docs(fork-prs): #34/#42 landed in wireguard_lwip submodule PR, #31 not needed - #59
Merged
Merged
Conversation
…t needed Batched the wireguard_lwip-submodule candidates that had piled up across sessions 5-9 (#31, #34, #35's remaining piece, #42). - #34 (handshake retry throttle) and #42 (DERP-routing-flag preservation) are both small, independent, and entirely within wireguardif.c/.h -- adapted and opened as fugo101/wireguard-lwip#15. Rows stay open until that PR merges, a new submodule version releases, and the pointer here gets bumped (same two-step flow as issue #43's TAI64N fix / PR #46). - #31 (LOCK_TCPIP_CORE around netif_set_link_up/down) investigated and found not needed: LOCK_TCPIP_CORE()/UNLOCK_TCPIP_CORE() expand to nothing when LWIP_TCPIP_CORE_LOCKING is disabled (this fork's default), so it's a no-op here. Its ip_input()->tcpip_input() change duplicates what this fork already does independently (issue #30). The rest of the commit disables WireGuard's cryptokey-routing source-IP validation entirely plus scattered debug printf's -- a security-relevant scope change, not something to fold in silently. No port planned. #35's remaining submodule piece (backpressure/TCP_NODELAY/hot-spin fixes in wireguardif.c) not triaged this pass -- left for a future session. Co-authored-by: Adrian.Nguyen-Qualgo <nguyen.ndt@qualgo.net> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Update rows 15/#34 and 22/#42: the submodule PR merged shortly after this branch was opened. release-please auto-opened its usual release PR (fugo101/wireguard-lwip#16, "release 1.0.2") -- merging that is the next step, then a follow-up PR here bumps the submodule pointer. Co-authored-by: Adrian.Nguyen-Qualgo <nguyen.ndt@qualgo.net> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Batched the
wireguard_lwip-submodule candidates that had piled up across sessions 5-9 (#31, #34, #35's remaining piece, #42) rather than continuing to defer them one-at-a-time.wireguardif.c/.h— adapted and opened asfugo101/wireguard-lwip#15.FORK_PRS.mdrows stay open in this repo until that PR merges, a new submodule version releases, and the pointer here gets bumped — same two-step flow as issue Adapt dj-oyu/microlink fixes: TAI64N replay-after-reboot, DERP-to-direct re-handshake, LOCK_TCPIP_CORE no-op, DISCO PONG rate-limiting #43's TAI64N fix (fugo101/wireguard-lwip#13→ v1.0.1 → PR chore: bump wireguard_lwip submodule to v1.0.1 #46 here).LOCK_TCPIP_COREaroundnetif_set_link_up/down) investigated and found not needed:LOCK_TCPIP_CORE()/UNLOCK_TCPIP_CORE()expand to nothing whenLWIP_TCPIP_CORE_LOCKINGis disabled (this fork's default in every example, confirmed inlwip/tcpip.h), so the fix is a no-op here. Itsip_input()→tcpip_input()change also duplicates what this fork already does independently (issue Resolve conflict: ip_input() vs netif->input threading fix for decrypted WG RX (cplewes vs Csontikka) #30's resolution). The rest of the commit disables WireGuard's cryptokey-routing source-IP validation entirely ("accept all source IPs") plus scattered debugprintfs — a security-relevant scope change contradictingFORK_PRS.md's own "not worth pursuing" note aboutGrieferPig/microlink(praised there for having correct src-IP validation). No port planned.#35's remaining submodule piece (backpressure/TCP_NODELAY/hot-spin-loop fixes, also in
wireguardif.c) was not triaged this pass — left as a named next step rather than folded in, to keep this batch reviewable.No issues closed by this PR — #31 gets a "not needed" note, #34/#42 stay open pending the submodule PR.
Test plan
N/A — documentation only in this repo. The actual code changes are in
fugo101/wireguard-lwip#15, reviewed separately.🤖 Generated with Claude Code