Page MenuHomeVyOS Platform
Create Task
Maniphest T5413

Deny the opportunity to use one public/private key pair on both wireguard peers.
Closed, ResolvedPublic
Actions

Description

Deny the opportunity to use one public/private key pair on both wireguard peers.

Key pair generation

vyos@vyos:~$ generate pki wireguard key-pair
Private key: oA2mjnxYxccfIFxnNfOZSrcJJiRl7kr9Qee999qywnY=
Public key: vu1n32sZC39x97i5wXRWb62KBCsj+UGVigwdmr4uhzg=

Configuration:

set interfaces wireguard wg1 address '10.0.0.1/24'
set interfaces wireguard wg1 peer TEST address '192.168.139.20'
set interfaces wireguard wg1 peer TEST allowed-ips '10.0.1.0/24'
set interfaces wireguard wg1 peer TEST port '51569'
set interfaces wireguard wg1 peer TEST public-key 'vu1n32sZC39x97i5wXRWb62KBCsj+UGVigwdmr4uhzg='
set interfaces wireguard wg1 private-key 'oA2mjnxYxccfIFxnNfOZSrcJJiRl7kr9Qee999qywnY='

Result:

interface: wg1
  public key: vu1n32sZC39x97i5wXRWb62KBCsj+UGVigwdmr4uhzg=
  private key: (hidden)
  listening port: 57089

Details

Difficulty level
Unknown (require assessment)
Version
VyOS 1.4-rolling-202307280757
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Perfectly compatible
Issue type
Bug (incorrect behavior)

Event Timeline

a.apostoliuk changed the task status from Open to In progress.Jul 28 2023, 1:49 PM
a.apostoliuk claimed this task.
a.apostoliuk triaged this task as Normal priority.
a.apostoliuk created this task.
a.apostoliuk created this object in space S1 VyOS Public.
pasik added a subscriber: pasik.Jul 28 2023, 9:52 PM
Apachez added a subscriber: Apachez.Jul 29 2023, 7:38 PM

Is this a limit of wireguard?

If not then VyOS should strongly recommend to use unique public/private pair of keys for each peer (as a best common practice) but should not limit if the admin want to use the same public/private pair of keys for more than one peer at once.

Common usecases (or rather not unusual) is if a "user" (or a site for that matter) uses multiple hardware.

That is the unique identifier is the user or the site and not the particular hardware unit.

c-po added a subscriber: c-po.Jul 31 2023, 5:37 PM

@a.apostoliuk found that actually this is silently discarded in the Kernel - so a proper error message is a good addition here.

https://github.com/torvalds/linux/blob/830b3c68c1fb1e9176028d02ef86f3cf76aa2476/drivers/net/wireguard/netlink.c#L401-L405

a.apostoliuk changed the task status from In progress to Needs testing.Nov 22 2023, 11:14 AM
a.apostoliuk changed the task status from Needs testing to In progress.Nov 22 2023, 11:35 AM
a.apostoliuk added a project: VyOS 1.3 Equuleus (1.3.5).
a.apostoliuk moved this task from Need Triage to Finished on the VyOS 1.4 Sagitta board.
a.apostoliuk changed the task status from In progress to Needs testing.Dec 12 2023, 8:54 AM
a.apostoliuk closed this task as Resolved.Dec 12 2023, 9:36 AM
a.apostoliuk moved this task from Need Triage to Finished on the VyOS 1.3 Equuleus (1.3.5) board.