zabpehely
/
wireguard-tools
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

wg-quick: linux: some iptables don't like empty lines 

Reported-by: Kenneth R. Crudup <kenny@panix.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
This commit is contained in:
Jason A. Donenfeld 2019-12-05 18:33:15 +01:00
parent 9eab3487cd
commit 3928ebb87d
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/wg-quick/linux.bash
View File

@ -188,9 +188,9 @@ remove_iptables() {
while read -r line; do while read -r line; do
[[ $line == "*"* || $line == COMMIT || $line == "-A "*"-m comment --comment \"wg-quick(8) rule for $INTERFACE\""* ]] || continue [[ $line == "*"* || $line == COMMIT || $line == "-A "*"-m comment --comment \"wg-quick(8) rule for $INTERFACE\""* ]] || continue
[[ $line == "-A"* ]] && found=1 [[ $line == "-A"* ]] && found=1
printf -v restore '%s\n%s' "$restore" "${line/#-A/-D}" printf -v restore '%s%s\n' "$restore" "${line/#-A/-D}"
done < <($iptables-save) done < <($iptables-save)
[[ $found -ne 1 ]] || echo "$restore" | cmd $iptables-restore -n [[ $found -ne 1 ]] || echo -n "$restore" | cmd $iptables-restore -n
done done
} }
@ -210,14 +210,14 @@ add_default() {
cmd ip $proto rule add not fwmark $table table $table cmd ip $proto rule add not fwmark $table table $table
cmd ip $proto rule add table main suppress_prefixlength 0 cmd ip $proto rule add table main suppress_prefixlength 0
local marker="-m comment --comment \"wg-quick(8) rule for $INTERFACE\"" restore="*raw" local marker="-m comment --comment \"wg-quick(8) rule for $INTERFACE\"" restore=$'*raw\n'
for i in "${ADDRESSES[@]}"; do for i in "${ADDRESSES[@]}"; do
[[ ( $proto == -4 && $i != *:* ) || ( $proto == -6 && $i == *:* ) ]] || continue [[ ( $proto == -4 && $i != *:* ) || ( $proto == -6 && $i == *:* ) ]] || continue
printf -v restore '%s\n-I PREROUTING ! -i %s -d %s -m addrtype ! --src-type LOCAL -j DROP %s\n' "$restore" "$INTERFACE" "${i%/*}" "$marker" printf -v restore '%s-I PREROUTING ! -i %s -d %s -m addrtype ! --src-type LOCAL -j DROP %s\n' "$restore" "$INTERFACE" "${i%/*}" "$marker"
done done
printf -v restore '%s\nCOMMIT\n*mangle\n-I POSTROUTING -m mark --mark %d -p udp -j CONNMARK --save-mark %s\n-I PREROUTING -p udp -j CONNMARK --restore-mark %s\nCOMMIT\n' "$restore" $table "$marker" "$marker" printf -v restore '%sCOMMIT\n*mangle\n-I POSTROUTING -m mark --mark %d -p udp -j CONNMARK --save-mark %s\n-I PREROUTING -p udp -j CONNMARK --restore-mark %s\nCOMMIT\n' "$restore" $table "$marker" "$marker"
[[ $proto == -4 ]] && cmd sysctl -q net.ipv4.conf.all.src_valid_mark=1 [[ $proto == -4 ]] && cmd sysctl -q net.ipv4.conf.all.src_valid_mark=1
echo "$restore" | cmd $iptables-restore -n echo -n "$restore" | cmd $iptables-restore -n
HAVE_SET_IPTABLES=1 HAVE_SET_IPTABLES=1
return 0 return 0
} }