Project

General

Profile

Bug #11618

WireGuard using incorrect IPv6 tunnel address prefix length

Added by Reza Arbab 2 months ago. Updated about 2 months ago.

Status:
Feedback
Priority:
Normal
Assignee:
Category:
WireGuard
Target version:
Start date:
03/03/2021
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
Release Notes:
Default
Affected Version:
2.5.0
Affected Architecture:

Description

Example; if I specify a tunnel with address fc00:bbbb:bbbb:bb01::9:xxxx/128, this is how it gets configured:

/sbin/ifconfig 'wg0' inet6 'fc00:bbbb:bbbb:bb01::9:xxxx' netmask '255.255.255.255'

This command ends up assigning the interface a /64 subnet instead of the desired /128. When I then try to add a second tunnel, with address fc00:bbbb:bbbb:bb01::8:xxxx/128, it fails because that's in the same /64:

The following input errors were detected:
fc00:bbbb:bbbb:bb01::8:xxxx/128 is already configured on this firewall: OPT10 (fc00:bbbb:bbbb:bb01::9:xxxx/64)

The attached patch fixes things for me so that the first interface is created properly and I can add the second:

/sbin/ifconfig 'wg0' inet6 'fc00:bbbb:bbbb:bb01::9:xxxx' prefixlen '128'
wg.inc.patch (589 Bytes) wg.inc.patch Reza Arbab, 03/03/2021 04:15 PM

Associated revisions

Revision 8579d26b (diff)
Added by Jim Pingle 2 months ago

Use correct parameters when adding WG IPv6 tunnel addr. Fixes #11618

Revision d76f5796 (diff)
Added by Jim Pingle 2 months ago

Use correct parameters when adding WG IPv6 tunnel addr. Fixes #11618

(cherry picked from commit 8579d26bfb0dea0386c61008ade222c0ea29aa98)

History

#1 Updated by Jim Pingle 2 months ago

  • Subject changed from vpn_wg_edit.php: Interface created with incorrect inet6 prefixlen to WireGuard using incorrect IPv6 tunnel address prefix length
  • Target version set to CE-Next

#2 Updated by Jim Pingle 2 months ago

  • Assignee set to Jim Pingle
  • Target version changed from CE-Next to 2.5.1

#3 Updated by Jim Pingle 2 months ago

That's easy enough to reproduce and check:

  • Set WG instance tunnel address to include 2001:db8:1:ee71::1/64 and confirm ifconfig wg0 shows 2001:db8:1:ee71::1/64
  • Change tunnel address to 2001:db8:1:ee71::1/128 and ifconfig wg0 incorrectly shows 2001:db8:1:ee71::1/64
  • Apply fix
  • Save the tunnel again with the tunnel address set to 2001:db8:1:ee71::1/128, ifconfig wg0 correctly shows 2001:db8:1:ee71::1/128
  • Set WG instance tunnel address back to 2001:db8:1:ee71::1/64 and confirm ifconfig wg0 correctly shows 2001:db8:1:ee71::1/64

Fix committed, will show up shortly.

#4 Updated by Jim Pingle 2 months ago

  • Status changed from New to Feedback
  • % Done changed from 0 to 100

#5 Updated by Jim Pingle 2 months ago

  • Status changed from Feedback to Waiting on Merge

#6 Updated by Renato Botelho 2 months ago

  • Status changed from Waiting on Merge to Feedback

Cherry-picked to RELENG_2_5_1

#7 Updated by Jim Pingle about 2 months ago

  • Target version changed from 2.5.1 to Future

Also available in: Atom PDF