From f65c82456d4acdf96f3c0ce769bcecb61550f367 Mon Sep 17 00:00:00 2001 From: "Jason A. Donenfeld" Date: Wed, 23 Jun 2021 15:43:39 +0200 Subject: [PATCH] ipc: add wireguard-nt support Signed-off-by: Jason A. Donenfeld --- .gitignore | 3 + src/Makefile | 18 +- src/ipc-openbsd.h | 7 +- src/ipc-uapi-windows.h | 21 ++ src/ipc-windows.h | 541 +++++++++++++++++++++++++++++++++++ src/ipc.c | 2 + src/uapi/windows/wireguard.h | 74 +++++ src/wincompat/include/nci.h | 30 ++ src/wincompat/init.c | 4 + src/wincompat/loader.c | 20 ++ 10 files changed, 711 insertions(+), 9 deletions(-) create mode 100644 src/ipc-windows.h create mode 100644 src/uapi/windows/wireguard.h create mode 100644 src/wincompat/include/nci.h create mode 100644 src/wincompat/loader.c diff --git a/.gitignore b/.gitignore index 0f03c4d..cb0ae8d 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,9 @@ cscope.out *.o *.d +*.lib +*.dll +*.gch *.dwo src/wg src/wg.exe diff --git a/src/Makefile b/src/Makefile index 7b8969a..931f261 100644 --- a/src/Makefile +++ b/src/Makefile @@ -59,12 +59,19 @@ ifeq ($(PLATFORM),haiku) LDLIBS += -lnetwork -lbsd endif ifeq ($(PLATFORM),windows) -CC := x86_64-w64-mingw32-gcc -WINDRES := x86_64-w64-mingw32-windres +CC := x86_64-w64-mingw32-clang +WINDRES := $(shell $(CC) $(CFLAGS) -print-prog-name=windres 2>/dev/null) CFLAGS += -Iwincompat/include -include wincompat/compat.h -DWINVER=0x0601 -D_WIN32_WINNT=0x0601 -flto -LDLIBS += -lws2_32 -flto +LDLIBS += -lws2_32 -lsetupapi -lole32 -ladvapi32 -lnci -Lwincompat +LDFLAGS += -flto -Wl,--dynamicbase -Wl,--nxcompat -Wl,--tsaware -mconsole +LDFLAGS += -Wl,--major-os-version=6 -Wl,--minor-os-version=1 -Wl,--major-subsystem-version=6 -Wl,--minor-subsystem-version=1 +# The use of -Wl,/delayload: here implies we're using llvm-mingw +LDFLAGS += -Wl,/delayload:ws2_32.dll -Wl,/delayload:setupapi.dll -Wl,/delayload:ole32.dll -Wl,/delayload:advapi32.dll -Wl,/delayload:nci.dll VERSION := $(patsubst "%",%,$(filter "%",$(file < version.h))) -wg: wincompat/libc.o wincompat/init.o wincompat/resources.o +wg: wincompat/libc.o wincompat/init.o wincompat/loader.o wincompat/resources.o wincompat/nci.lib +wincompat/nci.lib: wincompat/include/nci.h + -@$(if $(BUILT_IN_RM),$(BUILT_IN_RM),$(RM)) $@ + $(LINK.o) -DGENERATE_LIB -shared -xc $< -o wincompat/nci.dll -Wl,--out-implib,$@ wincompat/resources.o: wincompat/resources.rc wincompat/manifest.xml $(WINDRES) -DVERSION_STR=$(VERSION) -O coff -c 65001 -i $< -o $@ endif @@ -78,12 +85,13 @@ COMPILE.c = @echo " CC $@"; COMPILE.c += $(BUILT_IN_COMPILE.c) BUILT_IN_RM := $(RM) RM := @a() { echo " CLEAN $$@"; $(BUILT_IN_RM) "$$@"; }; a +WINDRES := @a() { echo " WINDRES $${@: -1}"; $(WINDRES) "$$@"; }; a endif wg: $(sort $(patsubst %.c,%.o,$(wildcard *.c))) clean: - $(RM) wg *.o *.d + $(RM) wg *.o *.d $(wildcard wincompat/*.o wincompat/*.lib wincompat/*.dll) install: wg @install -v -d "$(DESTDIR)$(BINDIR)" && install -v -m 0755 wg "$(DESTDIR)$(BINDIR)/wg" diff --git a/src/ipc-openbsd.h b/src/ipc-openbsd.h index c529d9a..03fbdb5 100644 --- a/src/ipc-openbsd.h +++ b/src/ipc-openbsd.h @@ -255,13 +255,12 @@ static int kernel_set_device(struct wgdevice *dev) wg_aip->a_af = aip->family; wg_aip->a_cidr = aip->cidr; - if (aip->family == AF_INET) { + if (aip->family == AF_INET) memcpy(&wg_aip->a_ipv4, &aip->ip4, sizeof(wg_aip->a_ipv4)); - } else if (aip->family == AF_INET6) { + else if (aip->family == AF_INET6) memcpy(&wg_aip->a_ipv6, &aip->ip6, sizeof(wg_aip->a_ipv6)); - } else { + else continue; - } ++aip_count; ++wg_aip; } diff --git a/src/ipc-uapi-windows.h b/src/ipc-uapi-windows.h index 86fab07..1aa08c4 100644 --- a/src/ipc-uapi-windows.h +++ b/src/ipc-uapi-windows.h @@ -113,6 +113,27 @@ err: return NULL; } +static bool userspace_has_wireguard_interface(const char *iface) +{ + char fname[MAX_PATH]; + WIN32_FIND_DATA find_data; + HANDLE find_handle; + bool ret = false; + + snprintf(fname, sizeof(fname), "ProtectedPrefix\\Administrators\\WireGuard\\%s", iface); + find_handle = FindFirstFile("\\\\.\\pipe\\*", &find_data); + if (find_handle == INVALID_HANDLE_VALUE) + return -GetLastError(); + do { + if (!strcmp(fname, find_data.cFileName)) { + ret = true; + break; + } + } while (FindNextFile(find_handle, &find_data)); + FindClose(find_handle); + return ret; +} + static int userspace_get_wireguard_interfaces(struct string_list *list) { static const char prefix[] = "ProtectedPrefix\\Administrators\\WireGuard\\"; diff --git a/src/ipc-windows.h b/src/ipc-windows.h new file mode 100644 index 0000000..14270c9 --- /dev/null +++ b/src/ipc-windows.h @@ -0,0 +1,541 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (C) 2015-2021 Jason A. Donenfeld . All Rights Reserved. + */ + +#include "containers.h" +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#define IPC_SUPPORTS_KERNEL_INTERFACE + +static int kernel_get_wireguard_interfaces(struct string_list *list) +{ + HDEVINFO dev_info = SetupDiGetClassDevsExW(&GUID_DEVCLASS_NET, NULL, NULL, DIGCF_PRESENT, NULL, NULL, NULL); + + if (dev_info == INVALID_HANDLE_VALUE) { + errno = EACCES; + return -errno; + } + + for (DWORD i = 0;; ++i) { + bool found = false; + DWORD buf_len = 0, value_type, ret; + WCHAR *buf = NULL, adapter_name[MAX_ADAPTER_NAME]; + SP_DEVINFO_DATA dev_info_data = { .cbSize = sizeof(SP_DEVINFO_DATA) }; + HKEY key; + GUID instance_id; + char *interface_name; + + if (!SetupDiEnumDeviceInfo(dev_info, i, &dev_info_data)) { + if (GetLastError() == ERROR_NO_MORE_ITEMS) + break; + continue; + } + + while (!SetupDiGetDeviceRegistryPropertyW(dev_info, &dev_info_data, SPDRP_HARDWAREID, &value_type, (BYTE *)buf, buf_len, &buf_len)) { + free(buf); + if (GetLastError() != ERROR_INSUFFICIENT_BUFFER) + goto skip; + buf = malloc(buf_len); + if (!buf) + goto skip; + } + + if (!buf || value_type != REG_MULTI_SZ || buf_len < sizeof(*buf) * 2 || buf[buf_len / sizeof(*buf) - 1] || buf[buf_len / sizeof(*buf) - 2]) { + free(buf); + continue; + } + + for (WCHAR *item = buf; *item; item += wcslen(item) + 1) { + if (!