
the mnlg bits anyway, there's little benefit in linking to libmnl.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Now that WireGuard has been upstreamed and the repos split, we have to
look elsewhere for these headers.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
This comes up occasionally, so it may be useful to mention its
possibility in the man page. At least the Arch Linux and Ubuntu kernels
support dynamic debugging, so this advise will at least help somebody.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Different versions of netd have different limits on how many can be
passed at once.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reported-by: Alexey <zaranecc@bk.ru>
We previously included $(pwd) in the compile output pretty printer,
because it matched our parent out-of-tree module build. Since we're no
longer coupled to the module, we can return to a prettier scheme of just
using the object name.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Fixes: eb68ad07 ("Makefile: even prettier output")
Otherwise nft(8) has strange ideas of what a string is.
Suggested-by: RistiCore <RistiCore@mail.ee>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Jason A. Donenfeld
