cloudflare / cloudflare/boringtun
Unable to remove private key with userspace interface
- Dominant language
- Rust
- Stars
- 7.2k
- Forks
- 532
- PR merge metrics
- No merged PRs in 30d
Description
When trying the boringtun user space socket interface, I noticed that it is currently impossible to remove a private key. The [specification](https://www.wireguard.com/xplatform/) for Wireguard user space implementations states that the private key can be removed.
## Platform
I'm using borington 0.2.0 on Linux `5.0.10-arch1-1-ARCH`.
## Reproduce
- Install a new copy of `boringtun` from cargo
- Create a new wireguard interface with `sudo boringtun wg2`
- Connect to the server's socket at `/var/run/wireguard/wg2.sock` (I used `sudo nc -U /var/run/wireguard/wg2.sock`)
- Review the current configuration. By default it only has the `listen_port` set.
```
> get=1
listen_port=54235
errno=0
```
- Set a private key
```
> set=1
private_key=c0b13a7afbe2a7afa5590f81321c3736627e85d28aacda3b662f8f96ecdXXXXX
errno=0
```
- Check the configuration
```
> get=1
private_key=c0b13a7afbe2a7afa5590f81321c3736627e85d28aacda3b662f8f96ecdXXXXX
listen_port=54235
errno=0
```
- Remove the private key
The "Cross Platform Userspace Implementation" page on wireguard.com states about
private keys that
>The value may be an all zero string in the case of a set operation, in which case it indicates
>that the private key should be removed.
```
> set=1
private_key=0000000000000000000000000000000000000000000000000000000000000000
errno=0
```
- Check if there is a private key
```
> get=1
private_key=0000000000000000000000000000000000000000000000000000000000000000
listen_port=54235
errno=0
```
Since there was no `private_key` field in the beginning, it shows that that interface can
have no key in some circumstances. The private key should be removed if it is set with a string
of 0s, but the private key still remains after.
## Solution
I think it would make sense to change the code in `/src/device/api.rs` to unset the private key when it is a string that contains only 0s.
Contributor guide
Assessment
This issue has not been assessed yet.