[RFC PATCH] wg-quick/linux: switch to ip rule rp filter

Alex Xu (Hello71) alex_y_xu at yahoo.ca
Fri Mar 6 18:04:04 CET 2020


---
 src/wg-quick/linux.bash | 113 ++++++++++++++++++++--------------------
 1 file changed, 56 insertions(+), 57 deletions(-)

diff --git a/src/wg-quick/linux.bash b/src/wg-quick/linux.bash
index 7c2c002..7bd2f85 100755
--- a/src/wg-quick/linux.bash
+++ b/src/wg-quick/linux.bash
@@ -22,10 +22,15 @@ POST_UP=( )
 PRE_DOWN=( )
 POST_DOWN=( )
 SAVE_CONFIG=0
+ALLOWEDIPS=( )
 CONFIG_FILE=""
 PROGRAM="${0##*/}"
 ARGS=( "$@" )
 
+# needs to match across all wireguard devices, because only one
+# suppress_ifgroup is supported
+IFGROUP=51820
+
 cmd() {
 	echo "[#] $*" >&2
 	"$@"
@@ -65,6 +70,7 @@ parse_options() {
 			SaveConfig) read_bool SAVE_CONFIG "$value"; continue ;;
 			esac
 		fi
+		[[ $key == "AllowedIPs" ]] && ALLOWEDIPS+=( ${value//,/ } )
 		WG_CONFIG+="$line"$'\n'
 	done < "$CONFIG_FILE"
 	shopt -u nocasematch
@@ -93,21 +99,23 @@ add_if() {
 }
 
 del_if() {
-	local table
+	local table table_local table_drop
 	[[ $HAVE_SET_DNS -eq 0 ]] || unset_dns
-	[[ $HAVE_SET_FIREWALL -eq 0 ]] || remove_firewall
 	if [[ -z $TABLE || $TABLE == auto ]] && get_fwmark table && [[ $(wg show "$INTERFACE" allowed-ips) =~ /0(\ |$'\n'|$) ]]; then
-		while [[ $(ip -4 rule show 2>/dev/null) == *"lookup $table"* ]]; do
-			cmd ip -4 rule delete table $table
-		done
-		while [[ $(ip -4 rule show 2>/dev/null) == *"from all lookup main suppress_prefixlength 0"* ]]; do
-			cmd ip -4 rule delete table main suppress_prefixlength 0
-		done
-		while [[ $(ip -6 rule show 2>/dev/null) == *"lookup $table"* ]]; do
-			cmd ip -6 rule delete table $table
-		done
-		while [[ $(ip -6 rule show 2>/dev/null) == *"from all lookup main suppress_prefixlength 0"* ]]; do
-			cmd ip -6 rule delete table main suppress_prefixlength 0
+		table_local=$((table + 1))
+		table_drop=$((table + 2))
+		for proto in -4 -6; do
+			for _table in $table $table_local $table_drop; do
+				while [[ $(ip $proto rule show 2>/dev/null) == *"lookup $_table"* ]]; do
+					cmd ip $proto rule delete lookup $_table
+				done
+                                if [[ -n $(ip $proto route show table $_table 2>/dev/null) ]]; then
+                                    cmd ip $proto route flush table $_table
+                                fi
+			done
+			while [[ $(ip $proto rule show 2>/dev/null) == *"from all lookup main suppress_prefixlength 0"* ]]; do
+				cmd ip $proto rule delete lookup main suppress_prefixlength 0
+			done
 		done
 	fi
 	cmd ip link delete dev "$INTERFACE"
@@ -181,31 +189,8 @@ get_fwmark() {
 	return 0
 }
 
-remove_firewall() {
-	if type -p nft >/dev/null; then
-		local table nftcmd
-		while read -r table; do
-			[[ $table == *" wg-quick-$INTERFACE" ]] && printf -v nftcmd '%sdelete %s\n' "$nftcmd" "$table"
-		done < <(nft list tables 2>/dev/null)
-		[[ -z $nftcmd ]] || cmd nft -f <(echo -n "$nftcmd")
-	fi
-	if type -p iptables >/dev/null; then
-		local line iptables found restore
-		for iptables in iptables ip6tables; do
-			restore="" found=0
-			while read -r line; do
-				[[ $line == "*"* || $line == COMMIT || $line == "-A "*"-m comment --comment \"wg-quick(8) rule for $INTERFACE\""* ]] || continue
-				[[ $line == "-A"* ]] && found=1
-				printf -v restore '%s%s\n' "$restore" "${line/#-A/-D}"
-			done < <($iptables-save 2>/dev/null)
-			[[ $found -ne 1 ]] || echo -n "$restore" | cmd $iptables-restore -n
-		done
-	fi
-}
-
-HAVE_SET_FIREWALL=0
 add_default() {
-	local table line
+	local table line table_local
 	if ! get_fwmark table; then
 		table=51820
 		while [[ -n $(ip -4 route show table $table 2>/dev/null) || -n $(ip -6 route show table $table 2>/dev/null) ]]; do
@@ -213,32 +198,35 @@ add_default() {
 		done
 		cmd wg set "$INTERFACE" fwmark $table
 	fi
+	table_local=$((table+1))
+	table_drop=$((table+2))
 	local proto=-4 iptables=iptables pf=ip
 	[[ $1 == *:* ]] && proto=-6 iptables=ip6tables pf=ip6
 	cmd ip $proto route add "$1" dev "$INTERFACE" table $table
 	cmd ip $proto rule add not fwmark $table table $table
 	cmd ip $proto rule add table main suppress_prefixlength 0
 
