Commit Graph

72 Commits

Author SHA1 Message Date
Jason A. Donenfeld 16e20de722 wg-quick: linux: quote ifname for nft
Otherwise nft(8) has strange ideas of what a string is.

Suggested-by: RistiCore <RistiCore@mail.ee>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-12-28 18:35:41 +01:00
Jason A. Donenfeld 6262906e5c wg-quick: linux: use already configured addresses instead of in-memory
The ADDRESSES array might not have addresses added during PreUp. But
moreover, nft(8) and iptables(8) don't like ip addresses in the form
somev6prefix::someipv4suffix, such as fd00::1.2.3.4, while ip(8) can
handle it. So by adding these first and then asking for them back, we
always get normalized addresses suitable for nft(8) and iptables(8).

Reported-by: Silvan Nagl <mail@53c70r.de>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-12-17 14:18:09 +01:00
Jason A. Donenfeld 6fbfa0d7bb wg-quick: linux: try both iptables(8) and nft(8) on teardown
Daniel argues that technically a package manager could install nft(8)
after previously having started wg-quick(8) using iptables(8).

Suggested-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-12-12 17:24:04 +01:00
Jason A. Donenfeld 45417c5c0d wg-quick: linux: support older nft(8)
Older nft(8), such as that on Ubuntu, does not accept the - parameter to
the -f argument and doesn't accept symbolic priority names. So instead
use the canonical numeric priority forms and use <(echo) instead of -.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-12-12 12:24:05 +01:00
Josh Soref a863be0148 global: fix up spelling
Signed-off-by: Josh Soref <jsoref@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-12-12 12:24:05 +01:00
Jason A. Donenfeld 17c78d31c2 wg-quick: linux: add support for nft and prefer it
If nft(8) is installed, use it. These rules should be identical to the
iptables-restore(8) ones, with the advantage that cleanup is easy
because we use custom table names.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-12-12 12:24:05 +01:00
Jason A. Donenfeld bc8bf54185 wg-quick: linux: ignore save warnings for iptables-nft
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-12-06 16:51:05 +01:00
Jason A. Donenfeld 8d4e4f3a86 wg-quick: linux: suppress more warnings on weird kernels
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-12-06 16:22:18 +01:00
Jason A. Donenfeld 3928ebb87d wg-quick: linux: some iptables don't like empty lines
Reported-by: Kenneth R. Crudup <kenny@panix.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-12-05 18:33:18 +01:00
Jason A. Donenfeld 9eab3487cd wg-quick: linux: iptables-* -w is not widely supported
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-12-05 11:48:25 +01:00
Jason A. Donenfeld 207aeed010 wg-quick: linux: have remove_iptables return true
Reported-by: Thomas Sattler <sattler@med.uni-frankfurt.de>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-12-05 11:48:25 +01:00
Jason A. Donenfeld af69113e02 wg-quick: linux: ensure postdown hooks execute
Reported-by: Thomas Sattler <sattler@med.uni-frankfurt.de>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-12-05 11:48:25 +01:00
Jason A. Donenfeld a9abb21575 wg-quick: linux: suppress error when finding unused table
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-11-27 17:12:15 +01:00
Jason A. Donenfeld ebcf1ef8b1 wg-quick: linux: filter bogus injected packets and don't disable rpfilter
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-11-27 13:45:58 +01:00
Jason A. Donenfeld a59aa6c404 wg-quick: linux: only touch net.ipv4 for v4
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-11-26 11:33:33 +01:00
Jason A. Donenfeld cf7ec31d2d wg-quick: android: check for null in binder cleanup functions
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-10-16 14:23:27 +02:00
Nicolas Douma 792727cf64 wg-quick: android: use Binder for setting DNS on Android 10
Signed-off-by: Nicolas Douma <nicolas@serveur.io>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-10-12 16:49:52 +02:00
Ronan Pigott 4154476d89 wg-quick: linux: don't fail down when using systemd-resolved
systemd-resolved has a compatibility interface for use with resolvconf
scripts when resolvectl is called from a symlink from resolvconf.
However, when tearing down the interface, cmd_down calls del_if and then
unset_dns. In the case of systemd-resolved, deleting the interface also
removes the systemd-resolved entry and causes resolvconf -d to fail when
resolvconf really is a symlink to resolvectl. This causes `wg-quick
down` and 'wg-quick@.service' to exit with failure.

