Re: [WireGuard] Debugging AllowedIps

2016-11-13 Thread John Huttley
Aha, Yes the dmesg command has the debug output. and the solution was to put the explicit /32 for the client on the host not the /24 and 0.0.0.0/0 on the client. Thanks, John On 14/11/16 15:59, Jason A. Donenfeld wrote: On Mon, Nov 14, 2016 at 3:28 AM, John Huttley wrote: I'm usi

Re: [WireGuard] Debugging AllowedIps

2016-11-13 Thread Jason A. Donenfeld
On Mon, Nov 14, 2016 at 3:28 AM, John Huttley wrote: > > I'm using gentoo x64. debug USE is enabled After recompiling with USE=debug, you'll need to remove and then insert the module: # rmmod wireguard # modprobe wireguard If that doesn't do it, then it means you have dynamic debugging enabled

Re: [WireGuard] Debugging AllowedIps

2016-11-13 Thread John Huttley
Thanks Jason, I'm using gentoo x64. debug USE is enabled == emerge -p -v wireguard These are the packages that would be merged, in order: Calculating dependencies... done! [ebuild R *] net-misc/wireguard-::gentoo USE="debug -kmod-src" 0 KiB == there is n

Re: [WireGuard] Debugging AllowedIps

2016-11-13 Thread Jason A. Donenfeld
Hi John, Compile with `make debug`, and in dmesg you'll have lots of debug output. You can also post your configuration and working understanding here, and we'll see if we can help that way too. Jason ___ WireGuard mailing list WireGuard@lists.zx2c4.com

[WireGuard] Debugging AllowedIps

2016-11-13 Thread John Huttley
Hi Team, I've had success with AllowedIPs = 0.0.0.0/0 but not otherwise. Is there a way of get some debug output on this? Regards, John ___ WireGuard mailing list WireGuard@lists.zx2c4.com http://lists.zx2c4.com/mailman/listinfo/wireguard

[WireGuard] [PATCH v3] ip6_output: ensure flow saddr actually belongs to device

2016-11-13 Thread Jason A. Donenfeld
This puts the IPv6 routing functions in parity with the IPv4 routing functions. Namely, we now check in v6 that if a flowi6 requests an saddr, the returned dst actually corresponds to a net device that has that saddr. This mirrors the v4 logic with __ip_dev_find in __ip_route_output_key_hash. In th

Re: [WireGuard] Wireguard in OpenWRT/LEDE: FYI: Pull Request

2016-11-13 Thread Dan Lüdtke
Hi again, here is the pull request for LuCi: https://github.com/openwrt/luci/pull/848 Please support this pull request as well. Thanks for all the beta testers and also to Jason and Baptiste for their help. It was a great pleasure supporting this project. Cheers, Dan > On 13 Nov 2016, at 23

[WireGuard] Wireguard in OpenWRT/LEDE: FYI: Pull Request

2016-11-13 Thread Dan Lüdtke
Hi all, first step of OpenWRT/LEDE integration is making sure the helper script for configuring the interface is installed. The corresponding pull request can be found here: https://github.com/openwrt/packages/pull/3512 Please support this pull request. Once it is accepted, the GUI (luci) will

Re: [WireGuard] [PATCH v2] ip6_output: ensure flow saddr actually belongs to device

2016-11-13 Thread David Ahern
On 11/13/16 12:02 PM, Jason A. Donenfeld wrote: > This puts the IPv6 routing functions in parity with the IPv4 routing > functions. Namely, we now check in v6 that if a flowi6 requests an > saddr, the returned dst actually corresponds to a net device that has > that saddr. This mirrors the v4 logic

Re: [WireGuard] [PATCH] ip6_output: ensure flow saddr actually belongs to device

2016-11-13 Thread David Ahern
On 11/13/16 1:19 PM, Jason A. Donenfeld wrote: > I gave v2 my best shot. Hopefully it's adequate, but I have a feeling > it might be best for you to just code up what you have in mind. nah, you are doing fine. one more comment on v2. ___ WireGuard mailin

Re: [WireGuard] [PATCH] ip6_output: ensure flow saddr actually belongs to device

2016-11-13 Thread Jason A. Donenfeld
Hi David, On Sun, Nov 13, 2016 at 5:30 PM, David Ahern wrote: > You can't require the address to be on the dst device. e.g., it can be an > address from the loopback/vrf device. > > This block needs to be done at function entry, and pass dev as NULL to mean > is the address assigned to any inte

[WireGuard] [PATCH v2] ip6_output: ensure flow saddr actually belongs to device

2016-11-13 Thread Jason A. Donenfeld
This puts the IPv6 routing functions in parity with the IPv4 routing functions. Namely, we now check in v6 that if a flowi6 requests an saddr, the returned dst actually corresponds to a net device that has that saddr. This mirrors the v4 logic with __ip_dev_find in __ip_route_output_key_hash. In th

Re: [WireGuard] [PATCH] ip6_output: ensure flow saddr actually belongs to device

2016-11-13 Thread David Ahern
On 11/13/16 6:23 AM, Jason A. Donenfeld wrote: > This puts the IPv6 routing functions in parity with the IPv4 routing > functions. Namely, we now check in v6 that if a flowi6 requests an > saddr, the returned dst actually corresponds to a net device that has > that saddr. This mirrors the v4 logic

[WireGuard] [PATCH] ip6_output: ensure flow saddr actually belongs to device

2016-11-13 Thread Jason A. Donenfeld
This puts the IPv6 routing functions in parity with the IPv4 routing functions. Namely, we now check in v6 that if a flowi6 requests an saddr, the returned dst actually corresponds to a net device that has that saddr. This mirrors the v4 logic with __ip_dev_find in __ip_route_output_key_hash. In th