-	local marker="-m comment --comment \"wg-quick(8) rule for $INTERFACE\"" restore=$'*raw\n' nftable="wg-quick-$INTERFACE" nftcmd 
-	printf -v nftcmd '%sadd table %s %s\n' "$nftcmd" "$pf" "$nftable"
-	printf -v nftcmd '%sadd chain %s %s preraw { type filter hook prerouting priority -300; }\n' "$nftcmd" "$pf" "$nftable"
-	printf -v nftcmd '%sadd chain %s %s premangle { type filter hook prerouting priority -150; }\n' "$nftcmd" "$pf" "$nftable"
-	printf -v nftcmd '%sadd chain %s %s postmangle { type filter hook postrouting priority -150; }\n' "$nftcmd" "$pf" "$nftable"
-	while read -r line; do
-		[[ $line =~ .*inet6?\ ([0-9a-f:.]+)/[0-9]+.* ]] || continue
-		printf -v restore '%s-I PREROUTING ! -i %s -d %s -m addrtype ! --src-type LOCAL -j DROP %s\n' "$restore" "$INTERFACE" "${BASH_REMATCH[1]}" "$marker"
-		printf -v nftcmd '%sadd rule %s %s preraw iifname != "%s" %s daddr %s fib saddr type != local drop\n' "$nftcmd" "$pf" "$nftable" "$INTERFACE" "$pf" "${BASH_REMATCH[1]}"
-	done < <(ip -o $proto addr show dev "$INTERFACE" 2>/dev/null)
-	printf -v restore '%sCOMMIT\n*mangle\n-I POSTROUTING -m mark --mark %d -p udp -j CONNMARK --save-mark %s\n-I PREROUTING -p udp -j CONNMARK --restore-mark %s\nCOMMIT\n' "$restore" $table "$marker" "$marker"
-	printf -v nftcmd '%sadd rule %s %s postmangle meta l4proto udp mark %d ct mark set mark \n' "$nftcmd" "$pf" "$nftable" $table
-	printf -v nftcmd '%sadd rule %s %s premangle meta l4proto udp meta mark set ct mark \n' "$nftcmd" "$pf" "$nftable"
-	[[ $proto == -4 ]] && cmd sysctl -q net.ipv4.conf.all.src_valid_mark=1
-	if type -p nft >/dev/null; then
-		cmd nft -f <(echo -n "$nftcmd")
-	else
-		echo -n "$restore" | cmd $iptables-restore -n
+	ip link set $INTERFACE group $IFGROUP
+	# this can be done with ip -batch, but this way allows us to use the cmd wrapper
+	ip $proto route show table local dev $INTERFACE | while read route; do
+		cmd ip $proto route add $route dev $INTERFACE table $table_local
+		if [[ "$route" == "local "* ]]; then
+			cmd ip $proto route add blackhole ${route#local} table $table_drop
+		fi
+	done
+	# ip rules are added in reverse priority order, so drop MUST be first
+	cmd ip $proto rule add lookup $table_drop
+	cmd ip $proto rule add iif $INTERFACE lookup $table_local
+	cmd ip $proto rule add iif lo lookup $table_local
+	# pre-state checked in cmd_up
+	if grep -q '^1$' /proc/sys/net/ipv4/conf/*/rp_filter; then
+		cmd sysctl -q net.ipv4.conf.all.rp_filter=2
 	fi
-	HAVE_SET_FIREWALL=1
+	if [[ $(ip rule show priority 0) == $'0:\tfrom all lookup local' ]]; then
+		cmd ip $proto rule add lookup local suppress_ifgroup $IFGROUP priority 0
+		cmd ip $proto rule del lookup local priority 0
+	fi
+
 	return 0
 }
 
@@ -321,6 +309,18 @@ cmd_usage() {
 cmd_up() {
 	local i
 	[[ -z $(ip link show dev "$INTERFACE" 2>/dev/null) ]] || die "\`$INTERFACE' already exists"
+	if [[ "${ROUTES[*]} " == *"/0 "* ]]; then
+		# do some checks first so we don't have to die in add_default later
+		case "$(ip rule show priority 0)" in
+			$'0:\tfrom all lookup local') ;;
+			$'0:\tfrom all lookup local suppress_ifgroup '$IFGROUP) ;;
+			*) die "ip rule priority 0 must be default or suppress_ifgroup $IFGROUP" ;;
+		esac
+		# most mainstream distros (all systemd-based) set rp_filter=2 by default anyways
+		if grep -q '^1$' /proc/sys/net/ipv4/conf/*/rp_filter; then
+			echo "$PROGRAM: warning: setting net.ipv4.conf.all.rp_filter=2 to support /0 route"
+		fi
+	fi
 	trap 'del_if; exit' INT TERM EXIT
 	execute_hooks "${PRE_UP[@]}"
 	add_if
@@ -343,7 +343,6 @@ cmd_down() {
 	[[ $SAVE_CONFIG -eq 0 ]] || save_config
 	del_if
 	unset_dns || true
-	remove_firewall || true
 	execute_hooks "${POST_DOWN[@]}"
 }
 
-- 
2.25.1



More information about the WireGuard mailing list