Instead we use the resolvconf '-f' flag to ignore non-existent
interfaces, supported by both openresolv and sd-resolved resolvconf.

Signed-off-by: Ronan Pigott <rpigott@berkeley.edu>
[zx2c4: moved -f argument to end to remain compatible with Debian's resolvconf]
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-08-27 20:29:17 -06:00
Ankur Kothari 5df58a945d wg-quick: openbsd: fix alternate routing table syntax
route(8) has always used the `-T` option to specify the
routing table; there is no `rdomain` option.

Signed-off-by: Ankur Kothari <ankur@lipidity.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-08-07 10:41:26 +02:00
Jason A. Donenfeld 6a5906608c wg-quick: android: refactor and add incoming allow rules
Suggested-by: Yağmur Oymak <yagmur.oymak@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-07-08 13:48:17 +02:00
Jason A. Donenfeld b30e74b595 wg-quick: darwin: support being called from launchd
This causes wg-quick up to wait for the monitor to exit before it exits,
so that launchd can correctly wait on it.

Reported-by: Cameron Palmer <cameron@promon.no>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-06-24 11:19:18 +02:00
Jason A. Donenfeld 604b5a9fa7 wg-quick: specify protocol to ip(8), because of inconsistencies
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-29 01:23:24 +02:00
Jason A. Donenfeld ce55f857ff wg-quick: look up existing routes properly
This was never really correct, and then 5.1 broke it entirely.

Reported-by: piraty1@inbox.ru
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-05-29 01:23:24 +02:00
Jason A. Donenfeld c2355e00aa wg-quick: make darwin and freebsd path search strict like linux
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-04-23 20:12:54 +09:00
Jason A. Donenfeld 090639ae90 wg-quick: freebsd: workaround SIOCGIFSTATUS race in FreeBSD kernel
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-04-23 20:12:54 +09:00
Luis Ressel cdb687cc0b wg-quick: add 'strip' subcommand
`wg-quick strip` prints the config file to stdout after stripping it of
all wg-quick-specific options.

This enables tricks such as `wg addconf $DEV <(wg-quick strip $DEV)`.

Signed-off-by: Luis Ressel <aranea@aixah.de>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-03-23 12:49:48 +01:00
Jason A. Donenfeld 7c20ac5ce2 wg-quick: freebsd: export TMPDIR when restoring and don't make empty
Otherwise mktemp doesn't see it, and if it's empty we wind up in /.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-03-18 14:50:36 -06:00
Jason A. Donenfeld 2c6cabd73d wg-quick: freebsd: rebreak interface loopback, while fixing localhost
The commit 7c833642 ("wg-quick: freebsd: allow loopback to work") was
supposed to make things better, but actually it just started sending
legitimate localhost traffic over the WireGuard interface, which is
really quite bad.

This reverts commit 7c833642dfa342218602ab18e7091e86408d2982.

Reported-by: Matt Smith <matt.xtaz@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-02-28 21:25:49 +01:00
Jason A. Donenfeld 3f7a31faea wg-quick: freebsd: allow loopback to work
FreeBSD adds a route for point-to-point destination addresses. We don't
really want to specify any destination address, but unfortunately we
have to. Before we tried to cheat by giving our own address as the
destination, but this had the unfortunate effect of preventing
loopback from working on our local ip address. We work around this with
yet another kludge: we set the destination address to 127.0.0.1. Since
127.0.0.1 is already assigned to an interface, this has the same effect
of not specifying a destination address, and therefore we accomplish the
intended behavior.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-01-24 03:28:54 +01:00
Jason A. Donenfeld b8e89f3a09 global: update copyright
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2019-01-07 19:26:10 -05:00
Aaron Jones 48a31572f1 wg-quick: bring interface up while setting MTU
This avoids another ip(8) invocation for little benefit.
Confirmed to work with iproute2 and busybox.