_wcsicmp(item, L"wireguard")) { + found = true; + break; + } + } + free(buf); + if (!found) + continue; + buf = NULL; + buf_len = 0; + + key = SetupDiOpenDevRegKey(dev_info, &dev_info_data, DICS_FLAG_GLOBAL, 0, DIREG_DRV, KEY_QUERY_VALUE); + if (key == INVALID_HANDLE_VALUE) + continue; + buf_len = 39 * sizeof(*buf); + buf = malloc(buf_len); + if (!buf) + continue; + while ((ret = RegQueryValueExW(key, L"NetCfgInstanceId", NULL, &value_type, (BYTE *)buf, &buf_len)) != ERROR_SUCCESS) { + free(buf); + if (ret != ERROR_MORE_DATA) + goto cleanup_key; + buf = malloc(buf_len); + if (!buf) + goto cleanup_key; + } + if (!buf || value_type != REG_SZ || buf_len < sizeof(*buf) || buf[buf_len / sizeof(*buf) - 1]) + goto cleanup_buf; + if (FAILED(CLSIDFromString(buf, &instance_id))) + goto cleanup_buf; + + if (NciGetConnectionName(&instance_id, adapter_name, sizeof(adapter_name), NULL) != ERROR_SUCCESS) + goto cleanup_buf; + adapter_name[_countof(adapter_name) - 1] = L'0'; + if (!adapter_name[0]) + goto cleanup_buf; + + buf_len = WideCharToMultiByte(CP_UTF8, 0, adapter_name, -1, NULL, 0, NULL, NULL); + if (!buf_len) + goto cleanup_buf; + interface_name = malloc(buf_len); + if (!interface_name) + goto cleanup_buf; + buf_len = WideCharToMultiByte(CP_UTF8, 0, adapter_name, -1, interface_name, buf_len, NULL, NULL); + if (!buf_len) { + free(interface_name); + goto cleanup_buf; + } + + string_list_add(list, interface_name); + free(interface_name); +cleanup_buf: + free(buf); +cleanup_key: + RegCloseKey(key); +skip:; + } + SetupDiDestroyDeviceInfoList(dev_info); + return 0; +} + +static HANDLE kernel_interface_handle(const char *iface) +{ + HDEVINFO dev_info = SetupDiGetClassDevsExW(&GUID_DEVCLASS_NET, NULL, NULL, DIGCF_PRESENT, NULL, NULL, NULL); + WCHAR *interfaces = NULL; + HANDLE handle; + + if (dev_info == INVALID_HANDLE_VALUE) + return NULL; + + for (DWORD i = 0; !interfaces; ++i) { + bool found = false; + DWORD buf_len = 0, value_type, ret; + WCHAR *buf = NULL, adapter_name[MAX_ADAPTER_NAME]; + SP_DEVINFO_DATA dev_info_data = { .cbSize = sizeof(SP_DEVINFO_DATA) }; + HKEY key; + GUID instance_id; + char *interface_name; + + if (!SetupDiEnumDeviceInfo(dev_info, i, &dev_info_data)) { + if (GetLastError() == ERROR_NO_MORE_ITEMS) + break; + continue; + } + + while (!SetupDiGetDeviceRegistryPropertyW(dev_info, &dev_info_data, SPDRP_HARDWAREID, &value_type, (BYTE *)buf, buf_len, &buf_len)) { + free(buf); + if (GetLastError() != ERROR_INSUFFICIENT_BUFFER) + goto skip; + buf = malloc(buf_len); + if (!buf) + goto skip; + } + + if (!buf || value_type != REG_MULTI_SZ || buf_len < sizeof(*buf) * 2 || buf[buf_len / sizeof(*buf) - 1] || buf[buf_len / sizeof(*buf) - 2]) { + free(buf); + continue; + } + + for (WCHAR *item = buf; *item; item += wcslen(item) + 1) { + if (!