fdo-mirrors/NetworkManager
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/NetworkManager/NetworkManager.git synced 2025-12-24 19:30:07 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
NetworkManager/libnm
History
Thomas Haller 10e05bf8ab wireguard: support configuring policy routing to avoid routing loops 
For WireGuard (like for all IP-tunnels and IP-based VPNs), the IP addresses of
the peers must be reached outside the tunnel/VPN itself.

For VPN connections, NetworkManager usually adds a direct /32 route to
the external VPN gateway to the underlying device. For WireGuard that is
not done, because injecting a route to another device is ugly and error
prone. Worse: WireGuard with automatic roaming and multiple peers makes this
more complicated.

This is commonly a problem when setting the default-route via the VPN,
but there are also other subtle setups where special care must be taken
to prevent such routing loops.

WireGuard's wg-quick provides a simple, automatic solution by adding two policy
routing rules and relying on the WireGuard packets having a fwmark set (see [1]).

Let's also do that. Add new properties "wireguard.ip4-auto-default-route"
and "wireguard.ip6-auto-default-route" to enable/disable this. Note that
the default value lets NetworkManager automatically choose whether to
enable it (depending on whether there are any peers that have a default
route). This means, common scenarios should now work well without additional
configuration.

Note that this is also a change in behavior and upon package upgrade
NetworkManager may start adding policy routes (if there are peers that
have a default-route). This is a change in behavior, as the user already
clearly had this setup working and configured some working solution
already.

The new automatism picks the rule priority automatically and adds the
default-route to the routing table that has the same number as the fwmark.
If any of this is unsuitable, then the user is free to disable this
automatism. Note that since 1.18.0 NetworkManager supports policy routing (*).
That means, what this automatism does can be also achieved via explicit
configuration of the profile, which gives the user more flexibility to
adjust all parameters explicitly).

(*) but only since 1.20.0 NetworkManager supports the "suppress_prefixlength"
rule attribute, which makes it impossible to configure exactly this rule-based
solution with 1.18.0 NetworkManager.

