feat: allowed_subnets for site-to-site/relay (integrates #3, hardened)#4
Merged
Conversation
…m users device allowed subnets
Integrates fherbert's relay-subnet feature (routed subnets -> peer allowed-ips, ip routes, and forward-chain jumps) with hardening before merge: - rebase migration onto current head (was branching, causing two alembic heads) - validate/normalize subnets via parse_subnet_list (rejects non-CIDR, blocks nft injection) - restrict relay subnets to the admin device page only (removed from user page) - drop the contributor's semantic-release version bump and CHANGELOG
Route management is now reconcile-style via wireguard.sync_routes: it makes the interface's relay routes exactly match the DB (adds missing, removes orphans) and never touches the tunnel networks. Device delete/update and startup reconcile all route through it, so removing a device or one of its subnets no longer leaves a stale ip route behind. Shared subnets are preserved.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Integrates PR #3 (fherbert) onto current
mainwith fixes applied before merge.What it adds
Per-device
allowed_subnets: routed subnets are appended to the peer's WireGuard allowed-ips, getip routes via the wg interface, and forward-chain jumps into the user's nftables chain (site-to-site / relay).Changes vs the original PR
d8b3a1f06e57— the original branched offb7e2f4a1c903, which would have created two Alembic heads and brokenalembic upgrade headon startup.parse_subnet_list): subnets are validated + normalized before reachingnft/ip route, rejecting non-CIDR input (blocks command injection and stops one bad entry from failing the whole firewall rebuild).Tests
Known follow-up
Removing a subnet from a device leaves a stale
ip route(reconcile only adds routes) — carried over from the original PR, not a regression.Original authorship preserved via the merge parent (fherbert's commits).