_wcsicmp(item, L"wireguard")) { + found = true; + break; + } + } + free(buf); + if (!found) + continue; + found = false; + buf = NULL; + buf_len = 0; + + key = SetupDiOpenDevRegKey(dev_info, &dev_info_data, DICS_FLAG_GLOBAL, 0, DIREG_DRV, KEY_QUERY_VALUE); + if (key == INVALID_HANDLE_VALUE) + continue; + buf_len = 39 * sizeof(*buf); + buf = malloc(buf_len); + if (!buf) + continue; + while ((ret = RegQueryValueExW(key, L"NetCfgInstanceId", NULL, &value_type, (BYTE *)buf, &buf_len)) != ERROR_SUCCESS) { + free(buf); + if (ret != ERROR_MORE_DATA) + goto cleanup_key; + buf = malloc(buf_len); + if (!buf) + goto cleanup_key; + } + if (!buf || value_type != REG_SZ || buf_len < sizeof(*buf) || buf[buf_len / sizeof(*buf) - 1]) + goto cleanup_buf; + if (FAILED(CLSIDFromString(buf, &instance_id))) + goto cleanup_buf; + + if (NciGetConnectionName(&instance_id, adapter_name, sizeof(adapter_name), NULL) != ERROR_SUCCESS) + goto cleanup_buf; + adapter_name[_countof(adapter_name) - 1] = L'0'; + if (!adapter_name[0]) + goto cleanup_buf; + + buf_len = WideCharToMultiByte(CP_UTF8, 0, adapter_name, -1, NULL, 0, NULL, NULL); + if (!buf_len) + goto cleanup_buf; + interface_name = malloc(buf_len); + if (!interface_name) + goto cleanup_buf; + buf_len = WideCharToMultiByte(CP_UTF8, 0, adapter_name, -1, interface_name, buf_len, NULL, NULL); + if (!buf_len) { + free(interface_name); + goto cleanup_buf; + } + found = !strcmp(interface_name, iface); + free(interface_name); +cleanup_buf: + free(buf); +cleanup_key: + RegCloseKey(key); + if (!found) + continue; + + if (SetupDiGetDeviceInstanceIdW(dev_info, &dev_info_data, NULL, 0, &buf_len) || GetLastError() != ERROR_INSUFFICIENT_BUFFER) + continue; + buf = calloc(sizeof(*buf), buf_len); + if (!buf) + continue; + if (!SetupDiGetDeviceInstanceIdW(dev_info, &dev_info_data, buf, buf_len, &buf_len)) + goto cleanup_instance_id; + if (CM_Get_Device_Interface_List_SizeW( + &buf_len, (GUID *)&GUID_DEVINTERFACE_NET, (DEVINSTID_W)buf, + CM_GET_DEVICE_INTERFACE_LIST_PRESENT) != CR_SUCCESS) + goto cleanup_instance_id; + interfaces = calloc(buf_len, sizeof(*interfaces)); + if (!interfaces) + goto cleanup_instance_id; + if (CM_Get_Device_Interface_ListW( + (GUID *)&GUID_DEVINTERFACE_NET, (DEVINSTID_W)buf, interfaces, buf_len, + CM_GET_DEVICE_INTERFACE_LIST_PRESENT) != CR_SUCCESS || !interfaces[0]) { + free(interfaces); + interfaces = NULL; + goto cleanup_instance_id; + } +cleanup_instance_id: + free(buf); +skip:; + } + SetupDiDestroyDeviceInfoList(dev_info); + if (!interfaces) { + errno = ENOENT; + return NULL; + } + handle = CreateFileW(interfaces, GENERIC_READ | GENERIC_WRITE, + FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, + OPEN_EXISTING, 0, NULL); + free(interfaces); + if (handle == INVALID_HANDLE_VALUE) { + errno = EACCES; + return NULL; + } + return handle; +} + +static BOOL elevated_ioctl(HANDLE handle, DWORD code, void *in_buf, DWORD in_buf_len, void *out_buf, DWORD out_buf_len, DWORD *bytes_returned) +{ + HANDLE thread_token, process_snapshot, winlogon_process, winlogon_token, duplicated_token; + PROCESSENTRY32 entry = { .dwSize = sizeof(PROCESSENTRY32) }; + TOKEN_PRIVILEGES privileges = { + .PrivilegeCount = 1, + .Privileges = {{ .Attributes = SE_PRIVILEGE_ENABLED }} + }; + SID expected_sid; + DWORD bytes = sizeof(expected_sid); + BOOL ret; + + if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &privileges.Privileges[0].Luid)) + return