NetworkManager/clients
Thomas Haller 115291a46f wireguard: don't let explicit gateway override WireGuard's peer route
The profile's "ipv4.gateway" and "ipv6.gateway" has only one real
purpose: to define the next hop of a static default route.

Usually, when specifying a gateway in this way, the default route from
other addressing methods (like DHCPv4 or IPv6 autoconf) gets ignored.

If you have a WireGuard peer with "AllowedIPs=0.0.0.0/0" and
"wireguard.peer-routes" enabled, NetworkManager would automatically add
a route to the peer. Previously, if the user also set a gateway, that
route was suppressed.

That doesn't feel right. Note that configuring a gateway on a WireGuard
profile is likely to be wrong to begin with. At least, unless you take
otherwise care to avoid routing loops. If you take care, setting a
gateway may work, but it would feel clearer to instead just add an
explicit /0 manual route instead.

Also, note that usually you don't need a gateway anyway. WireGuard is a
Layer 3 (IP) tunnel, where the next hop is alway just the other side of
the tunnel. The next hop has little effect on the routes that you
configure on a WireGuard interface. What however matters is whether a
default route is present or not.

Also, an explicit gateway probably works badly with "ipv[46].ip4-auto-default-route",
because in that case the automatism should add a /0 peer-route route in a
separate routing table. The explicit gateway interferes with that too.

Nonetheless, without this patch it's not obvious why the /0 peer
route gets suppressed when a gateway is set. Don't allow for that, and
always add the peer-route.

Probably the profile's gateway setting is still wrong and causes the
profile not to work. But at least, you see all routes configured, and
it's clearer where the (wrong) default route to the gateway comes from.
2020-04-22 11:36:51 +02:00
..
cli cli: let _print_fill() hide option if NM_META_ACCESSOR_GET_OUT_FLAGS_HIDE is set 2020-04-16 10:52:45 +02:00
cloud-setup license: Add license using SPDX identifiers to meson build files 2020-02-17 13:16:57 +01:00
common wireguard: don't let explicit gateway override WireGuard's peer route 2020-04-22 11:36:51 +02:00
tests clients/trivial: remove obsolete comment from test-client.py howto 2020-04-09 14:10:56 +02:00
tui meson: merge branch 'inigomartinez/meson-license' 2020-03-28 12:45:19 +01:00
meson.build license: Add license using SPDX identifiers to meson build files 2020-02-17 13:16:57 +01:00
nm-online.c all: use nm_clear_pointer() instead of g_clear_pointer() 2020-03-23 11:22:38 +01:00