From a26b0d11e91e9abca6220e50f0240ab6ae09c6d3 Mon Sep 17 00:00:00 2001 From: Neale Ranns Date: Mon, 14 Sep 2020 08:29:05 +0000 Subject: [PATCH] wireguard: increase FIB source priority Type: fix Signed-off-by: Neale Ranns Change-Id: Icc1c458474d357c7d9b3b4df1897500de0c314a1 --- src/plugins/wireguard/wireguard_peer.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/plugins/wireguard/wireguard_peer.c b/src/plugins/wireguard/wireguard_peer.c index 04b07d97652..30adea82647 100755 --- a/src/plugins/wireguard/wireguard_peer.c +++ b/src/plugins/wireguard/wireguard_peer.c @@ -402,8 +402,13 @@ format_wg_peer (u8 * s, va_list * va) static clib_error_t * wg_peer_module_init (vlib_main_t * vm) { - wg_fib_source = fib_source_allocate ("wireguard", 0xb0, // - FIB_SOURCE_BH_SIMPLE); + /* + * use a priority better than interface source, so that + * if the same subnet is added to the wg interface and is + * used as an allowed IP, then the wireguard soueced prefix + * wins and traffic is routed to the endpoint rather than dropped + */ + wg_fib_source = fib_source_allocate ("wireguard", 0x2, FIB_SOURCE_BH_API); return (NULL); } -- 2.16.6