Skip to content

Commit f484a30

Browse files
author
Paolo Abeni
committed
Merge branch 'wireguard-updates-for-6-16'
Jason A. Donenfeld says: ==================== wireguard updates for 6.16 This small series contains mostly cleanups and one new feature: 1) Kees' __nonstring annotation comes to wireguard. 2) Two selftest fixes, one to help with compilation on gcc 15, and one removing stale config options. 3) Adoption of NLA_POLICY_MASK. 4) Jordan has added the ability to run: # wg set ... peer ... allowed-ips -192.168.1.0/24 Which will remove the allowed IP for that peer. Previously you had to replace all the IPs non-atomically, or move it to a dummy peer atomically, which wasn't very clean. ==================== Link: https://patch.msgid.link/[email protected] Signed-off-by: Paolo Abeni <[email protected]>
2 parents 358bea9 + ca8bf8f commit f484a30

File tree

10 files changed

+194
-57
lines changed

10 files changed

+194
-57
lines changed

‎drivers/net/wireguard/allowedips.c

Lines changed: 71 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,52 @@ static int add(struct allowedips_node __rcu **trie, u8 bits, const u8 *key,
249249
return 0;
250250
}
251251

252+
static void remove_node(struct allowedips_node *node, struct mutex *lock)
253+
{
254+
struct allowedips_node *child, **parent_bit, *parent;
255+
bool free_parent;
256+
257+
list_del_init(&node->peer_list);
258+
RCU_INIT_POINTER(node->peer, NULL);
259+
if (node->bit[0] && node->bit[1])
260+
return;
261+
child = rcu_dereference_protected(node->bit[!rcu_access_pointer(node->bit[0])],
262+
lockdep_is_held(lock));
263+
if (child)
264+
child->parent_bit_packed = node->parent_bit_packed;
265+
parent_bit = (struct allowedips_node **)(node->parent_bit_packed & ~3UL);
266+
*parent_bit = child;
267+
parent = (void *)parent_bit -
268+
offsetof(struct allowedips_node, bit[node->parent_bit_packed & 1]);
269+
free_parent = !rcu_access_pointer(node->bit[0]) && !rcu_access_pointer(node->bit[1]) &&
270+
(node->parent_bit_packed & 3) <= 1 && !rcu_access_pointer(parent->peer);
271+
if (free_parent)
272+
child = rcu_dereference_protected(parent->bit[!(node->parent_bit_packed & 1)],
273+
lockdep_is_held(lock));
274+
call_rcu(&node->rcu, node_free_rcu);
275+
if (!free_parent)
276+
return;
277+
if (child)
278+
child->parent_bit_packed = parent->parent_bit_packed;
279+
*(struct allowedips_node **)(parent->parent_bit_packed & ~3UL) = child;
280+
call_rcu(&parent->rcu, node_free_rcu);
281+
}
282+
283+
static int remove(struct allowedips_node __rcu **trie, u8 bits, const u8 *key,
284+
u8 cidr, struct wg_peer *peer, struct mutex *lock)
285+
{
286+
struct allowedips_node *node;
287+
288+
if (unlikely(cidr > bits))
289+
return -EINVAL;
290+
if (!rcu_access_pointer(*trie) || !node_placement(*trie, key, cidr, bits, &node, lock) ||
291+
peer != rcu_access_pointer(node->peer))
292+
return 0;
293+
294+
remove_node(node, lock);
295+
return 0;
296+
}
297+
252298
void wg_allowedips_init(struct allowedips *table)
253299
{
254300
table->root4 = table->root6 = NULL;
@@ -300,44 +346,38 @@ int wg_allowedips_insert_v6(struct allowedips *table, const struct in6_addr *ip,
300346
return add(&table->root6, 128, key, cidr, peer, lock);
301347
}
302348

