contrib/embeddable-wg-library/wireguard.h

@@ -40,19 +40,17 @@ enum wg_peer_flags {
 	WGPEER_HAS_PERSISTENT_KEEPALIVE_INTERVAL = 1U << 4
 };
 
-typedef union wg_endpoint {
-	struct sockaddr addr;
-	struct sockaddr_in addr4;
-	struct sockaddr_in6 addr6;
-} wg_endpoint;
-
 typedef struct wg_peer {
 	enum wg_peer_flags flags;
 
 	wg_key public_key;
 	wg_key preshared_key;
 
-	wg_endpoint endpoint;
+	union {
+		struct sockaddr addr;
+		struct sockaddr_in addr4;
+		struct sockaddr_in6 addr6;
+	} endpoint;
 
 	struct timespec64 last_handshake_time;
 	uint64_t rx_bytes, tx_bytes;

contrib/reresolve-dns/reresolve-dns.sh

@@ -16,7 +16,7 @@ INTERFACE="${BASH_REMATCH[1]}"
 process_peer() {
 	[[ $PEER_SECTION -ne 1 || -z $PUBLIC_KEY || -z $ENDPOINT ]] && return 0
 	[[ $(wg show "$INTERFACE" latest-handshakes) =~ ${PUBLIC_KEY//+/\\+}\	([0-9]+) ]] || return 0
-	(( ($EPOCHSECONDS - ${BASH_REMATCH[1]}) > 135 )) || return 0
+	(( ($(date +%s) - ${BASH_REMATCH[1]}) > 135 )) || return 0
 	wg set "$INTERFACE" peer "$PUBLIC_KEY" endpoint "$ENDPOINT"
 	reset_peer_section
 }

src/Makefile

@@ -62,7 +62,7 @@ ifeq ($(PLATFORM),windows)
 CC := x86_64-w64-mingw32-clang
 WINDRES := $(shell $(CC) $(CFLAGS) -print-prog-name=windres 2>/dev/null)
 CFLAGS += -Iwincompat/include -include wincompat/compat.h -DWINVER=0x0601 -D_WIN32_WINNT=0x0601 -flto
-LDLIBS += -lws2_32 -lsetupapi -lole32 -ladvapi32 -lntdll -Lwincompat
+LDLIBS += -lws2_32 -lsetupapi -lole32 -ladvapi32 -Lwincompat
 LDFLAGS += -flto -Wl,--dynamicbase -Wl,--nxcompat -Wl,--tsaware -mconsole
 LDFLAGS += -Wl,--major-os-version=6 -Wl,--minor-os-version=1 -Wl,--major-subsystem-version=6 -Wl,--minor-subsystem-version=1
 # The use of -Wl,/delayload: here implies we're using llvm-mingw

src/config.c

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0 OR MIT
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  */

src/config.h

@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL-2.0 OR MIT */
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  */

src/containers.h

@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL-2.0 OR MIT */
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  */

src/ctype.h

@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL-2.0 OR MIT */
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  *

src/curve25519.c

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0 OR MIT
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (C) 2018-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  */

src/curve25519.h

@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL-2.0 OR MIT */
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  */

src/encoding.c

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0 OR MIT
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  *

src/encoding.h

@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL-2.0 OR MIT */
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  */

src/genkey.c

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0 OR MIT
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  */

src/ipc-freebsd.h

@@ -4,10 +4,9 @@
  *
  */
 
-#include <assert.h>
 #include <sys/nv.h>
 #include <sys/sockio.h>
-#include <dev/wg/if_wg.h>
+#include <dev/if_wg/if_wg.h>
 
 #define IPC_SUPPORTS_KERNEL_INTERFACE
 
@@ -119,7 +118,7 @@ static int kernel_get_device(struct wgdevice **device, const char *ifname)
 		goto skip_peers;
 	for (i = 0; i < peer_count; ++i) {
 		struct wgpeer *peer;
-		struct wgallowedip *aip = NULL;
+		struct wgallowedip *aip;
 		const nvlist_t *const *nvl_aips;
 		size_t aip_count, j;
 
