diff options
| author |   Jason A. Donenfeld <Jason@zx2c4.com> | 2019-12-05 18:33:15 +0100 |
|---|---|---|
| committer | Jason A. Donenfeld <Jason@zx2c4.com> | 2019-12-05 18:33:18 +0100 |
| commit | 3928ebb87de6069be44d520e6bf82ef57f8b7f91 (patch) | |
| tree | 3e08a5cf7c7bd2e4d01e47d65981fcf13a638e3d | |
| parent | wg-quick: linux: iptables-* -w is not widely supported (diff) | |
| download | wireguard-tools-3928ebb87de6069be44d520e6bf82ef57f8b7f91.tar.xz wireguard-tools-3928ebb87de6069be44d520e6bf82ef57f8b7f91.zip | |
wg-quick: linux: some iptables don't like empty lines
Reported-by: Kenneth R. Crudup <kenny@panix.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
| -rwxr-xr-x | src/wg-quick/linux.bash | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/src/wg-quick/linux.bash b/src/wg-quick/linux.bash index fc90e55..d2c2ba9 100755 --- a/src/wg-quick/linux.bash +++ b/src/wg-quick/linux.bash @@ -188,9 +188,9 @@ remove_iptables() { while read -r line; do [[ $line == "*"* || $line == COMMIT || $line == "-A "*"-m comment --comment \"wg-quick(8) rule for $INTERFACE\""* ]] || continue [[ $line == "-A"* ]] && found=1 - printf -v restore '%s\n%s' "$restore" "${line/#-A/-D}" + printf -v restore '%s%s\n' "$restore" "${line/#-A/-D}" done < <($iptables-save) - [[ $found -ne 1 ]] || echo "$restore" | cmd $iptables-restore -n + [[ $found -ne 1 ]] || echo -n "$restore" | cmd $iptables-restore -n done } @@ -210,14 +210,14 @@ add_default() { cmd ip $proto rule add not fwmark $table table $table cmd ip $proto rule add table main suppress_prefixlength 0 - local marker="-m comment --comment \"wg-quick(8) rule for $INTERFACE\"" restore="*raw" + local marker="-m comment --comment \"wg-quick(8) rule for $INTERFACE\"" restore=$'*raw\n' for i in "${ADDRESSES[@]}"; do [[ ( $proto == -4 && $i != *:* ) || ( $proto == -6 && $i == *:* ) ]] || continue - printf -v restore '%s\n-I PREROUTING ! -i %s -d %s -m addrtype ! --src-type LOCAL -j DROP %s\n' "$restore" "$INTERFACE" "${i%/*}" "$marker" + printf -v restore '%s-I PREROUTING ! -i %s -d %s -m addrtype ! --src-type LOCAL -j DROP %s\n' "$restore" "$INTERFACE" "${i%/*}" "$marker" done - printf -v restore '%s\nCOMMIT\n*mangle\n-I POSTROUTING -m mark --mark %d -p udp -j CONNMARK --save-mark %s\n-I PREROUTING -p udp -j CONNMARK --restore-mark %s\nCOMMIT\n' "$restore" $table "$marker" "$marker" + printf -v restore '%sCOMMIT\n*mangle\n-I POSTROUTING -m mark --mark %d -p udp -j CONNMARK --save-mark %s\n-I PREROUTING -p udp -j CONNMARK --restore-mark %s\nCOMMIT\n' "$restore" $table "$marker" "$marker" [[ $proto == -4 ]] && cmd sysctl -q net.ipv4.conf.all.src_valid_mark=1 - echo "$restore" | cmd $iptables-restore -n + echo -n "$restore" | cmd $iptables-restore -n HAVE_SET_IPTABLES=1 return 0 } |