FALSE; + if (!CreateWellKnownSid(WinLocalSystemSid, NULL, &expected_sid, &bytes)) + return FALSE; + + process_snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); + if (process_snapshot == INVALID_HANDLE_VALUE) + return FALSE; + for (ret = Process32First(process_snapshot, &entry); ret; ret = Process32Next(process_snapshot, &entry)) { + if (strcasecmp(entry.szExeFile, "winlogon.exe")) + continue; + + RevertToSelf(); + if (!ImpersonateSelf(SecurityImpersonation)) + continue; + if (!OpenThreadToken(GetCurrentThread(), TOKEN_ADJUST_PRIVILEGES, FALSE, &thread_token)) + continue; + if (!AdjustTokenPrivileges(thread_token, FALSE, &privileges, sizeof(privileges), NULL, NULL)) { + CloseHandle(thread_token); + continue; + } + CloseHandle(thread_token); + + winlogon_process = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, entry.th32ProcessID); + if (!winlogon_process) + continue; + if (!OpenProcessToken(winlogon_process, TOKEN_IMPERSONATE | TOKEN_DUPLICATE, &winlogon_token)) + continue; + CloseHandle(winlogon_process); + if (!DuplicateToken(winlogon_token, SecurityImpersonation, &duplicated_token)) { + RevertToSelf(); + continue; + } + CloseHandle(winlogon_token); + if (!SetThreadToken(NULL, duplicated_token)) { + CloseHandle(duplicated_token); + continue; + } + CloseHandle(duplicated_token); + ret = DeviceIoControl(handle, code, in_buf, in_buf_len, out_buf, out_buf_len, bytes_returned, NULL); + break; + } + + RevertToSelf(); + CloseHandle(process_snapshot); + return ret; +} + +static int kernel_get_device(struct wgdevice **device, const char *iface) +{ + WG_IOCTL_INTERFACE *wg_iface; + WG_IOCTL_PEER *wg_peer; + WG_IOCTL_ALLOWED_IP *wg_aip; + void *buf = NULL; + DWORD buf_len = 0; + HANDLE handle = kernel_interface_handle(iface); + struct wgdevice *dev; + struct wgpeer *peer; + struct wgallowedip *aip; + int ret; + + *device = NULL; + + if (!handle) + return -errno; + + while (!elevated_ioctl(handle, WG_IOCTL_GET, NULL, 0, buf, buf_len, &buf_len)) { + free(buf); + if (GetLastError() != ERROR_MORE_DATA) { + errno = EIO; + return -errno; + } + buf = malloc(buf_len); + if (!buf) + return -errno; + } + + wg_iface = (WG_IOCTL_INTERFACE *)buf; + dev = calloc(1, sizeof(*dev)); + if (!dev) + goto out; + strncpy(dev->name, iface, sizeof(dev->name)); + dev->name[sizeof(dev->name) - 1] = '\0'; + + if (wg_iface->Flags & WG_IOCTL_INTERFACE_HAS_LISTEN_PORT) { + dev->listen_port = wg_iface->ListenPort; + dev->flags |= WGDEVICE_HAS_LISTEN_PORT; + } + + if (wg_iface->Flags & WG_IOCTL_INTERFACE_HAS_PUBLIC_KEY) { + memcpy(dev->public_key, wg_iface->PublicKey, sizeof(dev->public_key)); + dev->flags |= WGDEVICE_HAS_PUBLIC_KEY; + } + + if (wg_iface->Flags & WG_IOCTL_INTERFACE_HAS_PRIVATE_KEY) { + memcpy(dev->private_key, wg_iface->PrivateKey, sizeof(dev->private_key)); + dev->flags |= WGDEVICE_HAS_PRIVATE_KEY; + } + + wg_peer = buf + sizeof(WG_IOCTL_INTERFACE); + for (ULONG i = 0; i < wg_iface->PeersCount; ++i) { + peer = calloc(1, sizeof(*peer)); + if (!peer) + goto out; + + if (dev->first_peer == NULL) + dev->first_peer = peer; + else + dev->last_peer->next_peer = peer; + dev->last_peer = peer; + + if (wg_peer->Flags & WG_IOCTL_PEER_HAS_PUBLIC_KEY) { + memcpy(peer->public_key, wg_peer->PublicKey, sizeof(peer->public_key)); + peer->flags |= WGPEER_HAS_PUBLIC_KEY; + } + + if (wg_peer->Flags & WG_IOCTL_PEER_HAS_PRESHARED_KEY) { + memcpy(peer->preshared_key, wg_peer->PresharedKey, sizeof(peer->preshared_key)); + if (!key_is_zero(peer->preshared_key)) + peer->flags |= WGPEER_HAS_PRESHARED_KEY; + } + + if (wg_peer->Flags & WG_IOCTL_PEER_HAS_PERSISTENT_KEEPALIVE) { + peer->persistent_keepalive_interval = wg_peer->PersistentKeepalive; + peer->flags |= WGPEER_HAS_PERSISTENT_KEEPALIVE_INTERVAL; + } + + if (wg_peer->Flags & WG_IOCTL_PEER_HAS_ENDPOINT) { + if (wg_peer->Endpoint.si_family == AF_INET) + peer->endpoint.addr4 = wg_peer->Endpoint.Ipv4; + else if (wg_peer->Endpoint.si_family == AF_INET6) + peer->endpoint.addr6 = wg_peer->Endpoint.Ipv6; + } + + peer->rx_bytes = wg_peer->RxBytes; + peer->tx_bytes = wg_peer->TxBytes; + + if (wg_peer->LastHandshake) { + peer->last_handshake_time.tv_sec = wg_peer->LastHandshake / 10000000 - 11644473600LL; + peer->last_handshake_time.tv_nsec = wg_peer->LastHandshake % 10000000 * 100; + } + + wg_aip = (void *)wg_peer + sizeof(WG_IOCTL_PEER); + for (ULONG j = 0; j < wg_peer->AllowedIPsCount; ++j) { + aip = calloc(1, sizeof(*aip)); + if (!aip) + goto out; + + if (peer->first_allowedip == NULL) + peer->first_allowedip = aip; + else + peer->last_allowedip->next_allowedip = aip; + peer->last_allowedip = aip; + + aip->family = wg_aip->AddressFamily; + if (wg_aip->AddressFamily == AF_INET) { + memcpy(&aip->ip4, &wg_aip->Address.V4, sizeof(aip->ip4)); + aip->cidr = wg_aip->Cidr; + } else if (wg_aip->AddressFamily == AF_INET6) { + memcpy(&aip->ip6, &wg_aip->Address.V6, sizeof(aip->ip6)); + aip->cidr = wg_aip->Cidr; + } + ++wg_aip; + } + wg_peer = (WG_IOCTL_PEER *)wg_aip; + } + *device = dev; + errno = 0; +out: + ret = -errno; + free(buf); + CloseHandle(handle); + return ret; +} + +static int kernel_set_device(struct wgdevice *dev) +{ + WG_IOCTL_INTERFACE *wg_iface; + WG_IOCTL_PEER *wg_peer; + WG_IOCTL_ALLOWED_IP *wg_aip; + size_t buf_len = sizeof(WG_IOCTL_INTERFACE); + HANDLE handle = kernel_interface_handle(dev->name); + struct wgpeer *peer; + struct wgallowedip *aip; + size_t peer_count, aip_count; + int ret = 0; + + if (!handle) + return -errno; + + for_each_wgpeer(dev, peer) { + buf_len += sizeof(WG_IOCTL_PEER); + for_each_wgallowedip(peer, aip) + buf_len += sizeof(WG_IOCTL_ALLOWED_IP); + } + wg_iface = calloc(1, buf_len); + if (!wg_iface) + return -errno; + + if (dev->flags & WGDEVICE_HAS_PRIVATE_KEY) { + memcpy(wg_iface->PrivateKey, dev->private_key, sizeof(wg_iface->PrivateKey)); + wg_iface->Flags |= WG_IOCTL_INTERFACE_HAS_PRIVATE_KEY; + } + + if (dev->flags & WGDEVICE_HAS_LISTEN_PORT) { + wg_iface->ListenPort = dev->listen_port; + wg_iface->Flags |= WG_IOCTL_INTERFACE_HAS_LISTEN_PORT; + } + + if (dev->flags & WGDEVICE_REPLACE_PEERS) + wg_iface->Flags |= WG_IOCTL_INTERFACE_REPLACE_PEERS; + + peer_count = 0; + wg_peer = (void *)wg_iface + sizeof(WG_IOCTL_INTERFACE); + for_each_wgpeer(dev, peer) { + wg_peer->Flags = WG_IOCTL_PEER_HAS_PUBLIC_KEY; + memcpy(wg_peer->PublicKey, peer->public_key, sizeof(wg_peer->PublicKey)); + + if (peer->flags & WGPEER_HAS_PRESHARED_KEY) { + memcpy(wg_peer->PresharedKey, peer->preshared_key, sizeof(wg_peer->PresharedKey)); + wg_peer->Flags |= WG_IOCTL_PEER_HAS_PRESHARED_KEY; + } + + if (peer->flags & WGPEER_HAS_PERSISTENT_KEEPALIVE_INTERVAL) { + wg_peer->PersistentKeepalive = peer->persistent_keepalive_interval; + wg_peer->Flags |= WG_IOCTL_PEER_HAS_PERSISTENT_KEEPALIVE; + } + + if (peer->endpoint.addr.sa_family == AF_INET) { + wg_peer->Endpoint.Ipv4 = peer->endpoint.addr4; + wg_peer->Flags |= WG_IOCTL_PEER_HAS_ENDPOINT; + } else if (peer->endpoint.addr.sa_family == AF_INET6) { + wg_peer->Endpoint.Ipv6 = peer->endpoint.addr6; + wg_peer->Flags |= WG_IOCTL_PEER_HAS_ENDPOINT; + } + + if (peer->flags & WGPEER_REPLACE_ALLOWEDIPS) + wg_peer->Flags |= WG_IOCTL_PEER_REPLACE_ALLOWED_IPS; + + if (peer->flags & WGPEER_REMOVE_ME) + wg_peer->Flags |= WG_IOCTL_PEER_REMOVE; + + aip_count = 0; + wg_aip = (void *)wg_peer + sizeof(WG_IOCTL_PEER); + for_each_wgallowedip(peer, aip) { + wg_aip->AddressFamily = aip->family; + wg_aip->Cidr = aip->cidr; + + if (aip->family == AF_INET) + wg_aip->Address.V4 = aip->ip4; + else if (aip->family == AF_INET6) + wg_aip->Address.V6 = aip->ip6; + else + continue; + ++aip_count; + ++wg_aip; + } + wg_peer->AllowedIPsCount = aip_count; + ++peer_count; + wg_peer = (WG_IOCTL_PEER *)wg_aip; + } + wg_iface->PeersCount = peer_count; + + if (!elevated_ioctl(handle, WG_IOCTL_SET, NULL, 0, wg_iface, buf_len, &buf_len)) + goto out; + errno = 0; + +out: + ret = -errno; + free(wg_iface); + CloseHandle(handle); + return ret; +} diff --git a/src/ipc.c b/src/ipc.c index 4a9f00a..08f9984 100644 --- a/src/ipc.c +++ b/src/ipc.c @@ -47,6 +47,8 @@ static int string_list_add(struct string_list *list, const char *str) #include "ipc-openbsd.h" #elif defined(__FreeBSD__) #include "ipc-freebsd.h" +#elif defined(_WIN32) +#include "ipc-windows.h" #endif /* first\0second\0third\0forth\0last\0\0 */ diff --git a/src/uapi/windows/wireguard.h b/src/uapi/windows/wireguard.h new file mode 100644 index 0000000..22fe9b6 --- /dev/null +++ b/src/uapi/windows/wireguard.h @@ -0,0 +1,74 @@ +/* SPDX-License-Identifier: GPL-2.0 + * + * Copyright (C) 2021 WireGuard LLC. All Rights Reserved. + */ + +#ifndef _WIREGUARD_NT_H +#define _WIREGUARD_NT_H + +#include +#include +#include +#include +#include + +#define WG_KEY_LEN 32 + +typedef struct _WG_IOCTL_ALLOWED_IP +{ + union + { + IN_ADDR V4; + IN6_ADDR V6; + } Address; + ADDRESS_FAMILY AddressFamily; + UCHAR Cidr; +} __attribute__((aligned(8))) WG_IOCTL_ALLOWED_IP; + +typedef enum +{ + WG_IOCTL_PEER_HAS_PUBLIC_KEY = 1 << 0, + WG_IOCTL_PEER_HAS_PRESHARED_KEY = 1 << 1, + WG_IOCTL_PEER_HAS_PERSISTENT_KEEPALIVE = 1 << 2, + WG_IOCTL_PEER_HAS_ENDPOINT = 1 << 3, + WG_IOCTL_PEER_HAS_PROTOCOL_VERSION = 1 << 4, + WG_IOCTL_PEER_REPLACE_ALLOWED_IPS = 1 << 