@@ -170,13 +169,11 @@ static int kernel_get_device(struct wgdevice **device, const char *ifname)
 		if (!aip_count || !nvl_aips)
 			goto skip_allowed_ips;
 		for (j = 0; j < aip_count; ++j) {
-			if (!nvlist_exists_number(nvl_aips[j], "cidr"))
-				continue;
-			if (!nvlist_exists_binary(nvl_aips[j], "ipv4") && !nvlist_exists_binary(nvl_aips[j], "ipv6"))
-				continue;
 			aip = calloc(1, sizeof(*aip));
 			if (!aip)
 				goto err_allowed_ips;
+			if (!nvlist_exists_number(nvl_aips[j], "cidr"))
+				continue;
 			number = nvlist_get_number(nvl_aips[j], "cidr");
 			if (nvlist_exists_binary(nvl_aips[j], "ipv4")) {
 				binary = nvlist_get_binary(nvl_aips[j], "ipv4", &size);
@@ -187,8 +184,7 @@ static int kernel_get_device(struct wgdevice **device, const char *ifname)
 				aip->family = AF_INET;
 				aip->cidr = number;
 				memcpy(&aip->ip4, binary, sizeof(aip->ip4));
-			} else {
+			} else if (nvlist_exists_binary(nvl_aips[j], "ipv6")) {
-				assert(nvlist_exists_binary(nvl_aips[j], "ipv6"));
 				binary = nvlist_get_binary(nvl_aips[j], "ipv6", &size);
 				if (!binary || number > 128) {
 					ret = EINVAL;
@@ -197,14 +193,14 @@ static int kernel_get_device(struct wgdevice **device, const char *ifname)
 				aip->family = AF_INET6;
 				aip->cidr = number;
 				memcpy(&aip->ip6, binary, sizeof(aip->ip6));
-			}
+			} else
+				continue;
 
 			if (!peer->first_allowedip)
 				peer->first_allowedip = aip;
 			else
 				peer->last_allowedip->next_allowedip = aip;
 			peer->last_allowedip = aip;
-			aip = NULL;
 			continue;
 
 		err_allowed_ips:
@@ -213,9 +209,6 @@ static int kernel_get_device(struct wgdevice **device, const char *ifname)
 			free(aip);
 			goto err_peer;
 		}
-
-		/* Nothing leaked, hopefully -- ownership transferred or aip freed. */
-		assert(aip == NULL);
 	skip_allowed_ips:
 		if (!dev->first_peer)
 			dev->first_peer = peer;
@@ -329,7 +322,6 @@ static int kernel_set_device(struct wgdevice *dev)
 			nvlist_destroy(nvl_aips[j]);
 		free(nvl_aips);
 		nvlist_destroy(nvl_peers[i]);
-		nvl_peers[i] = NULL;
 		goto err;
 	}
 	if (i) {
@@ -337,11 +329,9 @@ static int kernel_set_device(struct wgdevice *dev)
 		for (i = 0; i < peer_count; ++i)
 			nvlist_destroy(nvl_peers[i]);
 		free(nvl_peers);
-		nvl_peers = NULL;
 	}
 	wgd.wgd_data = nvlist_pack(nvl_device, &wgd.wgd_size);
 	nvlist_destroy(nvl_device);
-	nvl_device = NULL;
 	if (!wgd.wgd_data)
 		goto err;
 	s = get_dgram_socket();

src/ipc-linux.h

@@ -479,12 +479,6 @@ static int kernel_get_device(struct wgdevice **device, const char *iface)
 	struct nlmsghdr *nlh;
 	struct mnlg_socket *nlg;
 
