From cfe1237f3859c0cb19b98a47870f49942d5537d9 Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Sun, 16 Jan 2022 15:53:13 +0900
Subject: [PATCH 1/2] network: wireguard: do not add routes to AllowedIPs= by
 default

As setting such routes may break existing setups.

Closes #21964.
---
 man/systemd.netdev.xml         |  2 +-
 src/network/netdev/wireguard.c | 10 ++--------
 2 files changed, 3 insertions(+), 9 deletions(-)

diff --git a/man/systemd.netdev.xml b/man/systemd.netdev.xml
index 7d5c0ac729..051c45c748 100644
--- a/man/systemd.netdev.xml
+++ b/man/systemd.netdev.xml
@@ -1581,7 +1581,7 @@
           <citerefentry><refentrytitle>networkd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
           or a number in the range 1…4294967295. When <literal>off</literal> the routes to the
           addresses specified in the <varname>AllowedIPs=</varname> setting will not be configured.
-          Defaults to <literal>main</literal>. This setting will be ignored when the same setting is
+          Defaults to <literal>off</literal>. This setting will be ignored when the same setting is
           specified in the [WireGuardPeer] section.</para>
         </listitem>
       </varlistentry>
diff --git a/src/network/netdev/wireguard.c b/src/network/netdev/wireguard.c
index af91dc6257..2b26a92f5d 100644
--- a/src/network/netdev/wireguard.c
+++ b/src/network/netdev/wireguard.c
@@ -895,13 +895,8 @@ int config_parse_wireguard_route_table(
         assert(data);
         assert(userdata);
 
-        if (isempty(rvalue)) {
-                *table = RT_TABLE_MAIN;
-                return 0;
-        }
-
-        if (streq(rvalue, "off")) {
-                *table = 0;
+        if (isempty(rvalue) || streq(rvalue, "off")) {
+                *table = 0; /* Disabled. */
                 return 0;
         }
 
@@ -1061,7 +1056,6 @@ static void wireguard_init(NetDev *netdev) {
         assert(w);
 
         w->flags = WGDEVICE_F_REPLACE_PEERS;
-        w->route_table = RT_TABLE_MAIN;
 }
 
 static void wireguard_done(NetDev *netdev) {

From e135559d805e749a0a1f8d1396cf71f6edd94831 Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Sun, 16 Jan 2022 15:59:45 +0900
Subject: [PATCH 2/2] network: wireguard: also accept negative boolean values
 to disable adding routes

RouteTable=off was introduced to provide consistency with wg-quick
command. This makes the RouteTable= settings accepts other negative
boolean values.
---
 man/systemd.netdev.xml         | 16 ++++++++--------
 src/network/netdev/wireguard.c |  4 ++--
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/man/systemd.netdev.xml b/man/systemd.netdev.xml
index 051c45c748..ee5b61a068 100644
--- a/man/systemd.netdev.xml
+++ b/man/systemd.netdev.xml
@@ -1575,14 +1575,14 @@
         <term><varname>RouteTable=</varname></term>
         <listitem>
           <para>The table identifier for the routes to the addresses specified in the
-          <varname>AllowedIPs=</varname>. Takes the special value <literal>off</literal>, one of the
-          predefined names <literal>default</literal>, <literal>main</literal>, and
-          <literal>local</literal>, names defined in <varname>RouteTable=</varname> in
+          <varname>AllowedIPs=</varname>. Takes a negative boolean value, one of the predefined names
+          <literal>default</literal>, <literal>main</literal>, and <literal>local</literal>, names
+          defined in <varname>RouteTable=</varname> in
           <citerefentry><refentrytitle>networkd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
           or a number in the range 1…4294967295. When <literal>off</literal> the routes to the
           addresses specified in the <varname>AllowedIPs=</varname> setting will not be configured.
-          Defaults to <literal>off</literal>. This setting will be ignored when the same setting is
-          specified in the [WireGuardPeer] section.</para>
+          Defaults to false. This setting will be ignored when the same setting is specified in the
+          [WireGuardPeer] section.</para>
         </listitem>
       </varlistentry>
       <varlistentry>
@@ -1682,9 +1682,9 @@
         <term><varname>RouteTable=</varname></term>
         <listitem>
           <para>The table identifier for the routes to the addresses specified in the
-          <varname>AllowedIPs=</varname>. Takes the special value <literal>off</literal>, one of the
-          predefined names <literal>default</literal>, <literal>main</literal>, and
-          <literal>local</literal>, names defined in <varname>RouteTable=</varname> in
+          <varname>AllowedIPs=</varname>. Takes a negative boolean value, one of the predefined names
+          <literal>default</literal>, <literal>main</literal>, and <literal>local</literal>, names
+          defined in <varname>RouteTable=</varname> in
           <citerefentry><refentrytitle>networkd.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
           or a number in the range 1…4294967295. Defaults to unset, and the value specified in the
           same setting in the [WireGuard] section will be used.</para>
diff --git a/src/network/netdev/wireguard.c b/src/network/netdev/wireguard.c
index 2b26a92f5d..88f668753a 100644
--- a/src/network/netdev/wireguard.c
+++ b/src/network/netdev/wireguard.c
@@ -895,7 +895,7 @@ int config_parse_wireguard_route_table(
         assert(data);
         assert(userdata);
 
-        if (isempty(rvalue) || streq(rvalue, "off")) {
+        if (isempty(rvalue) || parse_boolean(rvalue) == 0) {
                 *table = 0; /* Disabled. */
                 return 0;
         }
@@ -947,7 +947,7 @@ int config_parse_wireguard_peer_route_table(
                 return 0;
         }
 
-        if (streq(rvalue, "off")) {
+        if (parse_boolean(rvalue) == 0) {
                 peer->route_table = 0; /* Disabled. */
                 peer->route_table_set = true;
                 TAKE_PTR(peer);