snow/wireguard-tools
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

wg-quick: linux: add support for nft and prefer it

Browse source 
If nft(8) is installed, use it. These rules should be identical to the
iptables-restore(8) ones, with the advantage that cleanup is easy
because we use custom table names.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
This commit is contained in:
Jason A. Donenfeld 2019-12-10 16:37:34 +01:00
parent bc8bf54185
commit 17c78d31c2
1 changed files with 39 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

59
src/wg-quick/linux.bash
View file

@ -95,7 +95,7 @@ add_if() {
del_if() { del_if() {
local table local table
[[ $HAVE_SET_DNS -eq 0 ]] || unset_dns [[ $HAVE_SET_DNS -eq 0 ]] || unset_dns
[[ $HAVE_SET_IPTABLES -eq 0 ]] || remove_iptables [[ $HAVE_SET_FIREWALL -eq 0 ]] || remove_firewall
if [[ -z $TABLE || $TABLE == auto ]] && get_fwmark table && [[ $(wg show "$INTERFACE" allowed-ips) =~ /0(\ |$'\n'|$) ]]; then if [[ -z $TABLE || $TABLE == auto ]] && get_fwmark table && [[ $(wg show "$INTERFACE" allowed-ips) =~ /0(\ |$'\n'|$) ]]; then
while [[ $(ip -4 rule show 2>/dev/null) == *"lookup $table"* ]]; do while [[ $(ip -4 rule show 2>/dev/null) == *"lookup $table"* ]]; do
cmd ip -4 rule delete table $table cmd ip -4 rule delete table $table
@ -181,22 +181,30 @@ get_fwmark() {
return 0 return 0
} }
remove_iptables() { remove_firewall() {
local line iptables found restore if type -p nft >/dev/null; then
for iptables in iptables ip6tables; do local table nftcmd
restore="" found=0 while read -r table; do
while read -r line; do [[ $table == *" wg-quick-$INTERFACE" ]] && printf -v nftcmd '%sdelete %s\n' "$nftcmd" "$table"
[[ $line == "*"* || $line == COMMIT || $line == "-A "*"-m comment --comment \"wg-quick(8) rule for $INTERFACE\""* ]] || continue done < <(nft list tables 2>/dev/null)
[[ $line == "-A"* ]] && found=1 [[ -z $nftcmd ]] || echo -n "$nftcmd" | cmd nft -f -
printf -v restore '%s%s\n' "$restore" "${line/#-A/-D}" else
done < <($iptables-save 2>/dev/null) local line iptables found restore
[[ $found -ne 1 ]] || echo -n "$restore" | cmd $iptables-restore -n for iptables in iptables ip6tables; do
done restore="" found=0
while read -r line; do
[[ $line == "*"* || $line == COMMIT || $line == "-A "*"-m comment --comment \"wg-quick(8) rule for $INTERFACE\""* ]] || continue
[[ $line == "-A"* ]] && found=1
printf -v restore '%s%s\n' "$restore" "${line/#-A/-D}"
done < <($iptables-save 2>/dev/null)
[[ $found -ne 1 ]] || echo -n "$restore" | cmd $iptables-restore -n
done
fi
} }
HAVE_SET_IPTABLES=0 HAVE_SET_FIREWALL=0
add_default() { add_default() {
local table proto i iptables local table i
if ! get_fwmark table; then if ! get_fwmark table; then
table=51820 table=51820
while [[ -n $(ip -4 route show table $table 2>/dev/null) || -n $(ip -6 route show table $table 2>/dev/null) ]]; do while [[ -n $(ip -4 route show table $table 2>/dev/null) || -n $(ip -6 route show table $table 2>/dev/null) ]]; do
@ -204,21 +212,32 @@ add_default() {
done done
cmd wg set "$INTERFACE" fwmark $table cmd wg set "$INTERFACE" fwmark $table
fi fi
