diff -pruN 1.0.20210914-1/debian/changelog 1.0.20210914-1ubuntu2/debian/changelog --- 1.0.20210914-1/debian/changelog 2021-09-28 01:21:06.000000000 +0000 +++ 1.0.20210914-1ubuntu2/debian/changelog 2021-12-07 11:33:57.000000000 +0000 @@ -1,3 +1,23 @@ +wireguard (1.0.20210914-1ubuntu2) jammy; urgency=medium + + * Add better DEP8 tests (LP: #1952102): + - d/t/control, d/t/wireguard-wgquick: test using network namespaces + and wg-quick + - d/t/netns-mini, d/t/control: test using network namespaces + and wg, taken from the wireguard-linux-compat package + * d/rules: add simple build-time test, taken from the existing + DEP8 test to generate keys (LP: #1952767) + + -- Andreas Hasenack Tue, 07 Dec 2021 08:33:57 -0300 + +wireguard (1.0.20210914-1ubuntu1) devel; urgency=medium + + * Merge from Debian unstable. Remaining changes: + - Switch alternative dependency order for the wireguard-modules, + wireguard-dkms alternative. + + -- Unit 193 Tue, 23 Nov 2021 11:41:45 -0500 + wireguard (1.0.20210914-1) unstable; urgency=medium * New upstream release. @@ -5,6 +25,14 @@ wireguard (1.0.20210914-1) unstable; urg -- Unit 193 Mon, 27 Sep 2021 21:21:06 -0400 +wireguard (1.0.20210424-1ubuntu1) devel; urgency=medium + + * Merge from Debian unstable. Remaining changes: + - Switch alternative dependency order for the wireguard-modules, + wireguard-dkms alternative. + + -- Unit 193 Mon, 16 Aug 2021 14:20:40 -0400 + wireguard (1.0.20210424-1) unstable; urgency=medium * New upstream release. @@ -12,6 +40,14 @@ wireguard (1.0.20210424-1) unstable; urg -- Unit 193 Fri, 13 Aug 2021 17:36:52 -0400 +wireguard (1.0.20210223-1ubuntu1) devel; urgency=medium + + * Merge from Debian unstable. Remaining changes: + - Switch alternative dependency order for the wireguard-modules, + wireguard-dkms alternative. + + -- Unit 193 Tue, 16 Mar 2021 17:27:19 -0400 + wireguard (1.0.20210223-1) unstable; urgency=medium * New upstream release. @@ -22,18 +58,45 @@ wireguard (1.0.20210223-1) unstable; urg -- Unit 193 Thu, 25 Feb 2021 02:02:36 -0500 +wireguard (1.0.20200827-1ubuntu1) devel; urgency=medium + + * Merge from Debian unstable. Remaining changes: + - Switch alternative dependency order for the wireguard-modules, + wireguard-dkms alternative. + + -- Unit 193 Wed, 30 Sep 2020 18:52:56 -0400 + wireguard (1.0.20200827-1) unstable; urgency=medium * New upstream release. -- Unit 193 Wed, 09 Sep 2020 03:47:59 -0400 +wireguard (1.0.20200820-1ubuntu1) groovy; urgency=low + + * Merge from Debian unstable. Remaining changes: + - Switch alternative dependency order for teh wireguard-modules, + wireguard-dkms alternative. + + -- Andy Whitcroft Wed, 26 Aug 2020 10:42:33 +0100 + wireguard (1.0.20200820-1) unstable; urgency=medium * New upstream release. -- Unit 193 Sat, 22 Aug 2020 19:19:51 -0400 +wireguard (1.0.20200513-1ubuntu1) groovy; urgency=medium + + * Switch alternative dependency order for the wireguard-modules, + wireguard-dkms alternative. Whichever is first is deemed the + preferred installation candidate when neither is present. When this is + wireguard-modules this is satisfied by installation of a random kernel + which claims support for wireguard regardless of its applicability. + Repeat after me, do not ever depend on a kernel. (LP: #1890201) + + -- Andy Whitcroft Mon, 03 Aug 2020 22:24:05 +0100 + wireguard (1.0.20200513-1) unstable; urgency=medium * New upstream release. diff -pruN 1.0.20210914-1/debian/control 1.0.20210914-1ubuntu2/debian/control --- 1.0.20210914-1/debian/control 2021-09-28 01:19:37.000000000 +0000 +++ 1.0.20210914-1ubuntu2/debian/control 2021-12-07 11:33:51.000000000 +0000 @@ -1,7 +1,8 @@ Source: wireguard Section: net Priority: optional -Maintainer: Daniel Kahn Gillmor +Maintainer: Ubuntu Developers +XSBC-Original-Maintainer: Daniel Kahn Gillmor Uploaders: Unit 193 , Build-Depends: @@ -17,7 +18,7 @@ Rules-Requires-Root: no Package: wireguard Architecture: all Depends: - wireguard-modules (>= 0.0.20191219) | wireguard-dkms (>= 0.0.20200121-2), + wireguard-dkms (>= 0.0.20200121-2) | wireguard-modules (>= 0.0.20191219), wireguard-tools (>= ${source:Version}), ${misc:Depends}, Description: fast, modern, secure kernel VPN tunnel (metapackage) diff -pruN 1.0.20210914-1/debian/rules 1.0.20210914-1ubuntu2/debian/rules --- 1.0.20210914-1/debian/rules 2020-05-15 22:28:58.000000000 +0000 +++ 1.0.20210914-1ubuntu2/debian/rules 2021-12-07 11:33:57.000000000 +0000 @@ -21,3 +21,18 @@ override_dh_fixperms: override_dh_installexamples: dh_installexamples -Xexternal-tests + +define test_wg +set -x; set -e; \ +echo "Testing command $1" && \ +a="$$(src/wg $1)" && b="$$(src/wg $1)" && \ +echo "a=$$a b=$$b" && \ +test -n "$$a" && \ +test -n "$$b" && \ +test "$$a" != "$$b" +endef + +override_dh_auto_test: + test "$$(head -c 32 /dev/zero | base64 | src/wg pubkey)" = "L+V9o0fNYkMVKNqsX7spBzD/9oSvxM/C7ZCZX1jLO3Q=" + $(call test_wg,genpsk) + $(call test_wg,genkey) diff -pruN 1.0.20210914-1/debian/tests/control 1.0.20210914-1ubuntu2/debian/tests/control --- 1.0.20210914-1/debian/tests/control 2020-05-22 07:09:50.000000000 +0000 +++ 1.0.20210914-1ubuntu2/debian/tests/control 2021-12-06 15:01:00.000000000 +0000 @@ -2,3 +2,16 @@ Tests: keygen Restrictions: superficial Depends: wireguard-tools, + +Tests: wg-quick +Restrictions: needs-root, isolation-machine, allow-stderr +Depends: + iproute2, + @, + +Tests: netns-mini +Restrictions: needs-root, isolation-machine +Depends: + iproute2, + iputils-ping, + @, diff -pruN 1.0.20210914-1/debian/tests/netns-mini 1.0.20210914-1ubuntu2/debian/tests/netns-mini --- 1.0.20210914-1/debian/tests/netns-mini 1970-01-01 00:00:00.000000000 +0000 +++ 1.0.20210914-1ubuntu2/debian/tests/netns-mini 2021-12-06 15:01:00.000000000 +0000 @@ -0,0 +1,55 @@ +#!