[1] https://www.wireguard.com/netns/#improved-rule-based-routing
2019-07-29 20:45:49 +02:00
..
tests all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
generate-plugin-docs.pl all: drop vim file variables from source files 2019-06-11 10:08:07 +02:00
generate-setting-docs.py libnm: rework team handling of JSON config 2019-05-23 18:09:49 +02:00
libnm.pc.in libnm,pkg-config: provide a variable with VPN service directory 2015-08-19 15:13:11 +02:00
libnm.ver wireguard: support configuring policy routing to avoid routing loops 2019-07-29 20:45:49 +02:00
meson.build build/meson: introduce libnm/liblibnm.la as static library for libnm/libnm.la 2019-05-22 20:04:08 +02:00
NetworkManager.h libnm-core: add ovs-dpdk setting 2019-06-14 12:10:20 +02:00
nm-access-point.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-access-point.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-active-connection.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-active-connection.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-autoptr.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-checkpoint.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-checkpoint.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-client.c core,libnm: add AddConnection2() D-Bus API to block autoconnect from the start 2019-07-25 15:26:49 +02:00
nm-client.h core,libnm: add AddConnection2() D-Bus API to block autoconnect from the start 2019-07-25 15:26:49 +02:00
nm-dbus-helpers.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-dbus-helpers.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-6lowpan.c libnm: add support form 6LoWPAN devices 2018-06-26 16:21:55 +02:00
nm-device-6lowpan.h libnm: add support form 6LoWPAN devices 2018-06-26 16:21:55 +02:00
nm-device-adsl.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-adsl.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-bond.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-bond.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-bridge.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-bridge.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-bt.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-bt.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-dummy.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-dummy.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-ethernet.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-ethernet.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-generic.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-generic.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-infiniband.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-infiniband.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-ip-tunnel.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-ip-tunnel.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-macsec.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-macsec.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-macvlan.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-macvlan.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-modem.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-modem.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-olpc-mesh.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-olpc-mesh.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-ovs-bridge.c all: drop unnecessary includes of <errno.h> and <string.h> 2019-02-12 08:50:28 +01:00
nm-device-ovs-bridge.h libnm: add accessors for ovs port/bridge slaves 2018-07-10 13:12:07 +02:00
nm-device-ovs-interface.c all: drop unnecessary includes of <errno.h> and <string.h> 2019-02-12 08:50:28 +01:00
nm-device-ovs-interface.h libnm: add support for ovs-interface devices 2017-10-30 17:40:08 +01:00
nm-device-ovs-port.c libnm,core: fix device TYPE for Wi-Fi P2P devices 2019-02-26 09:14:13 +01:00
nm-device-ovs-port.h libnm: add accessors for ovs port/bridge slaves 2018-07-10 13:12:07 +02:00
nm-device-ppp.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-ppp.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-private.h libnm: use the o.fd.DBus.ObjectManager API for object management 2016-11-10 16:48:48 +01:00
nm-device-team.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-team.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-tun.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-tun.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-vlan.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-vlan.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-vxlan.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-vxlan.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-wifi-p2p.c libnm,core: fix device TYPE for Wi-Fi P2P devices 2019-02-26 09:14:13 +01:00
nm-device-wifi-p2p.h wifi-p2p: drop WiFi-P2P "group-owner" property from D-Bus API and libnm 2019-02-21 15:34:55 +01:00
nm-device-wifi.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-wifi.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-wimax.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-wimax.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-device-wireguard.c libnm: fix leak for NMDeviceWireGuard's public_key 2018-08-06 08:34:27 +02:00
nm-device-wireguard.h libnm: introduce NMDeviceWireGuard 2018-08-06 08:34:27 +02:00
nm-device-wpan.c all: drop unnecessary includes of <errno.h> and <string.h> 2019-02-12 08:50:28 +01:00
nm-device-wpan.h libnm: add support for WPAN devices 2018-06-26 16:21:55 +02:00
nm-device.c device: free temporary typename with iface variable 2019-07-22 08:22:14 +02:00
nm-device.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-dhcp-config.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-dhcp-config.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-dhcp4-config.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-dhcp4-config.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-dhcp6-config.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-dhcp6-config.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-dns-manager.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-dns-manager.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-enum-types.c.template build: use template files for enum types' sources generation 2017-12-18 11:25:06 +01:00
nm-enum-types.h.template build: use template files for enum types' sources generation 2017-12-18 11:25:06 +01:00
nm-ip-config.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-ip-config.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-ip4-config.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-ip4-config.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-ip6-config.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-ip6-config.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-libnm-utils.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-libnm-utils.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-manager.c libnm,core: Add ConnectivityCheckUri property and accessors 2019-07-22 21:03:09 +02:00
nm-manager.h libnm,core: Add ConnectivityCheckUri property and accessors 2019-07-22 21:03:09 +02:00
nm-object-private.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-object.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-object.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-remote-connection-private.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-remote-connection.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-remote-connection.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-remote-settings.c core,libnm: add AddConnection2() D-Bus API to block autoconnect from the start 2019-07-25 15:26:49 +02:00
nm-remote-settings.h core,libnm: add AddConnection2() D-Bus API to block autoconnect from the start 2019-07-25 15:26:49 +02:00
nm-secret-agent-old.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-secret-agent-old.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-types.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-vpn-connection.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-vpn-connection.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-vpn-editor.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-vpn-editor.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-vpn-plugin-old.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-vpn-plugin-old.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-vpn-service-plugin.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-vpn-service-plugin.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-wifi-p2p-peer.c all: codespell fixes 2019-03-11 12:03:46 +01:00
nm-wifi-p2p-peer.h wifi-p2p: rename Wi-Fi P2P 2019-02-01 17:02:57 +01:00
nm-wimax-nsp.c all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00
nm-wimax-nsp.h all: drop emacs file variables from source files 2019-06-11 10:04:00 +02:00