--- a/src/wg-quick/linux.bash	2025-09-03 17:11:13.000000000 +0300
+++ b/src/wg-quick/linux.bash	2025-12-06 16:13:52.022333503 +0300
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/opt/bin/bash
 # SPDX-License-Identifier: GPL-2.0
 #
 # Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
@@ -18,10 +18,6 @@
 DNS=( )
 DNS_SEARCH=( )
 TABLE=""
-PRE_UP=( )
-POST_UP=( )
-PRE_DOWN=( )
-POST_DOWN=( )
 SAVE_CONFIG=0
 CONFIG_FILE=""
 PROGRAM="${0##*/}"
@@ -40,11 +36,10 @@
 parse_options() {
 	local interface_section=0 line key value stripped v
 	CONFIG_FILE="$1"
-	[[ $CONFIG_FILE =~ ^[a-zA-Z0-9_=+.-]{1,15}$ ]] && CONFIG_FILE="/etc/amnezia/amneziawg/$CONFIG_FILE.conf"
+	[[ $CONFIG_FILE =~ ^[a-zA-Z0-9_=+.-]{1,15}$ ]] && CONFIG_FILE="/opt/etc/amnezia/amneziawg/$CONFIG_FILE.conf"
 	[[ -e $CONFIG_FILE ]] || die "\`$CONFIG_FILE' does not exist"
 	[[ $CONFIG_FILE =~ (^|/)([a-zA-Z0-9_=+.-]{1,15})\.conf$ ]] || die "The config file must be a valid interface name, followed by .conf"
 	CONFIG_FILE="$(readlink -f "$CONFIG_FILE")"
-	((($(stat -c '0%#a' "$CONFIG_FILE") & $(stat -c '0%#a' "${CONFIG_FILE%/*}") & 0007) == 0)) || echo "Warning: \`$CONFIG_FILE' is world accessible" >&2
 	INTERFACE="${BASH_REMATCH[2]}"
 	shopt -s nocasematch
 	while read -r line || [[ -n $line ]]; do
@@ -60,12 +55,6 @@
 			DNS) for v in ${value//,/ }; do
 				[[ $v =~ (^[0-9.]+$)|(^.*:.*$) ]] && DNS+=( $v ) || DNS_SEARCH+=( $v )
 			done; continue ;;
-			Table) TABLE="$value"; continue ;;
-			PreUp) PRE_UP+=( "$value" ); continue ;;
-			PreDown) PRE_DOWN+=( "$value" ); continue ;;
-			PostUp) POST_UP+=( "$value" ); continue ;;
-			PostDown) POST_DOWN+=( "$value" ); continue ;;
-			SaveConfig) read_bool SAVE_CONFIG "$value"; continue ;;
 			esac
 		fi
 		WG_CONFIG+="$line"$'\n'
@@ -81,38 +70,11 @@
 	esac
 }
 
-auto_su() {
-	[[ $UID == 0 ]] || exec sudo -p "$PROGRAM must be run as root. Please enter the password for %u to continue: " -- "$BASH" -- "$SELF" "${ARGS[@]}"
-}
-
 add_if() {
-	local ret
-	if ! cmd ip link add "$INTERFACE" type amneziawg; then
-		ret=$?
-		[[ -e /sys/module/amneziawg ]] || ! command -v "${WG_QUICK_USERSPACE_IMPLEMENTATION:-amneziawg-go}" >/dev/null && exit $ret
-		echo "[!] Missing WireGuard (Amnezia VPN) kernel module. Falling back to slow userspace implementation." >&2
-		cmd "${WG_QUICK_USERSPACE_IMPLEMENTATION:-amneziawg-go}" "$INTERFACE"
-	fi
+	cmd amneziawg-go "$INTERFACE"
 }
 
 del_if() {
-	local table
-	[[ $HAVE_SET_DNS -eq 0 ]] || unset_dns
-	[[ $HAVE_SET_FIREWALL -eq 0 ]] || remove_firewall
-	if [[ -z $TABLE || $TABLE == auto ]] && get_fwmark table && [[ $(awg show "$INTERFACE" allowed-ips) =~ /0(\ |$'\n'|$) ]]; then
-		while [[ $(ip -4 rule show 2>/dev/null) == *"lookup $table"* ]]; do
-			cmd ip -4 rule delete table $table
-		done
-		while [[ $(ip -4 rule show 2>/dev/null) == *"from all lookup main suppress_prefixlength 0"* ]]; do
-			cmd ip -4 rule delete table main suppress_prefixlength 0
-		done
-		while [[ $(ip -6 rule show 2>/dev/null) == *"lookup $table"* ]]; do
-			cmd ip -6 rule delete table $table
-		done
-		while [[ $(ip -6 rule show 2>/dev/null) == *"from all lookup main suppress_prefixlength 0"* ]]; do
-			cmd ip -6 rule delete table main suppress_prefixlength 0
-		done
-	fi
 	cmd ip link delete dev "$INTERFACE"
 }
 