5, + WG_IOCTL_PEER_REMOVE = 1 << 6, + WG_IOCTL_PEER_UPDATE = 1 << 7 +} WG_IOCTL_PEER_FLAG; + +typedef struct _WG_IOCTL_PEER +{ + WG_IOCTL_PEER_FLAG Flags; + ULONG ProtocolVersion; /* 0 = latest protocol, 1 = this protocol. */ + UCHAR PublicKey[WG_KEY_LEN]; + UCHAR PresharedKey[WG_KEY_LEN]; + USHORT PersistentKeepalive; + SOCKADDR_INET Endpoint; + ULONG64 TxBytes; + ULONG64 RxBytes; + ULONG64 LastHandshake; + ULONG AllowedIPsCount; +} __attribute__((aligned(8))) WG_IOCTL_PEER; + +typedef enum +{ + WG_IOCTL_INTERFACE_HAS_PUBLIC_KEY = 1 << 0, + WG_IOCTL_INTERFACE_HAS_PRIVATE_KEY = 1 << 1, + WG_IOCTL_INTERFACE_HAS_LISTEN_PORT = 1 << 2, + WG_IOCTL_INTERFACE_REPLACE_PEERS = 1 << 3 +} WG_IOCTL_INTERFACE_FLAG; + +typedef struct _WG_IOCTL_INTERFACE +{ + WG_IOCTL_INTERFACE_FLAG Flags; + USHORT ListenPort; + UCHAR PrivateKey[WG_KEY_LEN]; + UCHAR PublicKey[WG_KEY_LEN]; + ULONG PeersCount; +} __attribute__((aligned(8))) WG_IOCTL_INTERFACE; + +#define WG_IOCTL_GET CTL_CODE(45208U, 321, METHOD_OUT_DIRECT, FILE_READ_DATA | FILE_WRITE_DATA) +#define WG_IOCTL_SET CTL_CODE(45208U, 322, METHOD_IN_DIRECT, FILE_READ_DATA | FILE_WRITE_DATA) + +#endif diff --git a/src/wincompat/include/nci.h b/src/wincompat/include/nci.h new file mode 100644 index 0000000..895e49a --- /dev/null +++ b/src/wincompat/include/nci.h @@ -0,0 +1,30 @@ +/* SPDX-License-Identifier: GPL-2.0 + * + * Copyright (C) 2018-2021 WireGuard LLC. All Rights Reserved. + */ + +#ifndef _NCI_H +#define _NCI_H + +#include + +#ifdef GENERATE_LIB +#define DECLSPEC __declspec(dllexport) +#define STUB { return 0; } +#else +#define DECLSPEC __declspec(dllimport) +#define STUB ; +#endif + + +EXTERN_C DECLSPEC DWORD WINAPI +NciSetConnectionName(const GUID *Guid, const WCHAR *NewName) STUB + +EXTERN_C DECLSPEC DWORD WINAPI +NciGetConnectionName( + const GUID *Guid, + WCHAR *Name, + DWORD InDestNameBytes, + DWORD *OutDestNameBytes) STUB + +#endif diff --git a/src/wincompat/init.c b/src/wincompat/init.c index 8943fff..f744f69 100644 --- a/src/wincompat/init.c +++ b/src/wincompat/init.c @@ -16,6 +16,10 @@ __attribute__((constructor)) static void init(void) DWORD console_mode; HANDLE stdout_handle; WSADATA wsaData; + + if (!SetDllDirectoryA("") || !SetDefaultDllDirectories(LOAD_LIBRARY_SEARCH_SYSTEM32)) + abort(); + WSAStartup(MAKEWORD(2, 2), &wsaData); stdout_handle = GetStdHandle(STD_OUTPUT_HANDLE); // We don't close this. diff --git a/src/wincompat/loader.c b/src/wincompat/loader.c new file mode 100644 index 0000000..72367b4 --- /dev/null +++ b/src/wincompat/loader.c @@ -0,0 +1,20 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (C) 2015-2021 Jason A. Donenfeld . All Rights Reserved. + */ + +#include +#include + +static FARPROC WINAPI delayed_load_library_hook(unsigned dliNotify, PDelayLoadInfo pdli) +{ + HMODULE library; + if (dliNotify != dliNotePreLoadLibrary) + return NULL; + library = LoadLibraryExA(pdli->szDll, NULL, LOAD_LIBRARY_SEARCH_SYSTEM32); + if (!library) + abort(); + return (FARPROC)library; +} + +PfnDliHook __pfnDliNotifyHook2 = delayed_load_library_hook;