-	/* libmnl doesn't check the buffer size, so enforce that before using. */
-	if (strlen(iface) >= IFNAMSIZ) {
-		errno = ENAMETOOLONG;
-		return -ENAMETOOLONG;
-	}
-
 try_again:
 	ret = 0;
 	*device = calloc(1, sizeof(**device));

src/ipc-windows.h

@@ -19,11 +19,10 @@
 static bool have_cached_kernel_interfaces;
 static struct hashtable cached_kernel_interfaces;
 static const DEVPROPKEY devpkey_name = DEVPKEY_WG_NAME;
-extern bool is_win7;
 
 static int kernel_get_wireguard_interfaces(struct string_list *list)
 {
-	HDEVINFO dev_info = SetupDiGetClassDevsExW(&GUID_DEVCLASS_NET, is_win7 ? L"ROOT\\WIREGUARD" : L"SWD\\WireGuard", NULL, DIGCF_PRESENT, NULL, NULL, NULL);
+	HDEVINFO dev_info = SetupDiGetClassDevsExW(&GUID_DEVCLASS_NET, NULL, NULL, DIGCF_PRESENT, NULL, NULL, NULL);
 	bool will_have_cached_kernel_interfaces = true;
 
 	if (dev_info == INVALID_HANDLE_VALUE) {
@@ -32,8 +31,9 @@ static int kernel_get_wireguard_interfaces(struct string_list *list)
 	}
 
 	for (DWORD i = 0;; ++i) {
-		DWORD buf_len;
+		bool found = false;
-		WCHAR adapter_name[MAX_ADAPTER_NAME];
+		DWORD buf_len = 0, value_type;
+		WCHAR *buf = NULL, adapter_name[MAX_ADAPTER_NAME];
 		SP_DEVINFO_DATA dev_info_data = { .cbSize = sizeof(SP_DEVINFO_DATA) };
 		DEVPROPTYPE prop_type;
 		ULONG status, problem_code;
@@ -46,6 +46,31 @@ static int kernel_get_wireguard_interfaces(struct string_list *list)
 			continue;
 		}
 
+		while (!SetupDiGetDeviceRegistryPropertyW(dev_info, &dev_info_data, SPDRP_HARDWAREID, &value_type, (BYTE *)buf, buf_len, &buf_len)) {
+			free(buf);
+			buf = NULL;
+			if (GetLastError() != ERROR_INSUFFICIENT_BUFFER)
+				break;
+			buf = malloc(buf_len);
+			if (!buf)
+				break;
+		}
+
+		if (!buf || value_type != REG_MULTI_SZ || buf_len < sizeof(*buf) * 2 || buf[buf_len / sizeof(*buf) - 1] || buf[buf_len / sizeof(*buf) - 2]) {
+			free(buf);
+			continue;
+		}
+
+		for (WCHAR *item = buf; *item; item += wcslen(item) + 1) {
+			if (!_wcsicmp(item, L"wireguard")) {
+				found = true;
+				break;
+			}
+		}
+		free(buf);
+		if (!found)
+			continue;
+
 		if (!SetupDiGetDevicePropertyW(dev_info, &dev_info_data, &devpkey_name,
 					       &prop_type, (PBYTE)adapter_name,
 					       sizeof(adapter_name), NULL, 0) ||
@@ -130,14 +155,14 @@ err_hash:
 		}
 	}
 
-	dev_info = SetupDiGetClassDevsExW(&GUID_DEVCLASS_NET, is_win7 ? L"ROOT\\WIREGUARD" : L"SWD\\WireGuard", NULL, DIGCF_PRESENT, NULL, NULL, NULL);
+	dev_info = SetupDiGetClassDevsExW(&GUID_DEVCLASS_NET, NULL, NULL, DIGCF_PRESENT, NULL, NULL, NULL);
 	if (dev_info == INVALID_HANDLE_VALUE)
 		return NULL;
 
 	for (DWORD i = 0; !interfaces; ++i) {
-		bool found;
+		bool found = false;
-		DWORD buf_len;
+		DWORD buf_len = 0, value_type;
-		WCHAR *buf, adapter_name[MAX_ADAPTER_NAME];
+		WCHAR *buf = NULL, adapter_name[MAX_ADAPTER_NAME];
 		SP_DEVINFO_DATA dev_info_data = { .cbSize = sizeof(SP_DEVINFO_DATA) };
 		DEVPROPTYPE prop_type;
 		char *interface_name;
@@ -148,6 +173,31 @@ err_hash:
 			continue;
 		}
 
