wireguard-tools/src/wg-quick, branch master

wg-quick: darwin: properly parse netstat -nr output

2026-05-06T21:21:24Z

Looking at the source [1], it appears that the interface is always the 4th argument, regardless of the family: C1. if (fam != old_fam) // FALSE P1. p_sockaddr(params, &addr.u_sa, &mask.u_sa, rtm->rtm_flags, WID_DST(addr.u_sa.sa_family)); P2. p_sockaddr(params, rti_info[RTAX_GATEWAY], NULL, RTF_HOST, WID_GW(addr.u_sa.sa_family)); C2. if (params->lflag && (rtm->rtm_addrs & RTA_IFA)) // FALSE P3. p_flags(rtm->rtm_flags, "%-10.10s "); C3. if (params->lflag) // FALSE P4. printf("%*.*s", WID_IF(addr.u_sa.sa_family), WID_IF(addr.u_sa.sa_family), ifname); Because C1, C2, and C3 evaluate to false, interface is always in the 4th argument. [1] https://github.com/apple-oss-distributions/network_cmds/blob/97e27e6244c16d399bfeb254315ddc5828711c56/netstat.tproj/route.c#L328 Reported-by: Florian Uekermann Signed-off-by: Jason A. Donenfeld

global: bump copyright

2026-03-21T11:20:43Z

Signed-off-by: Jason A. Donenfeld

wg-quick: linux: do not unnecessarily set sysctl

2026-02-23T21:54:42Z

In some restrictive container namespaces, sysctl is locked down and can't be changed. This shouldn't be a problem, though, at least in theory, because net.ipv4.conf.all.src_valid_mark is already 1. However, currently wg-quick unconditionally sets it. Instead, check to see if it's already 1 before trying make it 1. Suggested-by: Dean P Signed-off-by: Jason A. Donenfeld

wg-quick: use addconf instead of setconf

2025-06-19T15:08:50Z

The example in the man page at some point changed: - \fBPostUp = wg set %i private-key <(pass WireGuard/private-keys/%i)\fP + \fBPreUp = wg set %i private-key <(pass WireGuard/private-keys/%i)\fP This is actually wrong because PreUp is followed by set_config(), which calls `wg setconf`, which in turn deletes the private key from the interface because it is missing from the configuration. Replacing this with `wg addconf` is safe to do because the interface is newly created. Suggested-by: Matthias Dressel Signed-off-by: Jason A. Donenfeld

wg-quick: linux: deal with resolvconf migration more gracefully

2025-05-23T19:01:53Z

When Ubuntu systems upgrade from Debian's atrocious resolvconf to the systemd-resolve symlink, they sometimes leave around /etc/resolvconf/interface-order, which then winds up breaking the detection and passing the bogus 'tun.' prefix to systemd's resolvconf, resulting in failure. Work around this by only doing the 'tun.' prefix hack if resolvconf isn't a symlink. This is ugly but so it goes. Reported-by: Andrei Borzenkov Signed-off-by: Jason A. Donenfeld

wg-quick: pass on # comments to {Pre,Post}{Up,Down}

2025-05-23T18:43:30Z

Currently commands in {Pre,Post}{Up,Down} are stripped of everything starting with the first #, even if the # is escaped or in a string. This patch leaves comment interpretation to the shell, as it can presumably already handle the difference between comments and escaped #. Signed-off-by: Robyn Kosching [Jason: massage commit message, port to other platforms] Signed-off-by: Jason A. Donenfeld

wg-quick: linux: use smallest mtu, not largest

2025-05-21T21:07:59Z

By accident, this function was looking at the endpoint with the largest MTU rather than the smallest one. Reported-by: Ismael Bouya Signed-off-by: Jason A. Donenfeld

wg-quick: linux: add 'dev' to 'ip link add' to avoid keyword conflicts

2025-05-20T22:16:18Z

Signed-off-by: TriangleSnake Signed-off-by: Jason A. Donenfeld

wg-quick: run PreUp hook after creating interface

2023-05-18T14:38:34Z

Currently PreUp hooks run before the interface is created. This is problematic for moving the device into a Linux VRFs as this will currently clear all assigned IPv6 addressess (possibly a bug), so if we did this in PostUp (i.e. before add_addr) we'll have to manually re-add all assigned addresses. This is obviously less than ideal. Instead create the wg device just before running PreUp hooks. We apply this to all platforms for consistency. Test case: $ ip link add vrf-test type vrf table 1234 $ ip link add wg-test type wireguard $ ip addr add dev wg-test 192.168.42.42/24 $ ip addr add dev wg-test fe80::/64 $ ip -br addr show wg-test wg-test DOWN 192.168.42.42/24 fe80::/64 $ ip link set dev wg-test master vrf-test $ ip -br addr show wg-test wg-test DOWN 192.168.42.42/32 Signed-off-by: Daniel Gröber Signed-off-by: Jason A. Donenfeld

wg-quick: linux: prevent traffic from momentarily leaking into tunnel

2022-06-17T11:53:43Z

The wireguard route table ip rule should stay as a no-op until the `suppress_prefixlength 0 table main` rule is in effect. Therefore, add the wireguard default route to its route table after the latter rule is added. Signed-off-by: Tom Yan Signed-off-by: Jason A. Donenfeld