From 451fa5e142e9ccce45320c635a41487a09e10816 Mon Sep 17 00:00:00 2001
From: riccardom <riccardomanfrin@gmail.com>
Date: Mon, 1 Jun 2026 16:36:33 +0200
Subject: [PATCH] Adds missing WGPort config

---
 client/internal/profilemanager/config.go | 11 ++++++++
 client/mdm/policy.go                     | 33 ++++++++++++++++++++++++
 client/server/mdm.go                     |  3 +++
 3 files changed, 47 insertions(+)

diff --git a/client/internal/profilemanager/config.go b/client/internal/profilemanager/config.go
index ece1a045b..a9ad39a36 100644
--- a/client/internal/profilemanager/config.go
+++ b/client/internal/profilemanager/config.go
@@ -691,6 +691,17 @@ func (config *Config) applyMDMPolicy(policy *mdm.Policy) {
 	if v, ok := policy.GetBool(mdm.KeyRosenpassPermissive); ok {
 		config.RosenpassPermissive = v
 	}
+
+	if v, ok := policy.GetInt(mdm.KeyWireguardPort); ok {
+		// REG_DWORD is 32-bit; UDP port range is 1-65535. Clamp at the
+		// upper bound and reject obviously-invalid values to avoid the
+		// engine binding to an unusable port if the admin pushes garbage.
+		if v >= 1 && v <= 65535 {
+			config.WgPort = int(v)
+		} else {
+			log.Warnf("MDM wireguard port %d out of range [1,65535]; keeping previous value", v)
+		}
+	}
 }
 
 // parseURL parses and validates a service URL
diff --git a/client/mdm/policy.go b/client/mdm/policy.go
index 65d121e95..f072d3485 100644
--- a/client/mdm/policy.go
+++ b/client/mdm/policy.go
@@ -10,6 +10,7 @@ package mdm
 
 import (
 	"sort"
+	"strconv"
 
 	log "github.com/sirupsen/logrus"
 )
@@ -32,6 +33,7 @@ const (
 	KeyPreSharedKey             = "preSharedKey"
 	KeyRosenpassEnabled         = "rosenpassEnabled"
 	KeyRosenpassPermissive      = "rosenpassPermissive"
+	KeyWireguardPort            = "wireguardPort"
 	KeySplitTunnelAllowApps     = "splitTunnelAllowApps"
 	KeySplitTunnelDisallowApps  = "splitTunnelDisallowApps"
 )
@@ -53,6 +55,7 @@ var AllKeys = []string{
 	KeyPreSharedKey,
 	KeyRosenpassEnabled,
 	KeyRosenpassPermissive,
+	KeyWireguardPort,
 	KeySplitTunnelAllowApps,
 	KeySplitTunnelDisallowApps,
 }
@@ -171,6 +174,36 @@ func (p *Policy) GetBool(key string) (bool, bool) {
 	return false, false
 }
 
+// GetInt returns the managed value for key as int64, and whether the key
+// was set. Accepts native int / int64 (as produced by the Windows registry
+// loader for REG_DWORD/REG_QWORD) and numeric strings (decimal).
+func (p *Policy) GetInt(key string) (int64, bool) {
+	if p == nil {
+		return 0, false
+	}
+	v, ok := p.values[key]
+	if !ok {
+		return 0, false
+	}
+	switch t := v.(type) {
+	case int64:
+		return t, true
+	case int:
+		return int64(t), true
+	case int32:
+		return int64(t), true
+	case uint64:
+		return int64(t), true
+	case float64:
+		return int64(t), true
+	case string:
+		if n, err := strconv.ParseInt(t, 10, 64); err == nil {
+			return n, true
+		}
+	}
+	return 0, false
+}
+
 // GetStringSlice returns the managed value for key as []string, and whether
 // the key was set. Accepts []string, []any (of strings), and a single string
 // (treated as a one-element list).
diff --git a/client/server/mdm.go b/client/server/mdm.go
index 68464b763..075cf98ba 100644
--- a/client/server/mdm.go
+++ b/client/server/mdm.go
@@ -49,6 +49,9 @@ func requestedMDMManagedKeys(msg *proto.SetConfigRequest) []string {
 	if msg.BlockInbound != nil {
 		keys = append(keys, mdm.KeyBlockInbound)
 	}
+	if msg.WireguardPort != nil {
+		keys = append(keys, mdm.KeyWireguardPort)
+	}
 	return keys
 }