@@ -141,109 +103,16 @@
 	cmd ip link set mtu $(( mtu - 80 )) up dev "$INTERFACE"
 }
 
-resolvconf_iface_prefix() {
-	[[ -f /etc/resolvconf/interface-order ]] || return 0
-	local iface
-	while read -r iface; do
-		[[ $iface =~ ^([A-Za-z0-9-]+)\*$ ]] || continue
-		echo "${BASH_REMATCH[1]}." && return 0
-	done < /etc/resolvconf/interface-order
-}
-
-HAVE_SET_DNS=0
-set_dns() {
-	[[ ${#DNS[@]} -gt 0 ]] || return 0
-	{ printf 'nameserver %s\n' "${DNS[@]}"
-	  [[ ${#DNS_SEARCH[@]} -eq 0 ]] || printf 'search %s\n' "${DNS_SEARCH[*]}"
-	} | cmd resolvconf -a "$(resolvconf_iface_prefix)$INTERFACE" -m 0 -x
-	HAVE_SET_DNS=1
-}
-
-unset_dns() {
-	[[ ${#DNS[@]} -gt 0 ]] || return 0
-	cmd resolvconf -d "$(resolvconf_iface_prefix)$INTERFACE" -f
-}
-
-add_route() {
-	local proto=-4
-	[[ $1 == *:* ]] && proto=-6
-	[[ $TABLE != off ]] || return 0
-
-	if [[ -n $TABLE && $TABLE != auto ]]; then
-		cmd ip $proto route add "$1" dev "$INTERFACE" table "$TABLE"
-	elif [[ $1 == */0 ]]; then
-		add_default "$1"
-	else
-		[[ -n $(ip $proto route show dev "$INTERFACE" match "$1" 2>/dev/null) ]] || cmd ip $proto route add "$1" dev "$INTERFACE"
-	fi
-}
-
 get_fwmark() {
-	local fwmark
-	fwmark="$(awg show "$INTERFACE" fwmark)" || return 1
-	[[ -n $fwmark && $fwmark != off ]] || return 1
-	printf -v "$1" "%d" "$fwmark"
 	return 0
 }
 
 remove_firewall() {
-	if type -p nft >/dev/null; then
-		local table nftcmd
-		while read -r table; do
-			[[ $table == *" wg-quick-$INTERFACE" ]] && printf -v nftcmd '%sdelete %s\n' "$nftcmd" "$table"
-		done < <(nft list tables 2>/dev/null)
-		[[ -z $nftcmd ]] || cmd nft -f <(echo -n "$nftcmd")
-	fi
-	if type -p iptables >/dev/null; then
-		local line iptables found restore
-		for iptables in iptables ip6tables; do
-			restore="" found=0
-			while read -r line; do
-				[[ $line == "*"* || $line == COMMIT || $line == "-A "*"-m comment --comment \"awg-quick(8) rule for $INTERFACE\""* ]] || continue
-				[[ $line == "-A"* ]] && found=1
-				printf -v restore '%s%s\n' "$restore" "${line/#-A/-D}"
-			done < <($iptables-save 2>/dev/null)
-			[[ $found -ne 1 ]] || echo -n "$restore" | cmd $iptables-restore -n
-		done
-	fi
+	return 0
 }
 
