Skip to content

Commit ab1ee1f

Browse files
zx2c4zx2c4
committed
global: raise min windows version to 10
Since we're also bumping the PE subsystem header to 10.0, this means we need a _load_config with the proper flags. So there's some work to be done here. This also means bumping LLVM and Go builds. In the case of Go, the patch is still pending: https://go-review.googlesource.com/c/go/+/756680 , so it's a custom build. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
1 parent c77d0cd commit ab1ee1f

18 files changed

Lines changed: 98 additions & 189 deletions

File tree

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ define download =
2525
if ! mv $$@.unverified $$@; then rm -f $$@.unverified; exit 1; fi
2626
endef
2727

28-
$(eval $(call download,go.tar.gz,https://go.dev/dl/go1.26.1.linux-amd64.tar.gz,031f088e5d955bab8657ede27ad4e3bc5b7c1ba281f05f245bcc304f327c987a))
28+
$(eval $(call download,go.tar.gz,https://download.wireguard.com/windows-toolchain/distfiles/go1.26.1-linux_amd64_2026-03-21.tar.gz,47eaffc1fe0a495051b0c894858c567c00fe17cdfda04cbd1b5b5fc8b516e0b1))
2929
$(eval $(call download,wireguard-nt.zip,https://download.wireguard.com/wireguard-nt/wireguard-nt-0.10.1.zip,772c0b1463d8d2212716f43f06f4594d880dea4f735165bd68e388fc41b81605))
3030

3131
.deps/go/prepared: .distfiles/go.tar.gz

‎build.bat‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ rem Copyright (C) 2019-2026 WireGuard LLC. All Rights Reserved.
44

55
setlocal enabledelayedexpansion
66
set BUILDDIR=%~dp0
7-
set PATH=%BUILDDIR%.deps\llvm-mingw\bin;%BUILDDIR%.deps\go\bin;%BUILDDIR%.deps;%PATH%
7+
set PATH=%BUILDDIR%.deps\bin;%BUILDDIR%.deps;%PATH%
88
set PATHEXT=.exe
99
cd /d %BUILDDIR% || exit /b 1
1010

@@ -13,14 +13,14 @@ if exist .deps\prepared goto :render
1313
rmdir /s /q .deps 2> NUL
1414
mkdir .deps || goto :error
1515
cd .deps || goto :error
16-
call :download go.zip https://go.dev/dl/go1.26.1.windows-amd64.zip 9b68112c913f45b7aebbf13c036721264bbba7e03a642f8f7490c561eebd1ecc || goto :error
17-
rem Mirror of https://github.com/mstorsjo/llvm-mingw/releases/download/20201020/llvm-mingw-20201020-msvcrt-x86_64.zip
18-
call :download llvm-mingw-msvcrt.zip https://download.wireguard.com/windows-toolchain/distfiles/llvm-mingw-20201020-msvcrt-x86_64.zip 2e46593245090df96d15e360e092f0b62b97e93866e0162dca7f93b16722b844 || goto :error
16+
call :download go.zip https://download.wireguard.com/windows-toolchain/distfiles/go1.26.1-windows_amd64_2026-03-21.zip 5dee0cfdad62aaa838937ce816daa6614c2648435ea867c98aec9ef3d1dd0c84 "--strip-components 1" || goto :error
17+
rem Mirror of https://github.com/mstorsjo/llvm-mingw/releases/download/20260311/llvm-mingw-20260311-ucrt-x86_64.zip
18+
call :download llvm-mingw-ucrt.zip https://download.wireguard.com/windows-toolchain/distfiles/llvm-mingw-20260311-ucrt-x86_64.zip dd4c67d98959479c7be2fb6709ba074475991590848cb9d0eb2620be06b182e1 "--strip-components 1" || goto :error
1919
rem Mirror of https://imagemagick.org/download/binaries/ImageMagick-7.0.8-42-portable-Q16-x64.zip
2020
call :download imagemagick.zip https://download.wireguard.com/windows-toolchain/distfiles/ImageMagick-7.0.8-42-portable-Q16-x64.zip 584e069f56456ce7dde40220948ff9568ac810688c892c5dfb7f6db902aa05aa "convert.exe colors.xml delegates.xml" || goto :error
2121
rem Mirror of https://sourceforge.net/projects/ezwinports/files/make-4.2.1-without-guile-w32-bin.zip
2222
call :download make.zip https://download.wireguard.com/windows-toolchain/distfiles/make-4.2.1-without-guile-w32-bin.zip 30641be9602712be76212b99df7209f4f8f518ba764cf564262bc9d6e4047cc7 "--strip-components 1 bin" || goto :error
23-
call :download wireguard-tools.zip https://git.zx2c4.com/wireguard-tools/snapshot/wireguard-tools-1ee37b8e4833a25efe6f1fc0d5bdcb476148f4ba.zip ed0739bc3e5a7021a59d4cc4fc63e5fb60a0cb8628d30515a747bfbdcf1fdb0a "--exclude wg-quick --strip-components 1" || goto :error
23+
call :download wireguard-tools.zip https://git.zx2c4.com/wireguard-tools/snapshot/wireguard-tools-a92d534395227ded1595c25ab250266ab18e377a.zip 9fad2fe0bf3303a6b9e970096ecdfbaea8cb73cd260d6bdb1718a584e888bfff "--exclude wg-quick --strip-components 1" || goto :error
2424
call :download wireguard-nt.zip https://download.wireguard.com/wireguard-nt/wireguard-nt-0.10.1.zip 772c0b1463d8d2212716f43f06f4594d880dea4f735165bd68e388fc41b81605 || goto :error
2525
copy /y NUL prepared > NUL || goto :error
2626
cd .. || goto :error
@@ -36,7 +36,7 @@ if exist .deps\prepared goto :render
3636
set GOOS=windows
3737
set GOARM=7
3838
set GOPATH=%BUILDDIR%.deps\gopath
39-
set GOROOT=%BUILDDIR%.deps\go
39+
set GOROOT=%BUILDDIR%.deps
4040
if "%GoGenerate%"=="yes" (
4141
echo [+] Regenerating files
4242
go generate ./... || exit /b 1