349+
int wg_allowedips_remove_v4(struct allowedips *table, const struct in_addr *ip,
350+
u8 cidr, struct wg_peer *peer, struct mutex *lock)
351+
{
352+
/* Aligned so it can be passed to fls */
353+
u8 key[4] __aligned(__alignof(u32));
354+
355+
++table->seq;
356+
swap_endian(key, (const u8 *)ip, 32);
357+
return remove(&table->root4, 32, key, cidr, peer, lock);
358+
}
359+
360+
int wg_allowedips_remove_v6(struct allowedips *table, const struct in6_addr *ip,
361+
u8 cidr, struct wg_peer *peer, struct mutex *lock)
362+
{
363+
/* Aligned so it can be passed to fls64 */
364+
u8 key[16] __aligned(__alignof(u64));
365+
366+
++table->seq;
367+
swap_endian(key, (const u8 *)ip, 128);
368+
return remove(&table->root6, 128, key, cidr, peer, lock);
369+
}
370+
303371
void wg_allowedips_remove_by_peer(struct allowedips *table,
304372
struct wg_peer *peer, struct mutex *lock)
305373
{
306-
struct allowedips_node *node, *child, **parent_bit, *parent, *tmp;
307-
bool free_parent;
374+
struct allowedips_node *node, *tmp;
308375

309376
if (list_empty(&peer->allowedips_list))
310377
return;
311378
++table->seq;
312-
list_for_each_entry_safe(node, tmp, &peer->allowedips_list, peer_list) {
313-
list_del_init(&node->peer_list);
314-
RCU_INIT_POINTER(node->peer, NULL);
315-
if (node->bit[0] && node->bit[1])
316-
continue;
317-
child = rcu_dereference_protected(node->bit[!rcu_access_pointer(node->bit[0])],
318-
lockdep_is_held(lock));
319-
if (child)
320-
child->parent_bit_packed = node->parent_bit_packed;
321-
parent_bit = (struct allowedips_node **)(node->parent_bit_packed & ~3UL);
322-
*parent_bit = child;
323-
parent = (void *)parent_bit -
324-
offsetof(struct allowedips_node, bit[node->parent_bit_packed & 1]);
325-
free_parent = !rcu_access_pointer(node->bit[0]) &&
326-
!rcu_access_pointer(node->bit[1]) &&
327-
(node->parent_bit_packed & 3) <= 1 &&
328-
!rcu_access_pointer(parent->peer);
329-
if (free_parent)
330-
child = rcu_dereference_protected(
331-
parent->bit[!(node->parent_bit_packed & 1)],
332-
lockdep_is_held(lock));
333-
call_rcu(&node->rcu, node_free_rcu);
334-
if (!free_parent)
335-
continue;
336-
if (child)
337-
child->parent_bit_packed = parent->parent_bit_packed;
338-
*(struct allowedips_node **)(parent->parent_bit_packed & ~3UL) = child;
339-
call_rcu(&parent->rcu, node_free_rcu);
340-
}
379+
list_for_each_entry_safe(node, tmp, &peer->allowedips_list, peer_list)
380+
remove_node(node, lock);
341381
}
342382

343383
int wg_allowedips_read_node(struct allowedips_node *node, u8 ip[16], u8 *cidr)

‎drivers/net/wireguard/allowedips.h

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,10 @@ int wg_allowedips_insert_v4(struct allowedips *table, const struct in_addr *ip,
3838
u8 cidr, struct wg_peer *peer, struct mutex *lock);
3939
int wg_allowedips_insert_v6(struct allowedips *table, const struct in6_addr *ip,
4040
u8 cidr, struct wg_peer *peer, struct mutex *lock);
41+
int wg_allowedips_remove_v4(struct allowedips *table, const struct in_addr *ip,
42+
u8 cidr, struct wg_peer *peer, struct mutex *lock);
43+
int wg_allowedips_remove_v6(struct allowedips *table, const struct in6_addr *ip,
44+
u8 cidr, struct wg_peer *peer, struct mutex *lock);
4145
void wg_allowedips_remove_by_peer(struct allowedips *table,
4246
struct wg_peer *peer, struct mutex *lock);
4347
/* The ip input pointer should be __aligned(__alignof(u64))) */

