Page MenuHomeVyOS Platform

Deny the opportunity to use one public/private key pair on both wireguard peers.
Closed, ResolvedPublic

Description

Deny the opportunity to use one public/private key pair on both wireguard peers.

Key pair generation

vyos@vyos:~$ generate pki wireguard key-pair
Private key: oA2mjnxYxccfIFxnNfOZSrcJJiRl7kr9Qee999qywnY=
Public key: vu1n32sZC39x97i5wXRWb62KBCsj+UGVigwdmr4uhzg=

Configuration:

set interfaces wireguard wg1 address '10.0.0.1/24'
set interfaces wireguard wg1 peer TEST address '192.168.139.20'
set interfaces wireguard wg1 peer TEST allowed-ips '10.0.1.0/24'
set interfaces wireguard wg1 peer TEST port '51569'
set interfaces wireguard wg1 peer TEST public-key 'vu1n32sZC39x97i5wXRWb62KBCsj+UGVigwdmr4uhzg='
set interfaces wireguard wg1 private-key 'oA2mjnxYxccfIFxnNfOZSrcJJiRl7kr9Qee999qywnY='

Result:

interface: wg1
  public key: vu1n32sZC39x97i5wXRWb62KBCsj+UGVigwdmr4uhzg=
  private key: (hidden)
  listening port: 57089

Details

Version
VyOS 1.4-rolling-202307280757
Is it a breaking change?
Perfectly compatible
Issue type
Bug (incorrect behavior)

Event Timeline

a.apostoliuk changed the task status from Open to In progress.
a.apostoliuk claimed this task.
a.apostoliuk triaged this task as Normal priority.
a.apostoliuk created this object in space S1 VyOS Public.

Is this a limit of wireguard?

If not then VyOS should strongly recommend to use unique public/private pair of keys for each peer (as a best common practice) but should not limit if the admin want to use the same public/private pair of keys for more than one peer at once.

Common usecases (or rather not unusual) is if a "user" (or a site for that matter) uses multiple hardware.

That is the unique identifier is the user or the site and not the particular hardware unit.

a.apostoliuk changed the task status from In progress to Needs testing.Nov 22 2023, 11:14 AM
a.apostoliuk changed the task status from Needs testing to In progress.Nov 22 2023, 11:35 AM
a.apostoliuk moved this task from Open to Finished on the VyOS 1.4 Sagitta board.
a.apostoliuk changed the task status from In progress to Needs testing.Dec 12 2023, 8:54 AM