diff options
| author |   David Woodhouse <dwmw@amazon.co.uk> | 2026-10-30 16:38:06 +0000 |
|---|---|---|
| committer |   Jason A. Donenfeld <Jason@zx2c4.com> | 2026-11-10 18:58:45 +0100 |
| commit | 6d02c757940afc798e0eb294108262c3e55b1c5d (patch) | |
| tree | 49652057e232c65516a76dc25338c0e8f5effb13 /tools | |
| parent | wireguard: timers: mark racy persistent_keepalive_interval accesses (diff) | |
WireGuard attempts to reply from the address to which the original
packet was sent, caching it in endpoint->src4 and validating it before
each use with inet_confirm_addr(..., RT_SCOPE_HOST).
For Legacy IP that validation always fails for an address on a point-
to-point interface, because confirm_addr_indev() insists on
inet_ifa_match(), which compares against ifa_address — the *peer*
address on a p2p link — under a /32 mask. The local address is never
within that "subnet", so a perfectly valid source address is discarded
and send4() falls back to kernel source address selection.
For peers on the far side of the p2p link, the fallback happens to
select the same address and nobody notices. But when a peer on a local
LAN sends to the p2p address (e.g. my OpenWrt box listening on its
external PPPoE address), the reply is sent from the LAN interface's own
address instead. A stateful firewall on the peer then drops the reply
as unrelated to the flow it originated, and the handshake never
completes.
inet_confirm_addr() is an ARP helper answering "do I have an address
on the same subnet as this"; what send4() wants to ask is only "is
this still a local address". Use __ip_dev_find() for that, matching
what send6() already does with ipv6_chk_addr(). IPv6 does not have
this problem.
Fixes: e7096c131e51 ("net: WireGuard secure network tunnel")
Cc: stable@vger.kernel.org
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
[ Jason: add test to netns.sh to make sure this doesn't resurface. ]
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Diffstat (limited to 'tools')
| -rwxr-xr-x | tools/testing/selftests/wireguard/netns.sh | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/tools/testing/selftests/wireguard/netns.sh b/tools/testing/selftests/wireguard/netns.sh index a8f550aecb35..d9c2174b6278 100755 --- a/tools/testing/selftests/wireguard/netns.sh +++ b/tools/testing/selftests/wireguard/netns.sh @@ -480,6 +480,11 @@ ip2 route add 10.50.0.0/24 dev veth2 n2 wg set wg0 peer "$pub1" endpoint 10.50.0.1:1 n2 ping -W 1 -c 1 192.168.241.1 [[ $(n2 wg show wg0 endpoints) == "$pub1 10.50.0.1:1" ]] +# And verify it works with p2p addresses too +ip1 addr del 10.50.0.1/24 dev dummy0 +ip1 addr add 10.50.0.1 peer 10.50.0.2/32 dev dummy0 +n2 ping -W 1 -c 1 192.168.241.1 +[[ $(n2 wg show wg0 endpoints) == "$pub1 10.50.0.1:1" ]] ip1 link del dummy0 ip1 addr flush dev veth1 |