‎drivers/net/wireguard/cookie.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,8 @@ void wg_cookie_checker_init(struct cookie_checker *checker,
2626
}
2727

2828
enum { COOKIE_KEY_LABEL_LEN = 8 };
29-
static const u8 mac1_key_label[COOKIE_KEY_LABEL_LEN] = "mac1----";
30-
static const u8 cookie_key_label[COOKIE_KEY_LABEL_LEN] = "cookie--";
29+
static const u8 mac1_key_label[COOKIE_KEY_LABEL_LEN] __nonstring = "mac1----";
30+
static const u8 cookie_key_label[COOKIE_KEY_LABEL_LEN] __nonstring = "cookie--";
3131

3232
static void precompute_key(u8 key[NOISE_SYMMETRIC_KEY_LEN],
3333
const u8 pubkey[NOISE_PUBLIC_KEY_LEN],

‎drivers/net/wireguard/netlink.c

Lines changed: 27 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ static const struct nla_policy device_policy[WGDEVICE_A_MAX + 1] = {
2424
[WGDEVICE_A_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ - 1 },
2525
[WGDEVICE_A_PRIVATE_KEY] = NLA_POLICY_EXACT_LEN(NOISE_PUBLIC_KEY_LEN),
2626
[WGDEVICE_A_PUBLIC_KEY] = NLA_POLICY_EXACT_LEN(NOISE_PUBLIC_KEY_LEN),
27-
[WGDEVICE_A_FLAGS] = { .type = NLA_U32 },
27+
[WGDEVICE_A_FLAGS] = NLA_POLICY_MASK(NLA_U32, __WGDEVICE_F_ALL),
2828
[WGDEVICE_A_LISTEN_PORT] = { .type = NLA_U16 },
2929
[WGDEVICE_A_FWMARK] = { .type = NLA_U32 },
3030
[WGDEVICE_A_PEERS] = { .type = NLA_NESTED }
@@ -33,7 +33,7 @@ static const struct nla_policy device_policy[WGDEVICE_A_MAX + 1] = {
3333
static const struct nla_policy peer_policy[WGPEER_A_MAX + 1] = {
3434
[WGPEER_A_PUBLIC_KEY] = NLA_POLICY_EXACT_LEN(NOISE_PUBLIC_KEY_LEN),
3535
[WGPEER_A_PRESHARED_KEY] = NLA_POLICY_EXACT_LEN(NOISE_SYMMETRIC_KEY_LEN),
36-
[WGPEER_A_FLAGS] = { .type = NLA_U32 },
36+
[WGPEER_A_FLAGS] = NLA_POLICY_MASK(NLA_U32, __WGPEER_F_ALL),
3737
[WGPEER_A_ENDPOINT] = NLA_POLICY_MIN_LEN(sizeof(struct sockaddr)),
3838
[WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL] = { .type = NLA_U16 },
3939
[WGPEER_A_LAST_HANDSHAKE_TIME] = NLA_POLICY_EXACT_LEN(sizeof(struct __kernel_timespec)),
@@ -46,7 +46,8 @@ static const struct nla_policy peer_policy[WGPEER_A_MAX + 1] = {
4646
static const struct nla_policy allowedip_policy[WGALLOWEDIP_A_MAX + 1] = {
4747
[WGALLOWEDIP_A_FAMILY] = { .type = NLA_U16 },
4848
[WGALLOWEDIP_A_IPADDR] = NLA_POLICY_MIN_LEN(sizeof(struct in_addr)),
49-
[WGALLOWEDIP_A_CIDR_MASK] = { .type = NLA_U8 }
49+
[WGALLOWEDIP_A_CIDR_MASK] = { .type = NLA_U8 },
50+
[WGALLOWEDIP_A_FLAGS] = NLA_POLICY_MASK(NLA_U32, __WGALLOWEDIP_F_ALL),
5051
};
5152

