Conflict on overlapping WireGuard allowed_ips when merging drafts #82

New issue

Open

opened 2026-11-08 11:04:21 +01:00 by Alex · 0 comments

Alex commented

2026-11-08 11:04:21 +01:00

Owner

Problem

Two authors can each add a peer with the same allowed_ips to one tunnel, and the set-list merge accepts both.
allowed_ips validation in internal/service/wireguard.go only checks CIDR syntax.
Routes reject the same situation as a conflict.

Impact

In the kernel the peer set last wins the prefix, so traffic meant for the first peer silently goes to the second.

Proposed change

Report overlapping allowed_ips within a tunnel as a merge conflict and reject them in validation.
Update the expectation in internal/state/set_list_merge_effects_test.go, which currently records this merge as correct.

Validation

Tests for identical and partly overlapping prefixes, in one draft and across two drafts.

## Problem - Two authors can each add a peer with the same `allowed_ips` to one tunnel, and the set-list merge accepts both. - `allowed_ips` validation in `internal/service/wireguard.go` only checks CIDR syntax. - Routes reject the same situation as a conflict. ## Impact - In the kernel the peer set last wins the prefix, so traffic meant for the first peer silently goes to the second. ## Proposed change - Report overlapping `allowed_ips` within a tunnel as a merge conflict and reject them in validation. - Update the expectation in `internal/state/set_list_merge_effects_test.go`, which currently records this merge as correct. ## Validation - Tests for identical and partly overlapping prefixes, in one draft and across two drafts.

No labels

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Alex/kaido-core#82

No description provided.

Rows
Columns