 HAVE_SET_FIREWALL=0
 add_default() {
-	local table line
-	if ! get_fwmark table; then
-		table=51820
-		while [[ -n $(ip -4 route show table $table 2>/dev/null) || -n $(ip -6 route show table $table 2>/dev/null) ]]; do
-			((table++))
-		done
-		cmd awg set "$INTERFACE" fwmark $table
-	fi
-	local proto=-4 iptables=iptables pf=ip
-	[[ $1 == *:* ]] && proto=-6 iptables=ip6tables pf=ip6
-	cmd ip $proto rule add not fwmark $table table $table
-	cmd ip $proto rule add table main suppress_prefixlength 0
-	cmd ip $proto route add "$1" dev "$INTERFACE" table $table
-
-	local marker="-m comment --comment \"awg-quick(8) rule for $INTERFACE\"" restore=$'*raw\n' nftable="wg-quick-$INTERFACE" nftcmd
-	printf -v nftcmd '%sadd table %s %s\n' "$nftcmd" "$pf" "$nftable"
-	printf -v nftcmd '%sadd chain %s %s preraw { type filter hook prerouting priority -300; }\n' "$nftcmd" "$pf" "$nftable"
-	printf -v nftcmd '%sadd chain %s %s premangle { type filter hook prerouting priority -150; }\n' "$nftcmd" "$pf" "$nftable"
-	printf -v nftcmd '%sadd chain %s %s postmangle { type filter hook postrouting priority -150; }\n' "$nftcmd" "$pf" "$nftable"
-	while read -r line; do
-		[[ $line =~ .*inet6?\ ([0-9a-f:.]+)/[0-9]+.* ]] || continue
-		printf -v restore '%s-I PREROUTING ! -i %s -d %s -m addrtype ! --src-type LOCAL -j DROP %s\n' "$restore" "$INTERFACE" "${BASH_REMATCH[1]}" "$marker"
-		printf -v nftcmd '%sadd rule %s %s preraw iifname != "%s" %s daddr %s fib saddr type != local drop\n' "$nftcmd" "$pf" "$nftable" "$INTERFACE" "$pf" "${BASH_REMATCH[1]}"
-	done < <(ip -o $proto addr show dev "$INTERFACE" 2>/dev/null)
-	printf -v restore '%sCOMMIT\n*mangle\n-I POSTROUTING -m mark --mark %d -p udp -j CONNMARK --save-mark %s\n-I PREROUTING -p udp -j CONNMARK --restore-mark %s\nCOMMIT\n' "$restore" $table "$marker" "$marker"
-	printf -v nftcmd '%sadd rule %s %s postmangle meta l4proto udp mark %d ct mark set mark \n' "$nftcmd" "$pf" "$nftable" $table
-	printf -v nftcmd '%sadd rule %s %s premangle meta l4proto udp meta mark set ct mark \n' "$nftcmd" "$pf" "$nftable"
-	[[ $proto == -4 ]] && cmd sysctl -q net.ipv4.conf.all.src_valid_mark=1
-	if type -p nft >/dev/null; then
-		cmd nft -f <(echo -n "$nftcmd")
-	else
-		echo -n "$restore" | cmd $iptables-restore -n
-	fi
-	HAVE_SET_FIREWALL=1
 	return 0
 }
 
@@ -252,74 +121,26 @@
 }
 
 save_config() {
-	local old_umask new_config current_config address cmd
-	[[ $(ip -all -brief address show dev "$INTERFACE") =~ ^$INTERFACE\ +\ [A-Z]+\ +(.+)$ ]] || true
-	new_config=$'[Interface]\n'
-	for address in ${BASH_REMATCH[1]}; do
-		new_config+="Address = $address"$'\n'
-	done
-	while read -r address; do
-		[[ $address =~ ^nameserver\ ([a-zA-Z0-9_=+:%.-]+)$ ]] && new_config+="DNS = ${BASH_REMATCH[1]}"$'\n'
-	done < <(resolvconf -l "$(resolvconf_iface_prefix)$INTERFACE" 2>/dev/null || cat "/etc/resolvconf/run/interface/$(resolvconf_iface_prefix)$INTERFACE" 2>/dev/null)
-	[[ -n $MTU && $(ip link show dev "$INTERFACE") =~ mtu\ ([0-9]+) ]] && new_config+="MTU = ${BASH_REMATCH[1]}"$'\n'
-	[[ -n $TABLE ]] && new_config+="Table = $TABLE"$'\n'
-	[[ $SAVE_CONFIG -eq 0 ]] || new_config+=$'SaveConfig = true\n'
-	for cmd in "${PRE_UP[@]}"; do
-		new_config+="PreUp = $cmd"$'\n'
-	done
-	for cmd in "${POST_UP[@]}"; do
-		new_config+="PostUp = $cmd"$'\n'
-	done
-	for cmd in "${PRE_DOWN[@]}"; do
-		new_config+="PreDown = $cmd"$'\n'
-	done
-	for cmd in "${POST_DOWN[@]}"; do
-		new_config+="PostDown = $cmd"$'\n'
-	done
-	old_umask="$(umask)"
-	umask 077
-	current_config="$(cmd awg showconf "$INTERFACE")"
-	trap 'rm -f "$CONFIG_FILE.tmp"; exit' INT TERM EXIT
-	echo "${current_config/\[Interface\]$'\n'/$new_config}" > "$CONFIG_FILE.tmp" || die "Could not write configuration file"
-	sync "$CONFIG_FILE.tmp"
-	mv "$CONFIG_FILE.tmp" "$CONFIG_FILE" || die "Could not move configuration file"
-	trap - INT TERM EXIT
-	umask "$old_umask"
+	return 0
 }
 