5253
static struct wg_device *lookup_interface(struct nlattr **attrs,
@@ -329,6 +330,7 @@ static int set_port(struct wg_device *wg, u16 port)
329330
static int set_allowedip(struct wg_peer *peer, struct nlattr **attrs)
330331
{
331332
int ret = -EINVAL;
333+
u32 flags = 0;
332334
u16 family;
333335
u8 cidr;
334336

@@ -337,19 +339,30 @@ static int set_allowedip(struct wg_peer *peer, struct nlattr **attrs)
337339
return ret;
338340
family = nla_get_u16(attrs[WGALLOWEDIP_A_FAMILY]);
339341
cidr = nla_get_u8(attrs[WGALLOWEDIP_A_CIDR_MASK]);
342+
if (attrs[WGALLOWEDIP_A_FLAGS])
343+
flags = nla_get_u32(attrs[WGALLOWEDIP_A_FLAGS]);
340344

341345
if (family == AF_INET && cidr <= 32 &&
342-
nla_len(attrs[WGALLOWEDIP_A_IPADDR]) == sizeof(struct in_addr))
343-
ret = wg_allowedips_insert_v4(
344-
&peer->device->peer_allowedips,
345-
nla_data(attrs[WGALLOWEDIP_A_IPADDR]), cidr, peer,
346-
&peer->device->device_update_lock);
347-
else if (family == AF_INET6 && cidr <= 128 &&
348-
nla_len(attrs[WGALLOWEDIP_A_IPADDR]) == sizeof(struct in6_addr))
349-
ret = wg_allowedips_insert_v6(
350-
&peer->device->peer_allowedips,
351-
nla_data(attrs[WGALLOWEDIP_A_IPADDR]), cidr, peer,
352-
&peer->device->device_update_lock);
346+
nla_len(attrs[WGALLOWEDIP_A_IPADDR]) == sizeof(struct in_addr)) {
347+
if (flags & WGALLOWEDIP_F_REMOVE_ME)
348+
ret = wg_allowedips_remove_v4(&peer->device->peer_allowedips,
349+
nla_data(attrs[WGALLOWEDIP_A_IPADDR]), cidr,
350+
peer, &peer->device->device_update_lock);
351+
else
352+
ret = wg_allowedips_insert_v4(&peer->device->peer_allowedips,
353+
nla_data(attrs[WGALLOWEDIP_A_IPADDR]), cidr,
354+
peer, &peer->device->device_update_lock);
355+
} else if (family == AF_INET6 && cidr <= 128 &&
356+
nla_len(attrs[WGALLOWEDIP_A_IPADDR]) == sizeof(struct in6_addr)) {
357+
if (flags & WGALLOWEDIP_F_REMOVE_ME)
358+
ret = wg_allowedips_remove_v6(&peer->device->peer_allowedips,
359+
nla_data(attrs[WGALLOWEDIP_A_IPADDR]), cidr,
360+
peer, &peer->device->device_update_lock);
361+
else
362+
ret = wg_allowedips_insert_v6(&peer->device->peer_allowedips,
363+
nla_data(attrs[WGALLOWEDIP_A_IPADDR]), cidr,
364+
peer, &peer->device->device_update_lock);
365+
}
353366

354367
return ret;
355368
}
@@ -373,9 +386,6 @@ static int set_peer(struct wg_device *wg, struct nlattr **attrs)
373386

374387
if (attrs[WGPEER_A_FLAGS])
375388
flags = nla_get_u32(attrs[WGPEER_A_FLAGS]);
376-
ret = -EOPNOTSUPP;
377-
if (flags & ~__WGPEER_F_ALL)
378-
goto out;
379389

380390
ret = -EPFNOSUPPORT;
381391
if (attrs[WGPEER_A_PROTOCOL_VERSION]) {
@@ -506,9 +516,6 @@ static int wg_set_device(struct sk_buff *skb, struct genl_info *info)
506516

