From: "Jason A. Donenfeld" <Jason@zx2c4.com>
To: "Dan Lüdtke" <mail@danrl.com>
Cc: WireGuard mailing list <wireguard@lists.zx2c4.com>
Subject: openwrt route_allowed_ips is inprecise
Date: Sun, 18 Dec 2016 21:14:18 +0100 [thread overview]
Message-ID: <CAHmME9q+aZNDDH5Nsnn1O7+4RxFm489f08oOmyGpWsVx1pLxwg@mail.gmail.com> (raw)
Hey Dan,
The route_allowed_ips directive is not precise enough. I'm CCing Jorg,
the NixOS maintainer, because this same concern probably applies to
the Nix logic.
Your code is:
if [ ${route_allowed_ips} -ne 0 ]; then
for allowed_ip in ${allowed_ips}; do
case "${allowed_ip}" in
*:*/*)
proto_add_ipv6_route "${allowed_ip%%/*}" "${allowed_ip##*/}"
;;
*/*)
proto_add_ipv4_route "${allowed_ip%%/*}" "${allowed_ip##*/}"
;;
esac
done
fi
The way it should be done is described in wg-config:
https://git.zx2c4.com/WireGuard/tree/contrib/examples/wg-config/wg-config#n130
if [[ $AUTO_ROUTE -eq 1 ]]; then
for i in $(wg show "$INTERFACE" allowed-ips | cut -f 2 | tr -d ,); do
if ! add_default "$i" && [[ $(ip route get "$i") != *dev\
$INTERFACE\ * ]]; then
add_route "$i"
fi
done
fi
The add_default thing just accounts for dealing with 0/1 128/1, which
you can ignore, since openwrt has the dependency mechanism. But the
important thing is that I run `ip route get` for each one, and only
add a route if necessary.
FYI.
Jason
next reply other threads:[~2016-12-18 20:07 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-12-18 20:14 Jason A. Donenfeld [this message]
2016-12-19 8:00 ` Jörg Thalheim
2016-12-19 12:32 ` Jason A. Donenfeld
2016-12-19 13:06 ` Baptiste Jonglez
2016-12-19 13:09 ` Jason A. Donenfeld
2016-12-19 13:19 ` Baptiste Jonglez
2016-12-19 13:21 ` Jason A. Donenfeld
2016-12-20 1:13 ` Baptiste Jonglez
2016-12-20 3:14 ` Jason A. Donenfeld
2016-12-20 3:38 ` Dan Luedtke
2016-12-20 4:33 ` Jason A. Donenfeld
2016-12-20 8:52 ` Dan Lüdtke
2016-12-20 10:15 ` Dan Lüdtke
2016-12-20 13:33 ` Jason A. Donenfeld
2016-12-20 14:51 ` Dan Lüdtke
2016-12-20 18:27 ` Jason A. Donenfeld
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAHmME9q+aZNDDH5Nsnn1O7+4RxFm489f08oOmyGpWsVx1pLxwg@mail.gmail.com \
--to=jason@zx2c4.com \
--cc=mail@danrl.com \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).