+		while (!SetupDiGetDeviceRegistryPropertyW(dev_info, &dev_info_data, SPDRP_HARDWAREID, &value_type, (BYTE *)buf, buf_len, &buf_len)) {
+			free(buf);
+			buf = NULL;
+			if (GetLastError() != ERROR_INSUFFICIENT_BUFFER)
+				break;
+			buf = malloc(buf_len);
+			if (!buf)
+				break;
+		}
+
+		if (!buf || value_type != REG_MULTI_SZ || buf_len < sizeof(*buf) * 2 || buf[buf_len / sizeof(*buf) - 1] || buf[buf_len / sizeof(*buf) - 2]) {
+			free(buf);
+			continue;
+		}
+
+		for (WCHAR *item = buf; *item; item += wcslen(item) + 1) {
+			if (!_wcsicmp(item, L"wireguard")) {
+				found = true;
+				break;
+			}
+		}
+		free(buf);
+		if (!found)
+			continue;
+
 		if (!SetupDiGetDevicePropertyW(dev_info, &dev_info_data, &devpkey_name,
 					       &prop_type, (PBYTE)adapter_name,
 					       sizeof(adapter_name), NULL, 0) ||

src/ipc.c

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0 OR MIT
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  */

src/ipc.h

@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL-2.0 OR MIT */
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  */

src/man/wg-quick.8

@@ -168,7 +168,7 @@ sockets, which bypass Netfilter.) When IPv6 is in use, additional similar lines
 Or, perhaps it is desirable to store private keys in encrypted form, such as through use of
 .BR pass (1):
 
-    \fBPreUp = wg set %i private-key <(pass WireGuard/private-keys/%i)\fP
+    \fBPostUp = wg set %i private-key <(pass WireGuard/private-keys/%i)\fP
 .br
 
 For use on a server, the following is a more complicated example involving multiple peers:

src/pubkey.c

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0 OR MIT
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  */

src/set.c

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0 OR MIT
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  */

src/setconf.c

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0 OR MIT
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  */

src/show.c

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0 OR MIT
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  */
@@ -27,7 +27,7 @@
 static int peer_cmp(const void *first, const void *second)
 {
 	time_t diff;
-	const struct wgpeer *a = *(void *const *)first, *b = *(void *const *)second;
+	const struct wgpeer *a = *(const void **)first, *b = *(const void **)second;
 
 	if (!a->last_handshake_time.tv_sec && !a->last_handshake_time.tv_nsec && (b->last_handshake_time.tv_sec || b->last_handshake_time.tv_nsec))
 		return 1;
@@ -312,9 +312,9 @@ static bool ugly_print(struct wgdevice *device, const char *param, bool with_int
 		else
 			printf("off\n");
 	} else if (!strcmp(param, "endpoints")) {
+		if (with_interface)
+			printf("%s\t", device->name);
 		for_each_wgpeer(device, peer) {
-			if (with_interface)
-				printf("%s\t", device->name);
 			printf("%s\t", key(peer->public_key));
 			if (peer->endpoint.addr.sa_family == AF_INET || peer->endpoint.addr.sa_family == AF_INET6)
 				printf("%s\n", endpoint(&peer->endpoint.addr));

src/showconf.c

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0 OR MIT
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  */

src/subcommands.h

@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL-2.0 OR MIT */
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  */

src/terminal.c

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0 OR MIT
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  */

src/terminal.h

@@ -1,4 +1,4 @@
-/* SPDX-License-Identifier: GPL-2.0 OR MIT */
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  */

src/wg-quick/android.c

@@ -855,7 +855,7 @@ static void set_dnses(unsigned int netid, const char *dnses)
 	if (!len)
 		return;
 