507517
if (info->attrs[WGDEVICE_A_FLAGS])
508518
flags = nla_get_u32(info->attrs[WGDEVICE_A_FLAGS]);
509-
ret = -EOPNOTSUPP;
510-
if (flags & ~__WGDEVICE_F_ALL)
511-
goto out;
512519

513520
if (info->attrs[WGDEVICE_A_LISTEN_PORT] || info->attrs[WGDEVICE_A_FWMARK]) {
514521
struct net *net;

‎drivers/net/wireguard/noise.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,8 @@
2525
* <- e, ee, se, psk, {}
2626
*/
2727

28-
static const u8 handshake_name[37] = "Noise_IKpsk2_25519_ChaChaPoly_BLAKE2s";
29-
static const u8 identifier_name[34] = "WireGuard v1 zx2c4 [email protected]";
28+
static const u8 handshake_name[37] __nonstring = "Noise_IKpsk2_25519_ChaChaPoly_BLAKE2s";
29+
static const u8 identifier_name[34] __nonstring = "WireGuard v1 zx2c4 [email protected]";
3030
static u8 handshake_init_hash[NOISE_HASH_LEN] __ro_after_init;
3131
static u8 handshake_init_chaining_key[NOISE_HASH_LEN] __ro_after_init;
3232
static atomic64_t keypair_counter = ATOMIC64_INIT(0);

‎drivers/net/wireguard/selftest/allowedips.c

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -460,6 +460,10 @@ static __init struct wg_peer *init_peer(void)
460460
wg_allowedips_insert_v##version(&t, ip##version(ipa, ipb, ipc, ipd), \
461461
cidr, mem, &mutex)
462462

463+
#define remove(version, mem, ipa, ipb, ipc, ipd, cidr) \
464+
wg_allowedips_remove_v##version(&t, ip##version(ipa, ipb, ipc, ipd), \
465+
cidr, mem, &mutex)
466+
463467
#define maybe_fail() do { \
464468
++i; \
465469
if (!_s) { \
@@ -585,6 +589,50 @@ bool __init wg_allowedips_selftest(void)
585589
test_negative(4, a, 192, 0, 0, 0);
586590
test_negative(4, a, 255, 0, 0, 0);
587591