‎embeddable-dll-service/build.bat‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ rem Copyright (C) 2019-2026 WireGuard LLC. All Rights Reserved.
44

55
setlocal
66
set BUILDDIR=%~dp0
7-
set PATH=%BUILDDIR%..\.deps\llvm-mingw\bin;%BUILDDIR%..\.deps\go\bin;%PATH%
7+
set PATH=%BUILDDIR%..\.deps\bin;%PATH%
88
set PATHEXT=.exe
99
cd /d %BUILDDIR% || exit /b 1
1010

@@ -16,9 +16,9 @@ if exist ..\.deps\prepared goto :build
1616
set GOOS=windows
1717
set GOARM=7
1818
set GOPATH=%BUILDDIR%..\.deps\gopath
19-
set GOROOT=%BUILDDIR%..\.deps\go
19+
set GOROOT=%BUILDDIR%..\.deps
2020
set CGO_ENABLED=1
21-
set CGO_CFLAGS=-O3 -Wall -Wno-unused-function -Wno-switch -std=gnu11 -DWINVER=0x0601
21+
set CGO_CFLAGS=-O3 -Wall -Wno-unused-function -Wno-switch -std=gnu11 -DWINVER=0x0A00
2222
call :build_plat x86 i686 386 || goto :error
2323
call :build_plat amd64 x86_64 amd64 || goto :error
2424
call :build_plat arm64 aarch64 arm64 || goto :error

‎embeddable-dll-service/csharp/DemoUI/app.manifest‎

Lines changed: 1 addition & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -11,18 +11,8 @@
1111

1212
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
1313
<application>
14-
<!-- Windows 7 -->
15-
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" />
16-
17-
<!-- Windows 8 -->
18-
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}" />
19-
20-
<!-- Windows 8.1 -->
21-
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}" />
22-
23-
<!-- Windows 10 -->
14+
<!-- Windows 10 and 11 -->
2415
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}" />
25-
2616
</application>
2717
</compatibility>
2818

‎installer/build.bat‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,10 +32,10 @@ if exist .deps\prepared goto :build
3232

