Wireguard should check that the peer public key is different from the tunnel public key

joetaber

It would be nice if the wireguard package checks that a peer doesn't have the same public key as the host/tunnel.

I ran into a situation where a user wasn't paying attention to the setup instructions (in my opinion the instructions were very clear, screenshots with red outlines and arrows etc) and sent me back the public key of the firewall instead of their client public key. We were debugging for over two hours before I noticed that their public key was exactly the same as the firewall public key.

The wireguard package checks to make sure two peers don't have the same public key. ️ It would be nice if the wireguard package also checked that a peer doesn't have the same public key as the host/tunnel.

joetaber

I decided to implement this validation myself and opened a PR on what I believe is the github repo for the wireguard package:

https://github.com/rcmcdonald91/pfSense-pkg-WireGuard/pull/153

The added code:

// We don't want peers to have the same key as the tunnel itself.
$result = wg_tunnel_get_config_by_name($pconfig['tun'])
if ($result == false) {
	$input_errors[] = "Tunnel ({$pconfig['tun']}) doesn't exist."
} elseif ($result[1]['publickey'] == $pconfig['publickey']) {
	$input_errors[] = "The public key ({$pconfig['publickey']}) is already used by the tunnel itself ({$pconfig['tun']})."
}

Feedback and 's appreciated.

tinfoilmatt

https://github.com/rcmcdonald91/pfSense-pkg-WireGuard/pull/153

This is one of the Netgate developer's (@cmcdonald's) personal GitHub account. Correct repo for PR would be:

https://github.com/pfsense/FreeBSD-ports/tree/devel/net/pfSense-pkg-WireGuard

joetaber

@tinfoilmatt Thanks, I closed that PR and reopened it here: https://github.com/pfsense/FreeBSD-ports/pull/1433

cmcdonald

@joetaber said in Wireguard should check that the peer public key is different from the tunnel public key:

@tinfoilmatt Thanks, I closed that PR and reopened it here: https://github.com/pfsense/FreeBSD-ports/pull/1433

Thanks, we will pull this in soon

joetaber

@cmcdonald still planning to merge this?