/bin/bash +# SPDX-License-Identifier: GPL-2.0 +# Copyright (C) 2015-2020 Jason A. Donenfeld . All Rights Reserved. +set -e + +exec 3>&1 +netns0="wg-test-$$-0" +netns1="wg-test-$$-1" +netns2="wg-test-$$-2" +pretty() { echo -e "\x1b[32m\x1b[1m[+] ${1:+NS$1: }${2}\x1b[0m" >&3; } +pp() { pretty "" "$*"; "$@"; } +n1() { pretty 1 "$*"; ip netns exec $netns1 "$@"; } +n2() { pretty 2 "$*"; ip netns exec $netns2 "$@"; } +ip0() { pretty 0 "ip $*"; ip -n $netns0 "$@"; } +ip1() { pretty 1 "ip $*"; ip -n $netns1 "$@"; } +ip2() { pretty 2 "ip $*"; ip -n $netns2 "$@"; } + +cleanup() { + set +e + exec 2>/dev/null + ip0 link del dev wg0 + ip1 link del dev wg0 + ip2 link del dev wg0 + local to_kill="$(ip netns pids $netns0) $(ip netns pids $netns1) $(ip netns pids $netns2)" + [[ -n $to_kill ]] && kill $to_kill + pp ip netns del $netns1 + pp ip netns del $netns2 + pp ip netns del $netns0 + exit +} +trap cleanup EXIT + +ip netns del $netns0 2>/dev/null || true +ip netns del $netns1 2>/dev/null || true +ip netns del $netns2 2>/dev/null || true +pp ip netns add $netns0 +pp ip netns add $netns1 +pp ip netns add $netns2 +ip0 link set up dev lo +ip0 link add dev wg0 type wireguard +ip0 link set wg0 netns $netns1 +ip0 link add dev wg0 type wireguard +ip0 link set wg0 netns $netns2 +ip1 addr add 192.168.241.1/24 dev wg0 +ip2 addr add 192.168.241.2/24 dev wg0 +key1="$(pp wg genkey)" +key2="$(pp wg genkey)" +pub1="$(pp wg pubkey <<<"$key1")" +pub2="$(pp wg pubkey <<<"$key2")" +n1 wg set wg0 private-key <(echo "$key1") listen-port 1 peer "$pub2" allowed-ips 192.168.241.2/32 +n2 wg set wg0 private-key <(echo "$key2") listen-port 2 peer "$pub1" allowed-ips 192.168.241.1/32 +ip1 link set up dev wg0 +ip2 link set up dev wg0 +n2 wg set wg0 peer "$pub1" endpoint 127.0.0.1:1 +n2 ping -c 10 -f -W 1 192.168.241.1 diff -pruN 1.0.20210914-1/debian/tests/wg-quick 1.0.20210914-1ubuntu2/debian/tests/wg-quick --- 1.0.20210914-1/debian/tests/wg-quick 1970-01-01 00:00:00.000000000 +0000 +++ 1.0.20210914-1ubuntu2/debian/tests/wg-quick 2021-12-06 15:01:00.000000000 +0000 @@ -0,0 +1,171 @@ +#!/bin/bash + +set -e +set -o pipefail + +LEFT_NS="left_ns" +LEFT_GW="10.0.5.1/24" +LEFT_PORT=3001 +LEFT_INT="10.0.1.1/24" +WG_LEFT_INTERFACE="wg_left" +WG_LEFT_INTERFACE_CONF="/etc/wireguard/${WG_LEFT_INTERFACE}.conf" + +RIGHT_NS="right_ns" +RIGHT_GW="10.0.5.2/24" +RIGHT_PORT=3002 +RIGHT_INT="10.0.1.2/24" +WG_RIGHT_INTERFACE="wg_right" +WG_RIGHT_INTERFACE_CONF="/etc/wireguard/${WG_RIGHT_INTERFACE}.conf" + +cleanup() { + if [ $? -ne 0 ]; then + echo "Some test failed, here is some debugging" + dmesg -T | grep wireguard + fi + rm -f "${WG_LEFT_INTERFACE_CONF}" "${WG_RIGHT_INTERFACE_CONF}" + ip netns delete "${LEFT_NS}" &>/dev/null + ip netns delete "${RIGHT_NS}" &>/dev/null +} + +trap cleanup EXIT + + +setup() { + umask 0077 + echo "Generating keys" + LEFT_PRIVKEY="$(wg genkey)" + RIGHT_PRIVKEY="$(wg genkey)" + LEFT_PUBKEY="$(wg pubkey <<<"${LEFT_PRIVKEY}")" + RIGHT_PUBKEY="$(wg pubkey <<<"${RIGHT_PRIVKEY}")" + + echo "Generating wireguard config" + cat > "${WG_LEFT_INTERFACE_CONF}" <<-EOF + [Interface] + ListenPort = ${LEFT_PORT} + PrivateKey = ${LEFT_PRIVKEY} + Address = ${LEFT_GW} + + [Peer] + PublicKey = ${RIGHT_PUBKEY} + AllowedIPs = ${RIGHT_GW%%/*}/32 + Endpoint = ${RIGHT_INT%%/*}:${RIGHT_PORT} + EOF + + cat > "${WG_RIGHT_INTERFACE_CONF}" <<-EOF + [Interface] + ListenPort = ${RIGHT_PORT} + PrivateKey = ${RIGHT_PRIVKEY} + Address = ${RIGHT_GW} + + [Peer] + PublicKey = ${LEFT_PUBKEY} + AllowedIPs = ${LEFT_GW%%/*}/32 + Endpoint = ${LEFT_INT%%/*}:${LEFT_PORT} + EOF + + echo "Cleaning up old namespaces" + ip netns delete "${LEFT_NS}" &> /dev/null || true + ip netns delete "${RIGHT_NS}" &> /dev/null || true + + echo "Creating new namespaces ${LEFT_NS} and ${RIGHT_NS} and adding loopback interface to them" + ip netns add "${LEFT_NS}" + ip netns exec "${LEFT_NS}" ip link set dev lo up + + ip netns add "${RIGHT_NS}" + ip netns exec "${RIGHT_NS}" ip link set dev lo up + + echo "Creating veth interface connecting both namespaces" + ip link add p1 netns "${LEFT_NS}" type veth peer p2 netns "${RIGHT_NS}" + ip -n "${LEFT_NS}" addr add "${LEFT_INT}" dev p1 + ip -n "${LEFT_NS}" link set p1 up + + ip -n "${RIGHT_NS}" addr add "${RIGHT_INT}" dev p2 + ip -n "${RIGHT_NS}" link set p2 up + + echo "Bringing up LEFT wireguard interface in namespace ${LEFT_NS}" + ip netns exec "${LEFT_NS}" wg-quick up "${WG_LEFT_INTERFACE}" + + echo "Bringing up RIGHT wireguard interface in namespace ${RIGHT_NS}" + ip netns exec "${RIGHT_NS}" wg-quick up "${WG_RIGHT_INTERFACE}" +} + +show_config() { + echo "${LEFT_NS} namespace:" + ip netns exec "${LEFT_NS}" wg showconf "${WG_LEFT_INTERFACE}" + echo + echo "${RIGHT_NS} namespace:" + ip netns exec "${RIGHT_NS}" wg showconf "${WG_RIGHT_INTERFACE}" +} + +test_stats() { + local -i ret + local output="" + # to be run after the ping tests + # by now, we MUST have "transfer" and "last handshake" + for ns in "${LEFT_NS}" "${RIGHT_NS}"; do + echo "Namespace ${ns}" + output=$(ip netns exec "${ns}" wg show) + echo "${output}" | grep -E "latest handshake:" || { + ret=$? + echo "Missing \"latest handshake\" from stats in namespace ${ns}" + echo "Got this output:" + echo "${output}" + return $ret + } + echo "${output}" | grep -E "transfer:.*received.*sent" || { + ret=$? + echo "Missing \"transfer\" stats in namespace ${ns}" + echo "Got this output:" + echo "${output}" + return $ret + } + done +} + +test_gw_ping() { + echo "Pinging right gateway, from ${LEFT_NS} namespace" + ip netns exec "${LEFT_NS}" ping -W 2 -c 1 "${RIGHT_GW%%/*}" || return $? + echo + echo "Pinging left gateway, from ${RIGHT_NS} namespace" + ip netns exec "${RIGHT_NS}" ping -W 2 -c 1 "${LEFT_GW%%/*}" || return $? +} + +test_wireguard_ping() { + echo "Pinging right wireguard IP from ${LEFT_NS} namespace" + ip netns exec "${LEFT_NS}" ping -W 2 -c 1 "${RIGHT_INT%%/*}" || return $? + echo + echo "Pinging left wireguard IP from ${RIGHT_NS} namesapce" + ip netns exec "${RIGHT_NS}" ping -W 2 -c 1 "${LEFT_INT%%/*}" || return $? +} + + +echo "Setting things up" +setup || { + echo "Failed vpn test setup" + exit 1 +} + +echo +echo "This is the config" +show_config + +echo +echo "Testing gateway ping" +test_gw_ping || { + echo "Failed gateway ping" + exit 1 +} + +echo +echo "Testing wireguard interface ping" +test_wireguard_ping || { + echo "Failed wireguard interface ping" + exit 1 +} + +echo +echo "Testing vpn stats" +test_stats || { + echo "Failed to verify vpn stats" + exit 1 +}