[PATCH] wg-quick: linux: introduce BirthNamespace parameter

[Björn Fiedler]

This allows the interface to be created in another network namespace
and be moved into the current one afterwards. As the interface
remembers it's birth namespace, encrypted packets are sent and
received using the birth namespace. Use case is to route all the
traffic via the "New Namespace Solution" as described on
https://www.wireguard.com/netns/

Signed-off-by Björn Fiedler <bjoern at reldeif.de>
---
  src/man/wg-quick.8      | 3 +++
  src/wg-quick/linux.bash | 7 ++++++-
  2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/man/wg-quick.8 b/src/man/wg-quick.8
index bc9e145..b141041 100644
--- a/src/man/wg-quick.8
+++ b/src/man/wg-quick.8
@@ -92,6 +92,9 @@ special values: `off' disables the creation of routes altogether, and `auto'
  (the default) adds routes to the default table and enables special handling of
  default routes.
  .IP \(bu
+BirthNamespace \(em on Linux, if specified, the interface is created inside that namespace and
+afterwards moved into the current network namespace.
+.IP \(bu
  PreUp, PostUp, PreDown, PostDown \(em script snippets which will be executed by
  .BR bash (1)
  before/after setting up/tearing down the interface, most commonly used
diff --git a/src/wg-quick/linux.bash b/src/wg-quick/linux.bash
index 4193ce5..b0d1b70 100755
--- a/src/wg-quick/linux.bash
+++ b/src/wg-quick/linux.bash
@@ -18,6 +18,7 @@ MTU=""
  DNS=( )
  DNS_SEARCH=( )
  TABLE=""
+BIRTH_NAMESPACE=""
  PRE_UP=( )
  POST_UP=( )
  PRE_DOWN=( )
@@ -61,6 +62,7 @@ parse_options() {
                                 [[ $v =~ (^[0-9.]+$)|(^.*:.*$) ]] && DNS+=( $v ) || DNS_SEARCH+=( $v )
                         done; continue ;;
                         Table) TABLE="$value"; continue ;;
+                       BirthNamespace) BIRTH_NAMESPACE="$value"; continue ;;
                         PreUp) PRE_UP+=( "$value" ); continue ;;
                         PreDown) PRE_DOWN+=( "$value" ); continue ;;
                         PostUp) POST_UP+=( "$value" ); continue ;;
@@ -87,12 +89,15 @@ auto_su() {

  add_if() {
         local ret
-       if ! cmd ip link add "$INTERFACE" type wireguard; then
+       local namespace_arg=""
+       [[ -z $BIRTH_NAMESPACE ]] || namespace_arg="-n ${BIRTH_NAMESPACE}"
+       if ! cmd ip $namespace_arg link add "$INTERFACE" type wireguard; then
                 ret=$?
                 [[ -e /sys/module/wireguard ]] || ! command -v "${WG_QUICK_USERSPACE_IMPLEMENTATION:-wireguard-go}" >/dev/null && exit $ret
                 echo "[!] Missing WireGuard kernel module. Falling back to slow userspace implementation." >&2
                 cmd "${WG_QUICK_USERSPACE_IMPLEMENTATION:-wireguard-go}" "$INTERFACE"
         fi
+    [[ -z $BIRTH_NAMESPACE ]] || cmd ip $namespace_arg link set "$INTERFACE" netns $BASHPID
  }

  del_if() {
-- 
2.43.0