NetworkManager/clients/common
Thomas Haller 115291a46f wireguard: don't let explicit gateway override WireGuard's peer route
The profile's "ipv4.gateway" and "ipv6.gateway" has only one real
purpose: to define the next hop of a static default route.

Usually, when specifying a gateway in this way, the default route from
other addressing methods (like DHCPv4 or IPv6 autoconf) gets ignored.

If you have a WireGuard peer with "AllowedIPs=0.0.0.0/0" and
"wireguard.peer-routes" enabled, NetworkManager would automatically add
a route to the peer. Previously, if the user also set a gateway, that
route was suppressed.

That doesn't feel right. Note that configuring a gateway on a WireGuard
profile is likely to be wrong to begin with. At least, unless you take
otherwise care to avoid routing loops. If you take care, setting a
gateway may work, but it would feel clearer to instead just add an
explicit /0 manual route instead.

Also, note that usually you don't need a gateway anyway. WireGuard is a
Layer 3 (IP) tunnel, where the next hop is alway just the other side of
the tunnel. The next hop has little effect on the routes that you
configure on a WireGuard interface. What however matters is whether a
default route is present or not.

Also, an explicit gateway probably works badly with "ipv[46].ip4-auto-default-route",
because in that case the automatism should add a /0 peer-route route in a
separate routing table. The explicit gateway interferes with that too.

Nonetheless, without this patch it's not obvious why the /0 peer
route gets suppressed when a gateway is set. Don't allow for that, and
always add the peer-route.

Probably the profile's gateway setting is still wrong and causes the
profile not to work. But at least, you see all routes configured, and
it's clearer where the (wrong) default route to the gateway comes from.
2020-04-22 11:36:51 +02:00
..
tests clients: set routing search domain with nameservers when importing WireGuard profile 2020-04-08 12:33:56 +02:00
meson.build license: Add license using SPDX identifiers to meson build files 2020-02-17 13:16:57 +01:00
nm-client-utils.c clients: avoid compiler warning about redefining NDEBUG for qrcodegen 2020-01-15 22:25:21 +01:00
nm-client-utils.h cli: add "nmcli d wifi show" 2019-10-18 17:38:57 +02:00
nm-meta-setting-access.c all: unify format of our Copyright source code comments 2019-10-02 17:03:52 +02:00
nm-meta-setting-access.h all: unify format of our Copyright source code comments 2019-10-02 17:03:52 +02:00
nm-meta-setting-desc.c ethtool: refactor how options are hidden if default 2020-04-16 10:52:46 +02:00
nm-meta-setting-desc.h clients: allow properties to be hidden if they have the default value 2020-04-16 10:52:42 +02:00
nm-polkit-listener.c cli/polkit: make parsing polkit-agent-helper-1 protocol more conforming 2020-04-10 10:44:57 +02:00
nm-polkit-listener.h cli/polkit: rename NM_POLKIT_LISTENER_SIGNAL_REQUEST signal to "request-sync" 2020-04-10 10:44:52 +02:00
nm-secret-agent-simple.c clients/secret-agent: don't require secrets for OWE connections 2019-12-05 14:00:10 +01:00
nm-secret-agent-simple.h all: unify format of our Copyright source code comments 2019-10-02 17:03:52 +02:00
nm-vpn-helpers.c clients: set ipv4.dns-priority to a exclusive value (-10) when importing WireGuard profiles 2020-04-08 13:47:26 +02:00
nm-vpn-helpers.h all: unify format of our Copyright source code comments 2019-10-02 17:03:52 +02:00
qrcodegen.c cli: add "nmcli d wifi show" 2019-10-18 17:38:57 +02:00
qrcodegen.h cli: add "nmcli d wifi show" 2019-10-18 17:38:57 +02:00
settings-docs.h.in wireguard: don't let explicit gateway override WireGuard's peer route 2020-04-22 11:36:51 +02:00
settings-docs.xsl cli: fix marking settings docs for translation 2017-04-23 23:45:02 +02:00