3333
:build
3434
if exist ..\sign.bat call ..\sign.bat
35-
set PATH=%BUILDDIR%..\.deps\llvm-mingw\bin;%PATH%
35+
set PATH=%BUILDDIR%..\.deps\bin;%PATH%
3636
set WIX=%BUILDDIR%.deps\wix\
37-
set CFLAGS=-O3 -Wall -std=gnu11 -DWINVER=0x0601 -D_WIN32_WINNT=0x0601 -municode -DUNICODE -D_UNICODE -DNDEBUG
38-
set LDFLAGS=-shared -s -Wl,--kill-at -Wl,--major-os-version=6 -Wl,--minor-os-version=1 -Wl,--major-subsystem-version=6 -Wl,--minor-subsystem-version=1 -Wl,--tsaware -Wl,--dynamicbase -Wl,--nxcompat -Wl,--export-all-symbols
37+
set CFLAGS=-O3 -Wall -std=gnu11 -DWINVER=0x0A00 -D_WIN32_WINNT=0x0A00 -municode -DUNICODE -D_UNICODE -DNDEBUG
38+
set LDFLAGS=-shared -s -Wl,--kill-at -Wl,--major-os-version=10 -Wl,--minor-os-version=0 -Wl,--major-subsystem-version=10 -Wl,--minor-subsystem-version=0 -Wl,--tsaware -Wl,--dynamicbase -Wl,--nxcompat -Wl,--export-all-symbols
3939
set LDLIBS=-lmsi -lole32 -lshlwapi -lshell32 -luuid -lntdll
4040
call :msi x86 i686 x86 || goto :error
4141
call :msi amd64 x86_64 x64 || goto :error

‎installer/customactions.c‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,22 @@
1414
#include <stdbool.h>
1515
#include <tchar.h>
1616

17+
/*
18+
* This here is a bit of a hack. We're compiling with subsystem=10.0 in the PE
19+
* header, and so the Windows loader expects to see either
20+
* _load_config.SecurityCookie set to the initial magic value, or for
21+
* IMAGE_GUARD_SECURITY_COOKIE_UNUSED to be set. libssp doesn't use
22+
* SecurityCookie anyway; SecurityCookie is for MSVC's /GS protection. So it
23+
* seems like the proper thing to do is signal to the OS that it doesn't need
24+
* to initialize SecurityCookie.
25+
*/
26+
27+
#define IMAGE_GUARD_SECURITY_COOKIE_UNUSED 0x00000800
28+
const IMAGE_LOAD_CONFIG_DIRECTORY _load_config_used = {
29+
.Size = sizeof(_load_config_used),
30+
.GuardFlags = IMAGE_GUARD_SECURITY_COOKIE_UNUSED
31+
};
32+
1733
#define MANAGER_SERVICE_NAME TEXT("WireGuardManager")
1834
#define TUNNEL_SERVICE_PREFIX TEXT("WireGuardTunnel$")
1935

@@ -82,6 +98,23 @@ static void log_errorf(MSIHANDLE installer, enum log_level level, DWORD error_co
8298
LocalFree(system_message);
8399
}
84100

101+
extern NTAPI __declspec(dllimport) void RtlGetNtVersionNumbers(DWORD *MajorVersion, DWORD *MinorVersion, DWORD *BuildNumber);
102+
103+
__declspec(dllexport) UINT __stdcall CheckWinVer(MSIHANDLE installer)
104+
{
105+
bool is_com_initialized;
106+
DWORD maj;
107+
108+
RtlGetNtVersionNumbers(&maj, NULL, NULL);
109+
if (maj >= 10)
110+
return ERROR_SUCCESS;
111+
is_com_initialized = SUCCEEDED(CoInitialize(NULL));
112+
log_messagef(installer, LOG_LEVEL_MSIERR, TEXT("WireGuard requires Windows ≥10."));
113+
if (is_com_initialized)
114+
CoUninitialize();
115+
return ERROR_INSTALL_FAILURE;
116+
}
117+
85118
__declspec(dllexport) UINT __stdcall CheckWow64(MSIHANDLE installer)
86119
{
87120
UINT ret = ERROR_SUCCESS;

‎installer/fetcher/Makefile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,12 @@ CFLAGS ?= -Os
66
DEPLOYMENT_HOST ?= winvm
77
DEPLOYMENT_PATH ?= Desktop
88