592+
insert(4, a, 1, 0, 0, 0, 32);
593+
insert(4, a, 192, 0, 0, 0, 24);
594+
insert(6, a, 0x24446801, 0x40e40800, 0xdeaebeef, 0xdefbeef, 128);
595+
insert(6, a, 0x24446800, 0xf0e40800, 0xeeaebeef, 0, 98);
596+
test(4, a, 1, 0, 0, 0);
597+
test(4, a, 192, 0, 0, 1);
598+
test(6, a, 0x24446801, 0x40e40800, 0xdeaebeef, 0xdefbeef);
599+
test(6, a, 0x24446800, 0xf0e40800, 0xeeaebeef, 0x10101010);
600+
/* Must be an exact match to remove */
601+
remove(4, a, 192, 0, 0, 0, 32);
602+
test(4, a, 192, 0, 0, 1);
603+
/* NULL peer should have no effect and return 0 */
604+
test_boolean(!remove(4, NULL, 192, 0, 0, 0, 24));
605+
test(4, a, 192, 0, 0, 1);
606+
/* different peer should have no effect and return 0 */
607+
test_boolean(!remove(4, b, 192, 0, 0, 0, 24));
608+
test(4, a, 192, 0, 0, 1);
609+
/* invalid CIDR should have no effect and return -EINVAL */
610+
test_boolean(remove(4, b, 192, 0, 0, 0, 33) == -EINVAL);
611+
test(4, a, 192, 0, 0, 1);
612+
remove(4, a, 192, 0, 0, 0, 24);
613+
test_negative(4, a, 192, 0, 0, 1);
614+
remove(4, a, 1, 0, 0, 0, 32);
615+
test_negative(4, a, 1, 0, 0, 0);
616+
/* Must be an exact match to remove */
617+
remove(6, a, 0x24446801, 0x40e40800, 0xdeaebeef, 0xdefbeef, 96);
618+
test(6, a, 0x24446801, 0x40e40800, 0xdeaebeef, 0xdefbeef);
619+
/* NULL peer should have no effect and return 0 */
620+
test_boolean(!remove(6, NULL, 0x24446801, 0x40e40800, 0xdeaebeef, 0xdefbeef, 128));
621+
test(6, a, 0x24446801, 0x40e40800, 0xdeaebeef, 0xdefbeef);
622+
/* different peer should have no effect and return 0 */
623+
test_boolean(!remove(6, b, 0x24446801, 0x40e40800, 0xdeaebeef, 0xdefbeef, 128));
624+
test(6, a, 0x24446801, 0x40e40800, 0xdeaebeef, 0xdefbeef);
625+
/* invalid CIDR should have no effect and return -EINVAL */
626+
test_boolean(remove(6, a, 0x24446801, 0x40e40800, 0xdeaebeef, 0xdefbeef, 129) == -EINVAL);
627+
test(6, a, 0x24446801, 0x40e40800, 0xdeaebeef, 0xdefbeef);
628+
remove(6, a, 0x24446801, 0x40e40800, 0xdeaebeef, 0xdefbeef, 128);
629+
test_negative(6, a, 0x24446801, 0x40e40800, 0xdeaebeef, 0xdefbeef);
630+
/* Must match the peer to remove */
631+
remove(6, b, 0x24446800, 0xf0e40800, 0xeeaebeef, 0, 98);
632+
test(6, a, 0x24446800, 0xf0e40800, 0xeeaebeef, 0x10101010);
633+
remove(6, a, 0x24446800, 0xf0e40800, 0xeeaebeef, 0, 98);
634+
test_negative(6, a, 0x24446800, 0xf0e40800, 0xeeaebeef, 0x10101010);
635+
588636
wg_allowedips_free(&t, &mutex);
589637
wg_allowedips_init(&t);
590638
insert(4, a, 192, 168, 0, 0, 16);

‎include/uapi/linux/wireguard.h

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,10 @@
101101
* WGALLOWEDIP_A_FAMILY: NLA_U16
102102
* WGALLOWEDIP_A_IPADDR: struct in_addr or struct in6_addr
103103
* WGALLOWEDIP_A_CIDR_MASK: NLA_U8
104+
* WGALLOWEDIP_A_FLAGS: NLA_U32, WGALLOWEDIP_F_REMOVE_ME if
105+
* the specified IP should be removed;
106+
* otherwise, this IP will be added if
107+
* it is not already present.
104108
* 0: NLA_NESTED
105109
* ...
106110
* 0: NLA_NESTED
@@ -184,11 +188,16 @@ enum wgpeer_attribute {
184188
};
185189
#define WGPEER_A_MAX (__WGPEER_A_LAST - 1)
186190

191+
enum wgallowedip_flag {
192+
WGALLOWEDIP_F_REMOVE_ME = 1U << 0,
193+
__WGALLOWEDIP_F_ALL = WGALLOWEDIP_F_REMOVE_ME
194+
};
187195
enum wgallowedip_attribute {
188196
WGALLOWEDIP_A_UNSPEC,
189197
WGALLOWEDIP_A_FAMILY,
190198
WGALLOWEDIP_A_IPADDR,
191199
WGALLOWEDIP_A_CIDR_MASK,
200+
WGALLOWEDIP_A_FLAGS,
192201
__WGALLOWEDIP_A_LAST
193202
};
194203
#define WGALLOWEDIP_A_MAX (__WGALLOWEDIP_A_LAST - 1)

‎tools/testing/selftests/wireguard/netns.sh

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -611,6 +611,35 @@ n0 wg set wg0 peer "$pub2" allowed-ips "$allowedips"
611611
} < <(n0 wg show wg0 allowed-ips)
612612
ip0 link del wg0
613613

