upstream/wireguard-tools
1
0
Fork 0
mirror of https://git.zx2c4.com/wireguard-tools synced 2026-02-03 20:29:29 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions
WireGuard - Outils userspace
473 commits 3 branches 14 tags 778 KiB
C 68.7%
Shell 14.8%
Roff 4.3%
C++ 3.9%
Haskell 1.6%
Other 6.7%
Find a file
Jordan Rife 0788f90810 ipc: linux: support incremental allowed ips updates 
Extend the interface of `wg set` to leverage the WGALLOWEDIP_F_REMOVE_ME
flag, a direct way of removing a single allowed ip from a peer,
allowing for incremental updates to a peer's configuration. By default,
allowed-ips fully replaces a peer's allowed ips using
WGPEER_REPLACE_ALLOWEDIPS under the hood. When '+' or '-' is prepended
to any ip in the list, wg clears WGPEER_F_REPLACE_ALLOWEDIPS and sets
the WGALLOWEDIP_F_REMOVE_ME flag on any ip prefixed with '-'.

$ wg set wg0 peer <PUBKEY> allowed-ips +192.168.88.0/24,-192.168.0.1/32

This command means "add 192.168.88.0/24 to this peer's allowed ips if
not present, and remove 192.168.0.1/32 if present".

Use -isystem so that headers in uapi/ take precedence over system
headers; otherwise, the build will fail on systems running kernels
without the WGALLOWEDIP_F_REMOVE_ME flag.

Note that this patch is meant to be merged alongside the kernel patch
that introduces the flag.

Signed-off-by: Jordan Rife <jordan@jrife.io>
[Jason: removed linux ifdefs; this will eventually come to other platforms too. minor style nits.]
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2025-05-20 22:03:58 +02:00
contrib reresolve-dns: use $EPOCHSECONDS instead of $(date +%s) 2022-01-04 13:07:49 +01:00
src ipc: linux: support incremental allowed ips updates 2025-05-20 22:03:58 +02:00
.gitattributes git: add gitattributes so tarball doesn't have gitignore files 2020-04-08 23:54:42 -06:00
.gitignore ipc: add wireguard-nt support 2021-07-20 13:24:18 +02:00
COPYING Initial commit 2016-06-25 16:48:39 +02:00
README.md netlink: remove libmnl requirement 2020-02-03 18:17:27 +01:00

README.md

wireguard-tools — tools for configuring WireGuard

This supplies the main userspace tooling for using and configuring WireGuard tunnels, including the wg(8) and wg-quick(8) utilities. This project supports Linux, OpenBSD, FreeBSD, macOS, Windows, and Android.

More information may be found at WireGuard.com.

Building

$ cd src
$ make

There are no dependencies other than a good C compiler and a sane libc.

Installing

# make install

This command takes into account several environment variables:

  • PREFIX default: /usr

  • DESTDIR default:

  • BINDIR default: $(PREFIX)/bin

  • LIBDIR default: $(PREFIX)/lib

  • MANDIR default: $(PREFIX)/share/man

  • BASHCOMPDIR default: $(PREFIX)/share/bash-completion/completions

  • RUNSTATEDIR default: /var/run

  • PKG_CONFIG default: pkg-config

  • WITH_BASHCOMPLETION default: [auto-detect]

  • WITH_WGQUICK default: [auto-detect]

  • WITH_SYSTEMDUNITS default: [auto-detect]

  • DEBUG default:

The first section is rather standard. The second section is not:

  • WITH_BASHCOMPLETION decides whether or not bash completion files for the tools are installed. This is just a nice thing for people who have bash. If you don't have bash, or don't want this, set the environment variable to no. If you'd like to force its use, even if bash-completion isn't detected in DESTDIR, then set it to yes.

  • WITH_WGQUICK decides whether or not the wg-quick(8) script is installed. This is a very quick and dirty bash script for reading a few extra variables from wg(8)-style configuration files, and automatically configures the interface. If you don't have bash, you probably don't want this at all. Likewise, if you already have a working network management tool or configuration, you probably want to integrate wg(8) or the direct WireGuard API into your network manager, rather than using wg-quick(8). But for folks who like simple quick and dirty scripts, this is nice. If you'd like to force its use, even if bash isn't detected in DESTDIR, then set it to yes.

  • WITH_SYSTEMDUNITS decides whether or not systemd units are installed for wg-quick(8). If you don't use systemd, you certainly don't want this, and should set it to no. If systemd isn't auto-detected, but you still would like to install it, set this to yes.

  • DEBUG decides whether to build with -g, when set to yes.

If you're a simple make && make install kind of user, you can get away with not setting these variables and relying on the auto-detection. However, if you're writing a package for a distro, you'll want to explicitly set these, depending on what you want.

contrib/

The contrib/ subdirectory contains various scripts and examples. Most of these are not immediately useful for production use, but should provide inspiration for creating fully-featured tools. See the README in each directory.

License

This project is released under the GPLv2.