Some potential bug in wg-quick re. fwmark and default route

Saeid Akbari saeidscorp at
Mon Mar 12 15:17:10 CET 2018


Straight to the point :)
Suppose the following scenario:

On a client system I have 2 interfaces:
wg0 -> which has allowedips of; so it gets special treatment by wg-
quick -> so `ip rule add not fwmark 51820 table 51820`
wg1 -> which has a restrictive allowedips of (not important)

also each one have a FwMark set in their config file:
wg0 -> 51800
wg1 -> 51820

Then: `wg-quick up wg0` and `wg-quick up wg1`

Now the problem is, when I do `wg-quick down wg1` it also deletes the default 
rules for wg0, as its fwmark is 51820 which belongs to table of wg0. I see 
that this might seem a little bit weird to do, but why rely on hard-coded 
numbers if we can use the ones provided by the user...

So wouldn't be better if `add_default()` function first checks if fwmark is 
present on device (thus config file) and use that as fwmark and table-id?

Like what `del_if()` does, borrowing its code:

add_default() {
	local fwmark
	fwmark="$(wg show "$INTERFACE" fwmark)"
	[[ $fwmark != off ]] && DEFAULT_TABLE=$(( fwmark )) # borrowed
	if [[ -z $DEFAULT_TABLE ]]; then
		while [[ -n $(ip -4 route show table $DEFAULT_TABLE) || -n $(ip -6 route 
show table $DEFAULT_TABLE) ]]; do

This way, default interface (the one having allowedips of would 
register its own fwmark, and bringing down other interfaces, doesn't delete 
its rule.

+ But another issue, `del_if()` seems to assume that the interface is used as 
default route when a fwmark is present on it. This causes deletion of "from 
all lookup main suppress_prefixlength 0" when bringing down a non-default 
interface (in this scenario, wg1).

Any ideas?


More information about the WireGuard mailing list