 execute_hooks() {
-	local hook
-	for hook in "$@"; do
-		hook="${hook//%i/$INTERFACE}"
-		echo "[#] $hook" >&2
-		(eval "$hook")
-	done
+	return 0
 }
 
 cmd_usage() {
 	cat >&2 <<-_EOF
-	Usage: $PROGRAM [ up | down | save | strip ] [ CONFIG_FILE | INTERFACE ]
+	Usage: $PROGRAM [ up | down ] [ CONFIG_FILE | INTERFACE ]
 
 	  CONFIG_FILE is a configuration file, whose filename is the interface name
 	  followed by \`.conf'. Otherwise, INTERFACE is an interface name, with
-	  configuration found at /etc/amnezia/INTERFACE.conf. It is to be readable
+	  configuration found at /opt/etc/amnezia/INTERFACE.conf. It is to be readable
 	  by awg(8)'s \`setconf' sub-command, with the exception of the following additions
 	  to the [Interface] section, which are handled by $PROGRAM:
 
 	  - Address: may be specified one or more times and contains one or more
 	    IP addresses (with an optional CIDR mask) to be set for the interface.
-	  - DNS: an optional DNS server to use while the device is up.
 	  - MTU: an optional MTU for the interface; if unspecified, auto-calculated.
-	  - Table: an optional routing table to which routes will be added; if
-	    unspecified or \`auto', the default table is used. If \`off', no routes
-	    are added.
-	  - PreUp, PostUp, PreDown, PostDown: script snippets which will be executed
-	    by bash(1) at the corresponding phases of the link, most commonly used
-	    to configure DNS. The string \`%i' is expanded to INTERFACE.
-	  - SaveConfig: if set to \`true', the configuration is saved from the current
-	    state of the interface upon shutdown.
-
-	See awg-quick(8) for more info and examples.
 	_EOF
 }
 
@@ -328,33 +149,20 @@
 	[[ -z $(ip link show dev "$INTERFACE" 2>/dev/null) ]] || die "\`$INTERFACE' already exists"
 	trap 'del_if; exit' INT TERM EXIT
 	add_if
-	execute_hooks "${PRE_UP[@]}"
 	set_config
 	for i in "${ADDRESSES[@]}"; do
 		add_addr "$i"
 	done
 	set_mtu_up
-	set_dns
-	for i in $(while read -r _ i; do for i in $i; do [[ $i =~ ^[0-9a-z:.]+/[0-9]+$ ]] && echo "$i"; done; done < <(awg show "$INTERFACE" allowed-ips) | sort -nr -k 2 -t /); do
-		add_route "$i"
-	done
-	execute_hooks "${POST_UP[@]}"
 	trap - INT TERM EXIT
 }
 
 cmd_down() {
-	[[ " $(awg show interfaces) " == *" $INTERFACE "* ]] || die "\`$INTERFACE' is not a WireGuard interface"
-	execute_hooks "${PRE_DOWN[@]}"
-	[[ $SAVE_CONFIG -eq 0 ]] || save_config
 	del_if
-	unset_dns || true
-	remove_firewall || true
-	execute_hooks "${POST_DOWN[@]}"
 }
 
 cmd_save() {
-	[[ " $(awg show interfaces) " == *" $INTERFACE "* ]] || die "\`$INTERFACE' is not a WireGuard interface"
-	save_config
+	return 0
 }
 
 cmd_strip() {
@@ -366,19 +174,15 @@
 if [[ $# -eq 1 && ( $1 == --help || $1 == -h || $1 == help ) ]]; then
 	cmd_usage
 elif [[ $# -eq 2 && $1 == up ]]; then
-	auto_su
 	parse_options "$2"
 	cmd_up
 elif [[ $# -eq 2 && $1 == down ]]; then
-	auto_su
 	parse_options "$2"
 	cmd_down
 elif [[ $# -eq 2 && $1 == save ]]; then
-	auto_su
 	parse_options "$2"
 	cmd_save
 elif [[ $# -eq 2 && $1 == strip ]]; then
-	auto_su
 	parse_options "$2"
 	cmd_strip
 else
