Re: [PATCH] gateway: Fix typo when setting 'is_vpn6'

Ok, right. I get your point, if that feature is missing it will be quite 
impossible to use WG.

Our version with the changes does handle that, and also requires CIDR 
format for IP address, well, check is a bit rudimentary:
https://github.com/sailfishos/connman/blob/master/connman/vpn/plugins/wireguard.c#L201 
but since all goes through getaddrinfo() checks it should work if DNS is 
working on the transport medium.

- Jussi



On 1/23/25 13:49, Christian Hewitt wrote:
> Ignore: https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=90592f7a58358a98bde5df6928e2b871041c12bc
> 
> So I think this is not the feature I’m thinking of, as it discusses Endpoint re-resolving.
> 
> The challenge our users have is ‘Host’ which currently must be an IP address. Upstream WireGuard with wg-quick etc. allows an FQDN. I see users that need to connect to home locations on dynamic IPs where Host will periodically change. I also see users with commercial VPN services which use an FQDN in the (upstream) wireguard configuration format and this resolves to multiple A records (round-robin balancing) and the ‘static’ IPs move around in their ASN range over time in an an attempt to mitigate (poor) IP reputation issues.
> 
> Christian
> 
> 
>> On 23 Jan 2025, at 3:35 pm, Christian Hewitt <[email protected]> wrote:
>>
>> Looking here: https://git.kernel.org/pub/scm/network/connman/connman.git/log/ I’m not finding "wireguard: Regular reresolve endpoint address” and the first page of log goes back to December ’23. Are we using the wrong upstream?
>>
>> Christian
>>
>>> On 23 Jan 2025, at 3:22 pm, Jussi Laakkonen <[email protected]> wrote:
>>>
>>> Hi Christian,
>>>
>>> That is actually in upstream, all the commits regarding WireGuard before July 10, 2024 are taken from the latest upstream and the changes after that are new features.
>>>
>>> Well, the vpn.c changes do depend on having the ASSOCIATION state also for VPNs to be implemented, that was proposed in the RFC https://lore.kernel.org/connman/[email protected]/T/#mbced39d72dd424884fe105a66fea02a83c708f97 as the state transitions depend on that bit. But it does not seem to be depending on the gateway.c/connection.c. Well, I can try to squeeze time to address the issues Daniel earlier raised on that RFC and push them to upstream, then make a big change on the vpn.c and wireguard.c.
>>>
>>> Br,
>>> Jussi
>>>
>>>
>>> On 1/23/25 13:12, Christian Hewitt wrote:
>>>> You don't often get email from [email protected]. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>
>>>> Ohh.. I would be VERY keen to see support for FQDN’s resolving to dynamic IP’s upstreamed so this looks interesting:
>>>> https://github.com/sailfishos/connman/commit/adb6ab2b49a2b822e6517d703f972b866fdbd8bd
>>>> Is that feature dependent on any other changes? (being lazy.. I didn’t read all the commits in that branch yet!).
>>>> Christian
>>>> On 23 Jan 2025, at 3:06 pm, Jussi Laakkonen <[email protected]> wrote:
>>>> Hello,
>>>> Regarding WireGuard, I had to make a bunch of changes to the latest version of it to get it running properly on our fork (yes, we upgrade it slowly, now 1.38): https://github.com/sailfishos/connman/commits/master/connman/vpn
>>>> But I haven't had time to figure out all that is needed for upstream to be sent first, like this RFC edit that was forgotten because of... "eastern winds blowing into our direction": https://lore.kernel.org/connman/[email protected]/T/#mbced39d72dd424884fe105a66fea02a83c708f97
>>>> And then the connection.c was modified a lot (and renamed) and I'm not sure if these will work on top of that anymore. Mostly because we have features that may not have been compatible with latest upstream, like adding a support  for two different devices to be belonging into one service to facilitate CLAT support https://github.com/sailfishos/connman/commits/master/connman/src/connection.c etc. etc. etc.
>>>> At some point I'll start pushing changes but not sure when I have time. Mostly they could be RFCs as the changes are big.
>>>> BR,
>>>> Jussi
>>>> On 1/23/25 12:45, daniel antoine wrote:
>>>> Hi
>>>> I have opened a ticket for connman-vpn not working with wireguard  in
>>>> April 2024. If you give me the patches I can test them
>>>> Best regards
>>>> Daniel
>>>> Le mer. 22 janv. 2025 à 18:01, Grant Erickson
>>>> <[email protected]> a écrit :
>>>> On Jan 13, 2025, at 5:59 AM, Gabriel Sanches <[email protected]> wrote:
>>>> I was testing connman's wireguard plugin and got a segmentation fault.
>>>> Looking at the backtrace revealed that there are some typos in the `src/gateway.c` file where `is_vpn6` was incorrectly set using ipv4 variables instead of ipv6 regarding vpn.
>>>> I simply changed them to ipv6 and got it working.
>>>> not related to the patch:
>>>> I had to manually add ip route so the other devices could be pinged
>>>> The plugin adds routes for the WireGuard.DNS configuration setting
>>>> # ip route
>>>> 1.1.1.1 dev wg0 scope link
>>>> 8.8.8.8 dev wg0 scope link
>>>> 10.42.0.0/24 dev end1 proto kernel scope link src 10.42.0.83
>>>> 10.42.0.1 dev end1 scope link
>>>> <vpn host ip> via 10.42.0.1 dev end1
>>>> the missing route added manually:
>>>> ip route add 10.33.0.0/16 dev wg0 scope link
>>>> an equivalent wireguard file adds it properly (using wg-quick)
>>>> Is the plugin lacking some implementation?
>>>> ---
>>>> src/gateway.c | 6 +++---
>>>> 1 file changed, 3 insertions(+), 3 deletions(-)
>>>> diff --git a/src/gateway.c b/src/gateway.c
>>>> index 16c87f83..b2c211e2 100644
>>>> --- a/src/gateway.c
>>>> +++ b/src/gateway.c
>>>> @@ -3704,10 +3704,10 @@ int __connman_gateway_add(struct connman_service *service,
>>>>                                       is_gateway_config_vpn(
>>>>                                               new_gateway->ipv4_config);
>>>> -             is_vpn6 = do_ipv4 &&
>>>> -                                     new_gateway->ipv4_config &&
>>>> +             is_vpn6 = do_ipv6 &&
>>>> +                                     new_gateway->ipv6_config &&
>>>>                                       is_gateway_config_vpn(
>>>> -                                             new_gateway->ipv4_config);
>>>> +                                             new_gateway->ipv6_config);
>>>>       } else {
>>>>               if (do_ipv4 && new_gateway->ipv4_config)
>>>> --
>>>> 2.43.0
>>>> Gabriel,
>>>> Great catch on this copy-and-paste typo; thank you!
>>>> Best,
>>>> Grant
>>>
>>
>