614+
allowedips=( )
615+
for i in {1..197}; do
616+
allowedips+=( 192.168.0.$i )
617+
allowedips+=( abcd::$i )
618+
done
619+
saved_ifs="$IFS"
620+
IFS=,
621+
allowedips="${allowedips[*]}"
622+
IFS="$saved_ifs"
623+
ip0 link add wg0 type wireguard
624+
n0 wg set wg0 peer "$pub1" allowed-ips "$allowedips"
625+
n0 wg set wg0 peer "$pub1" allowed-ips -192.168.0.1/32,-192.168.0.20/32,-192.168.0.100/32,-abcd::1/128,-abcd::20/128,-abcd::100/128
626+
{
627+
read -r pub allowedips
628+
[[ $pub == "$pub1" ]]
629+
i=0
630+
for ip in $allowedips; do
631+
[[ $ip != "192.168.0.1" ]]
632+
[[ $ip != "192.168.0.20" ]]
633+
[[ $ip != "192.168.0.100" ]]
634+
[[ $ip != "abcd::1" ]]
635+
[[ $ip != "abcd::20" ]]
636+
[[ $ip != "abcd::100" ]]
637+
((++i))
638+
done
639+
((i == 388))
640+
} < <(n0 wg show wg0 allowed-ips)
641+
ip0 link del wg0
642+
614643
! n0 wg show doesnotexist || false
615644

616645
ip0 link add wg0 type wireguard

‎tools/testing/selftests/wireguard/qemu/Makefile

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ $(eval $(call tar_download,IPROUTE2,iproute2,5.17.0,.tar.gz,https://www.kernel.o
4343
$(eval $(call tar_download,IPTABLES,iptables,1.8.7,.tar.bz2,https://www.netfilter.org/projects/iptables/files/,c109c96bb04998cd44156622d36f8e04b140701ec60531a10668cfdff5e8d8f0))
4444
$(eval $(call tar_download,NMAP,nmap,7.92,.tgz,https://nmap.org/dist/,064183ea642dc4c12b1ab3b5358ce1cef7d2e7e11ffa2849f16d339f5b717117))
4545
$(eval $(call tar_download,IPUTILS,iputils,s20190709,.tar.gz,https://github.com/iputils/iputils/archive/s20190709.tar.gz/#,a15720dd741d7538dd2645f9f516d193636ae4300ff7dbc8bfca757bf166490a))
46-
$(eval $(call tar_download,WIREGUARD_TOOLS,wireguard-tools,1.0.20210914,.tar.xz,https://git.zx2c4.com/wireguard-tools/snapshot/,97ff31489217bb265b7ae850d3d0f335ab07d2652ba1feec88b734bc96bd05ac))
46+
$(eval $(call tar_download,WIREGUARD_TOOLS,wireguard-tools,1.0.20250521,.tar.xz,https://git.zx2c4.com/wireguard-tools/snapshot/,b6f2628b85b1b23cc06517ec9c74f82d52c4cdbd020f3dd2f00c972a1782950e))
4747

4848
export CFLAGS := -O3 -pipe
4949
ifeq ($(HOST_ARCH),$(ARCH))
@@ -401,6 +401,7 @@ $(BASH_PATH)/.installed: $(BASH_TAR)
401401
flock -s $<.lock tar -C $(BUILD_PATH) -xf $<
402402
touch $@
403403

404+
$(BASH_PATH)/bash: export CFLAGS_FOR_BUILD += -std=gnu17
404405
$(BASH_PATH)/bash: | $(BASH_PATH)/.installed $(USERSPACE_DEPS)
405406
cd $(BASH_PATH) && ./configure --prefix=/ $(CROSS_COMPILE_FLAG) --without-bash-malloc --disable-debugger --disable-help-builtin --disable-history --disable-progcomp --disable-readline --disable-mem-scramble
406407
$(MAKE) -C $(BASH_PATH)

0 commit comments

Comments
 (0)