* [WireGuard] [PATCH] use /run not /tmp in example/test code
@ 2016-07-01 12:40 Daniel Kahn Gillmor
0 siblings, 0 replies; only message in thread
From: Daniel Kahn Gillmor @ 2016-07-01 12:40 UTC (permalink / raw)
To: WireGuard mailing list
/run is both ephemeral and typically only writable by root, while /tmp
is often persistent and world-writable. This change avoids possible
symlink attacks and makes it less likely for generated keys to hit the
disks.
These changes are for example/test code, so this isn't a security
vulnerability, but it's better for the example/test code to use good
form, since inevitably someone will crib their system config scripts
from these bits.
---
contrib/client-server-example/client.sh | 7 ++++---
contrib/stress-testing/self-send.sh | 8 +++++---
2 files changed, 9 insertions(+), 6 deletions(-)
diff --git a/contrib/client-server-example/client.sh b/contrib/client-server-example/client.sh
index fbae46a..97b444d 100755
--- a/contrib/client-server-example/client.sh
+++ b/contrib/client-server-example/client.sh
@@ -2,14 +2,15 @@
set -e
[[ $UID == 0 ]] || { echo "You must be root to run this."; exit 1; }
umask 077
-trap 'rm -f /tmp/wg_private_key' EXIT INT TERM
+mkdir -p -m 0700 /run/wireguard
+trap 'rm -f /run/wireguard/private_key' EXIT INT TERM
exec 3<>/dev/tcp/demo.wireguard.io/42912
-wg genkey | tee /tmp/wg_private_key | wg pubkey >&3
+wg genkey | tee /run/wireguard/private_key | wg pubkey >&3
IFS=: read -r status server_pubkey server_port internal_ip <&3
[[ $status == OK ]]
ip link del dev wg0 2>/dev/null || true
ip link add dev wg0 type wireguard
-wg set wg0 private-key /tmp/wg_private_key peer "$server_pubkey" allowed-ips 0.0.0.0/0 endpoint "demo.wireguard.io:$server_port"
+wg set wg0 private-key /run/wireguard/private_key peer "$server_pubkey" allowed-ips 0.0.0.0/0 endpoint "demo.wireguard.io:$server_port"
ip address add "$internal_ip"/24 dev wg0
ip link set up dev wg0
if [ "$1" == "default-route" ]; then
diff --git a/contrib/stress-testing/self-send.sh b/contrib/stress-testing/self-send.sh
index eb7947b..4599b49 100755
--- a/contrib/stress-testing/self-send.sh
+++ b/contrib/stress-testing/self-send.sh
@@ -4,6 +4,8 @@ set -e
PRIVATE_KEYS=("")
PUBLIC_KEYS=("")
+mkdir -p -m 0700 /run/wireguard
+
resetwg() {
for i in {1..64}; do
ip link delete dev wg${i} 2>/dev/null >/dev/null || true
@@ -31,12 +33,12 @@ for i in {1..64}; do
echo "AllowedIPs = 192.168.8.${j}/32"
echo "Endpoint = 127.0.0.1:$(( $j + 31222 ))"
done
- } > "/tmp/deviceload.conf"
+ } > "/run/wireguard/deviceload.conf"
ip link add dev wg${i} type wireguard
- wg setconf wg${i} "/tmp/deviceload.conf"
+ wg setconf wg${i} "/run/wireguard/deviceload.conf"
ip link set up dev wg${i}
- rm "/tmp/deviceload.conf"
+ rm "/run/wireguard/deviceload.conf"
done
ip address add dev wg1 192.168.8.1/24
--
2.8.1
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2016-07-01 12:37 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-07-01 12:40 [WireGuard] [PATCH] use /run not /tmp in example/test code Daniel Kahn Gillmor
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).