9-
CFLAGS += -std=gnu11 -DWINVER=0x0601 -D_WIN32_WINNT=0x0601 -flto
9+
CFLAGS += -std=gnu11 -DWINVER=0x0A00 -D_WIN32_WINNT=0x0A00 -flto
1010
CFLAGS += -Wall -Wextra
1111
CFLAGS += -MMD -MP
1212
LDLIBS += -lkernel32 -lwinhttp -lntdll -lshlwapi -lmsi -lcomctl32 -luser32 -lshell32 -lwintrust -lbcrypt
1313
LDFLAGS += -s -flto -Wl,--dynamicbase -Wl,--nxcompat -Wl,--tsaware -mwindows
14-
LDFLAGS += -Wl,--major-os-version=6 -Wl,--minor-os-version=1 -Wl,--major-subsystem-version=6 -Wl,--minor-subsystem-version=1
14+
LDFLAGS += -Wl,--major-os-version=10 -Wl,--minor-os-version=0 -Wl,--major-subsystem-version=10 -Wl,--minor-subsystem-version=0
1515
# The use of -Wl,/delayload: here implies we're using llvm-mingw
1616
LDFLAGS += -Wl,/delayload:winhttp.dll -Wl,/delayload:msi.dll -Wl,/delayload:wintrust.dll -Wl,/delayload:advapi32.dll -Wl,/delayload:shell32.dll -Wl,/delayload:shlwapi.dll -Wl,/delayload:gdi32.dll -Wl,/delayload:user32.dll -Wl,/delayload:comctl32.dll -Wl,/delayload:bcrypt.dll
1717
TARGET := wireguard-installer.exe

‎installer/fetcher/fetcher.c‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -111,15 +111,11 @@ static DWORD __stdcall download_thread(void *param)
111111
goto out;
112112

113113
set_status(progress, "connecting to server");
114-
session = WinHttpOpen(L(useragent()), is_win7() ? WINHTTP_ACCESS_TYPE_DEFAULT_PROXY : WINHTTP_ACCESS_TYPE_AUTOMATIC_PROXY, NULL, NULL, 0);
114+
session = WinHttpOpen(L(useragent()), WINHTTP_ACCESS_TYPE_AUTOMATIC_PROXY, NULL, NULL, 0);
115115
if (!session)
116116
goto out;
117-
WinHttpSetOption(session, WINHTTP_OPTION_ENABLE_HTTP_PROTOCOL, &enable_http2, sizeof(enable_http2)); // Don't check return value, in case of old Windows
118-
if (is_win8dotzero_or_below()) {
119-
DWORD enable_tls12 = WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2;
120-
if (!WinHttpSetOption(session, WINHTTP_OPTION_SECURE_PROTOCOLS, &enable_tls12, sizeof(enable_tls12)))
121-
goto out;
122-
}
117+
if (!WinHttpSetOption(session, WINHTTP_OPTION_ENABLE_HTTP_PROTOCOL, &enable_http2, sizeof(enable_http2)))
118+
goto out;
123119

124120
connection = WinHttpConnect(session, L(server), port, 0);
125121
if (!connection)

‎installer/fetcher/load_config.c‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
// SPDX-License-Identifier: GPL-2.0
2+
/*
3+
* Copyright (C) 2020-2026 Jason A. Donenfeld. All Rights Reserved.
4+
*
5+
* This here is a bit of a hack. We're compiling with subsystem=10.0 in the PE
6+
* header, and so the Windows loader expects to see either
7+
* _load_config.SecurityCookie set to the initial magic value, or for
8+
* IMAGE_GUARD_SECURITY_COOKIE_UNUSED to be set. libssp doesn't use
9+
* SecurityCookie anyway; SecurityCookie is for MSVC's /GS protection. So it
10+
* seems like the proper thing to do is signal to the OS that it doesn't need
11+
* to initialize SecurityCookie.
12+
*/
13+
14+
#include <windows.h>
15+
16+
#define IMAGE_GUARD_SECURITY_COOKIE_UNUSED 0x00000800
17+
const IMAGE_LOAD_CONFIG_DIRECTORY _load_config_used = {
18+
.Size = sizeof(_load_config_used),
19+
.GuardFlags = IMAGE_GUARD_SECURITY_COOKIE_UNUSED
20+
};

‎installer/fetcher/manifest.xml‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,8 @@
33
<assemblyIdentity version="1.0.0.0" processorArchitecture="*" name="wireguard-installer" type="win32" />
44
<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
55
<application>
6-
<!-- Windows 10 -->
6+
<!-- Windows 10 and 11 -->
77
<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}" />
8-
<!-- Windows 8.1 -->
9-
<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}" />
10-
<!-- Windows 8 -->
11-
<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}" />
12-
<!-- Windows 7 -->
13-
<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" />
148
</application>
159
</compatibility>
1610
<dependency>

0 commit comments

Comments
 (0)