-	xregcomp(&regex_ipnothost, "(^[0-9.]+$)|(^.*:.*$)", REG_EXTENDED | REG_NOSUB);
+	xregcomp(&regex_ipnothost, "^[a-zA-Z0-9_=+.-]{1,15}$", REG_EXTENDED | REG_NOSUB);
 	for (char *dns = strtok(mutable, ", \t\n"); dns; dns = strtok(NULL, ", \t\n")) {
 		if (strchr(dns, '\'') || strchr(dns, '\\'))
 			continue;

src/wg-quick/darwin.bash

@@ -452,8 +452,8 @@ cmd_up() {
 	local i
 	get_real_interface && die "\`$INTERFACE' already exists as \`$REAL_INTERFACE'"
 	trap 'del_if; del_routes; exit' INT TERM EXIT
-	add_if
 	execute_hooks "${PRE_UP[@]}"
+	add_if
 	set_config
 	for i in "${ADDRESSES[@]}"; do
 		add_addr "$i"

src/wg-quick/freebsd.bash

@@ -420,8 +420,8 @@ cmd_up() {
 	local i
 	[[ -z $(ifconfig "$INTERFACE" 2>/dev/null) ]] || die "\`$INTERFACE' already exists"
 	trap 'del_if; del_routes; clean_temp; exit' INT TERM EXIT
-	add_if
 	execute_hooks "${PRE_UP[@]}"
+	add_if
 	set_config
 	for i in "${ADDRESSES[@]}"; do
 		add_addr "$i"

src/wg-quick/linux.bash

@@ -220,9 +220,9 @@ add_default() {
 	fi
 	local proto=-4 iptables=iptables pf=ip
 	[[ $1 == *:* ]] && proto=-6 iptables=ip6tables pf=ip6
+	cmd ip $proto route add "$1" dev "$INTERFACE" table $table
 	cmd ip $proto rule add not fwmark $table table $table
 	cmd ip $proto rule add table main suppress_prefixlength 0
-	cmd ip $proto route add "$1" dev "$INTERFACE" table $table
 
 	local marker="-m comment --comment \"wg-quick(8) rule for $INTERFACE\"" restore=$'*raw\n' nftable="wg-quick-$INTERFACE" nftcmd 
 	printf -v nftcmd '%sadd table %s %s\n' "$nftcmd" "$pf" "$nftable"
@@ -327,8 +327,8 @@ cmd_up() {
 	local i
 	[[ -z $(ip link show dev "$INTERFACE" 2>/dev/null) ]] || die "\`$INTERFACE' already exists"
 	trap 'del_if; exit' INT TERM EXIT
-	add_if
 	execute_hooks "${PRE_UP[@]}"
+	add_if
 	set_config
 	for i in "${ADDRESSES[@]}"; do
 		add_addr "$i"

src/wg-quick/openbsd.bash

@@ -417,8 +417,8 @@ cmd_up() {
 	local i
 	get_real_interface && die "\`$INTERFACE' already exists as \`$REAL_INTERFACE'"
 	trap 'del_if; del_routes; exit' INT TERM EXIT
-	add_if
 	execute_hooks "${PRE_UP[@]}"
+	add_if
 	set_config
 	for i in "${ADDRESSES[@]}"; do
 		add_addr "$i"

src/wg.c

@@ -1,4 +1,4 @@
-// SPDX-License-Identifier: GPL-2.0 OR MIT
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
  */

src/wincompat/init.c

@@ -10,22 +10,16 @@
 #define ENABLE_VIRTUAL_TERMINAL_PROCESSING 0x4
 #endif
 
-extern void NTAPI RtlGetNtVersionNumbers(DWORD *major, DWORD *minor, DWORD *build);
-bool is_win7 = false;
-
 __attribute__((constructor)) static void init(void)
 {
 	char *colormode;
-	DWORD console_mode, major, minor;
+	DWORD console_mode;
 	HANDLE stdout_handle;
 	WSADATA wsaData;
 
 	if (!SetDllDirectoryA("") || !SetDefaultDllDirectories(LOAD_LIBRARY_SEARCH_SYSTEM32))
 		abort();
 
-	RtlGetNtVersionNumbers(&major, &minor, NULL);
-	is_win7 = (major == 6 && minor <= 1) || major < 6;
-
 	WSAStartup(MAKEWORD(2, 2), &wsaData);
 
 	stdout_handle = GetStdHandle(STD_OUTPUT_HANDLE); // We don't close this.