wireguard-tools, branch master

wg-quick: darwin: properly parse netstat -nr output

2026-05-06T21:21:24Z

Looking at the source [1], it appears that the interface is always the 4th argument, regardless of the family: C1. if (fam != old_fam) // FALSE P1. p_sockaddr(params, &addr.u_sa, &mask.u_sa, rtm->rtm_flags, WID_DST(addr.u_sa.sa_family)); P2. p_sockaddr(params, rti_info[RTAX_GATEWAY], NULL, RTF_HOST, WID_GW(addr.u_sa.sa_family)); C2. if (params->lflag && (rtm->rtm_addrs & RTA_IFA)) // FALSE P3. p_flags(rtm->rtm_flags, "%-10.10s "); C3. if (params->lflag) // FALSE P4. printf("%*.*s", WID_IF(addr.u_sa.sa_family), WID_IF(addr.u_sa.sa_family), ifname); Because C1, C2, and C3 evaluate to false, interface is always in the 4th argument. [1] https://github.com/apple-oss-distributions/network_cmds/blob/97e27e6244c16d399bfeb254315ddc5828711c56/netstat.tproj/route.c#L328 Reported-by: Florian Uekermann Signed-off-by: Jason A. Donenfeld

ipc: freebsd: add allowed-ip flags support for FreeBSD

2026-03-24T02:27:26Z

The FreeBSD kernel flags will match what we define here in wg(8), just pass them through and let the kernel sort it out. Signed-off-by: Kyle Evans Signed-off-by: Jason A. Donenfeld

ipc: windows: support incremental allowed ips updates

2026-03-24T02:22:51Z

Following the Linux case, now support the same API on Windows. Signed-off-by: Jason A. Donenfeld

global: bump copyright

2026-03-21T11:20:43Z

Signed-off-by: Jason A. Donenfeld

wg: windows: raise min windows version to 10

2026-03-21T10:42:07Z

Signed-off-by: Jason A. Donenfeld

version: bump

2026-02-23T22:24:27Z

Signed-off-by: Jason A. Donenfeld

syncconf: account for persistent keepalive removed from config file

2026-02-23T22:23:04Z

Otherwise removing a persistent keepalive from a config file wouldn't reflect on the runtime state. Signed-off-by: Jason A. Donenfeld

config: preserve const correctness

2026-02-23T22:10:51Z

Signed-off-by: Jason A. Donenfeld

wg-quick@.service: add deps on wg-quick.target

2026-02-23T22:02:07Z

These dependencies ensure that instances of this service are started before wg-quick.target is considered started, allowing other services to depend on wg-quick.target to mean "all wg-quick services are started" Signed-off-by: Doug Freed Signed-off-by: Jason A. Donenfeld

wg-quick: linux: do not unnecessarily set sysctl

2026-02-23T21:54:42Z

In some restrictive container namespaces, sysctl is locked down and can't be changed. This shouldn't be a problem, though, at least in theory, because net.ipv4.conf.all.src_valid_mark is already 1. However, currently wg-quick unconditionally sets it. Instead, check to see if it's already 1 before trying make it 1. Suggested-by: Dean P Signed-off-by: Jason A. Donenfeld