pjandro/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-11-06 21:25:04 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(wireguard): hold /0 allowedIPs to the overlap guard

Browse Source 
The tunnel overlap guard treated every /0 allowedIPs entry as claiming
no address, while the entry was stored with its host bits and the
consumers read them back: the AmneziaWG port forwarder resolves a peer's
target from them and the device routes the /0 by longest prefix. An
entry such as 10.8.1.2/0 therefore passed next to another client's
10.8.1.2/32, and forwarded ports reached that client's device.

A written entry now counts with its whole range, so a /0 collides with
every held address of its family. On the stored side only a literal
0.0.0.0/0 or ::/0 default route keeps nobody out, and a /0 with host
bits claims that host. Editing a legacy peer that echoes its stored
default route still works.
This commit is contained in:
MHSanaei
2026-11-01 00:06:09 +01:00
parent d114845e44
commit daf5b16eda
8 changed files with 196 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/service/client_inbound_apply.go
+1 -1
View File
@@ -833,7 +833,7 @@ func (s *ClientService) UpdateInboundClient(inboundSvc *InboundService, data *mo
}
peers = append(peers, oldClients[i].AllowedIPs...)
}
if entry, taken := wireguardAllowedIPsOverlap(normalized, peers); taken != "" {
if entry, taken := wireguardAllowedIPsOverlap(withoutKeptDefaultRoutes(normalized, old.AllowedIPs), peers); taken != "" {
return false, common.NewError("wireguard: allowedIPs entry", entry, "overlaps", taken, "used by another client")
}
clients[0].AllowedIPs = normalized