add wireguard watchdog - #2242
Open
Puzzak01 wants to merge 7 commits into
Open
Conversation
PR Summary by QodoAdd WireGuard watchdog with cron-based health checks
AI Description
Diagram
High-Level Assessment
Files changed (3)
|
Code Review by Qodo
1. Cron directory mismatch
|
![qodo-free-for-open-source-projects[bot]](https://avatars.githubusercontent.com/in/1068000?s=60&v=4){kind=small}
Comment on lines
+6
to
+8
| WIREGUARD_CRONTABS_FLASH="/etc/crontabs/root" | ||
| WIREGUARD_CRONTABS_RAM="/run/cron/crontabs/root" | ||
| WIREGUARD_CRON_MARK="# run wireguard-watchdog every few minutes (autogenerated)" |
There was a problem hiding this comment.
1. Cron directory mismatch 🐞 Bug ≡ Correctness
S98wireguard-watchdog installs the cron entry into /run/cron/crontabs/root, but crond is configured to read /etc/crontabs, so the watchdog job likely never executes.
Agent Prompt
### Issue description
The watchdog installer writes the cron job to `/run/cron/crontabs/root`, but the platform’s `crond` is started with `-c /etc/crontabs`, so it will not read the job file being modified.
### Issue Context
- `S98wireguard-watchdog` currently seeds from `/etc/crontabs/root` but writes updates to `/run/cron/crontabs/root`.
- `S60crond` starts `crond` with `-c /etc/crontabs`.
### Fix Focus Areas
- general/overlay/etc/init.d/S98wireguard-watchdog[6-8]
- general/overlay/etc/init.d/S60crond[3-6]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+3
to
6
| ip link del dev wg0 2>/dev/null || true | ||
|
|
||
| modprobe wireguard || { echo "Error: Failed to load wireguard module." >&2; exit 1; } | ||
| ip link add dev wg0 type wireguard || { echo "Error: Failed to create wg0 interface." >&2; exit 1; } |
There was a problem hiding this comment.
2. Wg0 deleted before validation 🐞 Bug ☼ Reliability
The wireguard script now deletes wg0 before verifying modprobe and interface creation succeed; if either step fails, an existing working tunnel is torn down and not restored.
Agent Prompt
### Issue description
`ip link del dev wg0` runs unconditionally before `modprobe wireguard` and `ip link add`. If `modprobe` or `ip link add` fails, the script exits, leaving the device deleted.
### Issue Context
This is especially risky because the new watchdog can trigger restarts; a transient failure becomes a hard outage.
### Fix Focus Areas
- general/overlay/usr/sbin/wireguard[3-6]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+19
to
+21
| zero_handshake_since=0 | ||
| [ -r "$STATE_FILE" ] && . "$STATE_FILE" | ||
| } |
There was a problem hiding this comment.
4. State file sourcing risk 🐞 Bug ⛨ Security
wireguard-watchdog sources /run/wireguard-watchdog.state as shell code and overwrites it via cp; if that path becomes attacker-controlled (e.g., writable/symlinked), it could enable root code execution or file clobbering.
Agent Prompt
### Issue description
The watchdog loads state by executing `. "$STATE_FILE"` and writes state with `cp` to a fixed path. If the state file is replaced/tampered with, it can execute arbitrary shell code; `cp` also follows symlinks.
### Issue Context
Exploitability depends on runtime permissions for `/run` and the state file, but the pattern is unsafe by design.
### Fix Focus Areas
- general/overlay/usr/sbin/wireguard-watchdog[18-31]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.