Signed-off-by: Aaron Jones <aaronmdjones@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2018-12-18 14:41:27 +01:00
Jason A. Donenfeld 7e106d3a4c wg-quick: android: do not choke on empty allowed-ips
Reported-by: Samuel Holland <samuel@sholland.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2018-11-11 22:15:01 -05:00
Jason A. Donenfeld 4410c87c39 wg-quick: wait for interface to disappear on freebsd
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2018-10-13 01:55:31 +02:00
Jason A. Donenfeld cef7ac9ef9 global: put SPDX identifier on its own line
The kernel has very specific rules correlating file type with comment
type, and also SPDX identifiers can't be merged with other comments.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2018-09-20 19:41:22 +02:00
Jason A. Donenfeld b2ec7892c8 wg-quick: check correct variable for route deduplication
Reported-by: John Sager <john@sager.me.uk>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2018-08-21 15:42:17 -07:00
Jason A. Donenfeld ffcc09358e wg-quick: darwin: prefer system paths for tools
The only things wg-quick(8) needs from Homebrew are bash(1) and wg(8).
Other than that, it's explicitly coded against the native system
utilities. Since wg-quick(8) and bash(1) are invoked in auto_su by their
full absolute path (via $SELF and $BASH, respectively), we can simply
set the $PATH to be prefixed by the default system binary paths. This
way, if users install tools that conflict with system tools -- such as
GNU coreutils -- we won't accidently call those.

Reported-by: Deirdre Connolly <durumcrustulum@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2018-08-12 00:28:28 -07:00
Jason A. Donenfeld 544d965d5f wg-quick: android: remove compat code
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2018-07-24 18:15:17 +02:00
Jason A. Donenfeld f621f36800 wg-quick: android: allow package to be overridden
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2018-07-24 18:15:17 +02:00
Jason A. Donenfeld 4349005f4e wg-quick: allow link local default gateway
It's unclear why it was like this in the first place, but it apparently
broke certain IPv6 setups.

Reported-by: Jonas Blahut <j@die-blahuts.de>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2018-07-16 17:27:00 +02:00
Jason A. Donenfeld 4367cd0d3d wg-quick: android: support excluding applications
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2018-07-05 19:26:13 +02:00
Jason A. Donenfeld b3b6d97db8 wg-quick: android: prevent outgoing handshake packets from being dropped
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2018-06-25 16:15:35 +02:00
Jason A. Donenfeld 02733c681b wg-quick: android: don't forget to free compiled regexes
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2018-06-17 19:36:37 +02:00
Jason A. Donenfeld 3bbacaaf14 wg-quick: android: disable roaming to v6 networks when v4 is specified
This works around an unfortunate bug in 464XLAT transitions.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2018-06-17 19:36:37 +02:00
Jason A. Donenfeld 8c4cf156d5 wg-quick: android: change name of intent
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2018-06-04 07:05:58 +02:00
Jason A. Donenfeld 2044bb026d wg-quick: android: delay setting users until end
`ndc users add` eventually invokes SOCK_DESTROY on user sockets, causing
them to reconnect. By delaying this until after routes are set, we
ensure that the sockets reconnect using the tunnel, rather than the old
route.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2018-05-31 16:38:08 +02:00
Jason A. Donenfeld 206e8f08e2 wg-quick: darwin: set DNS servers after delay on route change
This works around a race condition in macOS's network daemons, while
also adding one in the form of possibly calling kill -ALRM on a stale
PID; unfortunately bash can't wait from a trap.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2018-05-31 01:24:51 +02:00
Jason A. Donenfeld d532074ef5 wg-quick: freebsd: configure as p2p link
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2018-05-27 05:24:07 +02:00
Jason A. Donenfeld df6c69e98c wg-quick: darwin: add multiple IP addresses
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2018-05-27 05:22:55 +02:00
Jason A. Donenfeld 19ce650fb6 wg-quick: determine IPs when saving interface
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2018-05-27 02:42:31 +02:00
Jason A. Donenfeld c99e6beecb wg-quick: freebsd: work around security vulnerabilities in bash
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2018-05-24 02:24:02 +02:00