Package: wireguard-tools Version: 1.0.20210914-1+b1 Severity: normal Tags: patch upstream X-Debbugs-Cc: [email protected], [email protected]
Dear Maintainer, currently wg-quick has a bug in it's handling of PreUp actions that prevents (easily) moving a wireguard interface into an IPv6 VRF. I managed to convince upstream to merge a trivial [patch] to fix this problem but it hasn't been released yet. [patch]: https://git.zx2c4.com/wireguard-tools/commit/?id=e6888dd74ee4215449517f43aba9c11a1633ea4e I would appreciate it if we could get this patch applied in Debian to fix this use-case (perhaps even as a stable update if you think this is appropriate). Thanks, --Daniel Quoting from the [patch] commit message: Currently PreUp hooks run before the interface is created. This is problematic for moving the device into a Linux VRFs as this will currently clear all assigned IPv6 addressess (possibly a bug), so if we did this in PostUp (i.e. before add_addr) we'll have to manually re-add all assigned addresses. This is obviously less than ideal. Instead create the wg device just before running PreUp hooks. We apply this to all platforms for consistency. Test case: $ ip link add vrf-test type vrf table 1234 $ ip link add wg-test type wireguard $ ip addr add dev wg-test 192.168.42.42/24 $ ip addr add dev wg-test fe80::/64 $ ip -br addr show wg-test wg-test DOWN 192.168.42.42/24 fe80::/64 $ ip link set dev wg-test master vrf-test $ ip -br addr show wg-test wg-test DOWN 192.168.42.42/32 -- System Information: Debian Release: 12.0 APT prefers stable APT policy: (990, 'stable'), (500, 'stable-security'), (500, 'stable-debug'), (500, 'proposed-updates-debug') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 6.1.0-9-amd64 (SMP w/16 CPU threads; PREEMPT) Kernel taint flags: TAINT_WARN Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages wireguard-tools depends on: ii libc6 2.36-9 Versions of packages wireguard-tools recommends: ii iptables 1.8.9-2 ii linux-image-amd64 [wireguard-modules] 6.1.27-1 ii nftables 1.0.6-2 Versions of packages wireguard-tools suggests: pn openresolv | resolvconf <none> -- no debconf information
