[git.ipfire.org] IPFire 2.x development tree branch, next, updated. f4fa8b317d41fa5650ddcad5d42cdee1affc51e5

[Michael Tremer <git@ipfire.org>]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  f4fa8b317d41fa5650ddcad5d42cdee1affc51e5 (commit)
       via  3948ba05ec12cddf75a70174baa75097107c407b (commit)
      from  25ac8dbdcf88184daa9e41bcc4cc489a5d3a5f11 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit f4fa8b317d41fa5650ddcad5d42cdee1affc51e5
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Fri Apr 25 14:11:49 2025 +0200

    wireguard: Don't block RW peer traffic
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit 3948ba05ec12cddf75a70174baa75097107c407b
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Fri Apr 25 14:06:36 2025 +0200

    wireguard-functions.pl: Fix collecting used IP addresses
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 config/cfgroot/wireguard-functions.pl | 9 +++++----
 src/initscripts/system/wireguard      | 6 ++++++
 2 files changed, 11 insertions(+), 4 deletions(-)

Difference in files:
diff --git a/config/cfgroot/wireguard-functions.pl b/config/cfgroot/wireguard-functions.pl
index 219f9282d..c8af939b5 100644
--- a/config/cfgroot/wireguard-functions.pl
+++ b/config/cfgroot/wireguard-functions.pl
@@ -340,13 +340,14 @@ sub free_pool_addresses($$) {
 
 	# Collect all used addresses
 	foreach my $key (keys %peers) {
-		my $type    = $peers{$key}[1];
-		my $address = $peers{$key}[6];
+		my $peer = &load_peer($key);
 
 		# Only check hosts
-		next if ($type ne "host");
+		next if ($peer->{"TYPE"} ne "host");
 
-		push(@used_addresses, &Network::ip2bin($address));
+		foreach my $address (@{ $peer->{"CLIENT_ADDRESS"} }) {
+			push(@used_addresses, &Network::ip2bin($address));
+		}
 	}
 
 	# Fetch the first address
diff --git a/src/initscripts/system/wireguard b/src/initscripts/system/wireguard
index 7632d6114..9321b09c4 100644
--- a/src/initscripts/system/wireguard
+++ b/src/initscripts/system/wireguard
@@ -285,6 +285,12 @@ reload_firewall() {
 
 	iptables -F WGBLOCK
 
+	# Don't block any traffic from Roadwarrior peers
+	if [ -n "${CLIENT_POOL}" ]; then
+		iptables -A WGBLOCK -s "${CLIENT_POOL}" -i wg0 -j RETURN
+		iptables -A WGBLOCK -d "${CLIENT_POOL}" -o wg0 -j RETURN
+	fi
+
 	# Block all other traffic
 	iptables -A WGBLOCK -j REJECT --reject-with icmp-admin-prohibited
 }


hooks/post-receive
--
IPFire 2.x development tree