proto=-4 iptables=iptables local proto=-4 iptables=iptables pf=ip
[[ $1 == *:* ]] && proto=-6 iptables=ip6tables [[ $1 == *:* ]] && proto=-6 iptables=ip6tables pf=ip6
cmd ip $proto route add "$1" dev "$INTERFACE" table $table cmd ip $proto route add "$1" dev "$INTERFACE" table $table
cmd ip $proto rule add not fwmark $table table $table cmd ip $proto rule add not fwmark $table table $table
cmd ip $proto rule add table main suppress_prefixlength 0 cmd ip $proto rule add table main suppress_prefixlength 0
local marker="-m comment --comment \"wg-quick(8) rule for $INTERFACE\"" restore=$'*raw\n' local marker="-m comment --comment \"wg-quick(8) rule for $INTERFACE\"" restore=$'*raw\n' nftable="wg-quick-$INTERFACE" nftcmd
printf -v nftcmd '%sadd table %s %s\n' "$nftcmd" "$pf" "$nftable"
printf -v nftcmd '%sadd chain %s %s preraw { type filter hook prerouting priority raw; }\n' "$nftcmd" "$pf" "$nftable"
printf -v nftcmd '%sadd chain %s %s premangle { type filter hook prerouting priority mangle; }\n' "$nftcmd" "$pf" "$nftable"
printf -v nftcmd '%sadd chain %s %s postmangle { type filter hook postrouting priority mangle; }\n' "$nftcmd" "$pf" "$nftable"
for i in "${ADDRESSES[@]}"; do for i in "${ADDRESSES[@]}"; do
[[ ( $proto == -4 && $i != *:* ) || ( $proto == -6 && $i == *:* ) ]] || continue [[ ( $proto == -4 && $i != *:* ) || ( $proto == -6 && $i == *:* ) ]] || continue
printf -v restore '%s-I PREROUTING ! -i %s -d %s -m addrtype ! --src-type LOCAL -j DROP %s\n' "$restore" "$INTERFACE" "${i%/*}" "$marker" printf -v restore '%s-I PREROUTING ! -i %s -d %s -m addrtype ! --src-type LOCAL -j DROP %s\n' "$restore" "$INTERFACE" "${i%/*}" "$marker"
printf -v nftcmd '%sadd rule %s %s preraw iifname != %s %s daddr %s fib saddr type != local drop\n' "$nftcmd" "$pf" "$nftable" "$INTERFACE" "$pf" "${i%/*}"
done done
printf -v restore '%sCOMMIT\n*mangle\n-I POSTROUTING -m mark --mark %d -p udp -j CONNMARK --save-mark %s\n-I PREROUTING -p udp -j CONNMARK --restore-mark %s\nCOMMIT\n' "$restore" $table "$marker" "$marker" printf -v restore '%sCOMMIT\n*mangle\n-I POSTROUTING -m mark --mark %d -p udp -j CONNMARK --save-mark %s\n-I PREROUTING -p udp -j CONNMARK --restore-mark %s\nCOMMIT\n' "$restore" $table "$marker" "$marker"
printf -v nftcmd '%sadd rule %s %s postmangle meta l4proto udp mark %d ct mark set mark \n' "$nftcmd" "$pf" "$nftable" $table
printf -v nftcmd '%sadd rule %s %s premangle meta l4proto udp meta mark set ct mark \n' "$nftcmd" "$pf" "$nftable"
[[ $proto == -4 ]] && cmd sysctl -q net.ipv4.conf.all.src_valid_mark=1 [[ $proto == -4 ]] && cmd sysctl -q net.ipv4.conf.all.src_valid_mark=1
echo -n "$restore" | cmd $iptables-restore -n if type -p nft >/dev/null; then
HAVE_SET_IPTABLES=1 echo -n "$nftcmd" | cmd nft -f -
else
echo -n "$restore" | cmd $iptables-restore -n
fi
HAVE_SET_FIREWALL=1
return 0 return 0
} }
@ -323,7 +342,7 @@ cmd_down() {
[[ $SAVE_CONFIG -eq 0 ]] || save_config [[ $SAVE_CONFIG -eq 0 ]] || save_config
del_if del_if
unset_dns || true unset_dns || true
remove_iptables || true remove_firewall || true
execute_hooks "${POST_DOWN[@]}" execute_hooks "${POST_DOWN[@]}"
} }