cloudflare / cloudflare/boringtun

Unable to remove private key with userspace interface

Open
#81 0 comments 0 reactions 1 assignee Claimed by @vkrasnov View on GitHub
bug
Dominant language
Rust
Stars
7.2k
Forks
532
PR merge metrics
No merged PRs in 30d

Description

When trying the boringtun user space socket interface, I noticed that it is currently impossible to remove a private key. The [specification](https://www.wireguard.com/xplatform/) for Wireguard user space implementations states that the private key can be removed.

## Platform

I'm using borington 0.2.0 on Linux `5.0.10-arch1-1-ARCH`.

## Reproduce
- Install a new copy of `boringtun` from cargo
- Create a new wireguard interface with `sudo boringtun wg2`
- Connect to the server's socket at `/var/run/wireguard/wg2.sock` (I used `sudo nc -U /var/run/wireguard/wg2.sock`)
- Review the current configuration. By default it only has the `listen_port` set.
```
> get=1
listen_port=54235
errno=0
```
- Set a private key
```
> set=1
private_key=c0b13a7afbe2a7afa5590f81321c3736627e85d28aacda3b662f8f96ecdXXXXX
errno=0
```
- Check the configuration
```
> get=1
private_key=c0b13a7afbe2a7afa5590f81321c3736627e85d28aacda3b662f8f96ecdXXXXX
listen_port=54235
errno=0
```
- Remove the private key
The "Cross Platform Userspace Implementation" page on wireguard.com states about
private keys that

>The value may be an all zero string in the case of a set operation, in which case it indicates
>that the private key should be removed.

```
> set=1
private_key=0000000000000000000000000000000000000000000000000000000000000000
errno=0
```
- Check if there is a private key
```
> get=1
private_key=0000000000000000000000000000000000000000000000000000000000000000
listen_port=54235
errno=0
```

Since there was no `private_key` field in the beginning, it shows that that interface can
have no key in some circumstances. The private key should be removed if it is set with a string
of 0s, but the private key still remains after.

## Solution
I think it would make sense to change the code in `/src/device/api.rs` to unset the private key when it is a string that contains only 0s.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.