summaryrefslogtreecommitdiff
path: root/src/conf_mode/interfaces-wireguard.py
diff options
context:
space:
mode:
authorChristian Breunig <christian@breunig.cc>2023-08-02 12:22:26 +0200
committerGitHub <noreply@github.com>2023-08-02 12:22:26 +0200
commitea30c0307996ec301474820bbcbf90d5eda7fda4 (patch)
treefcc31bb6f2437e8e7e8e1428166f08a3b789e4ee /src/conf_mode/interfaces-wireguard.py
parentad57339e9ce655823e1f8e7ad25dc5560359b8da (diff)
parentfee5669514492e9543b34b3e77e08d1552dee386 (diff)
downloadvyos-1x-ea30c0307996ec301474820bbcbf90d5eda7fda4.tar.gz
vyos-1x-ea30c0307996ec301474820bbcbf90d5eda7fda4.zip
Merge pull request #2122 from aapostoliuk/T5413
wireguard: T5413: Blocked adding the peer with the router's public key
Diffstat (limited to 'src/conf_mode/interfaces-wireguard.py')
-rwxr-xr-xsrc/conf_mode/interfaces-wireguard.py7
1 files changed, 6 insertions, 1 deletions
diff --git a/src/conf_mode/interfaces-wireguard.py b/src/conf_mode/interfaces-wireguard.py
index a02baba82..40404d091 100755
--- a/src/conf_mode/interfaces-wireguard.py
+++ b/src/conf_mode/interfaces-wireguard.py
@@ -1,6 +1,6 @@
#!/usr/bin/env python3
#
-# Copyright (C) 2018-2022 VyOS maintainers and contributors
+# Copyright (C) 2018-2023 VyOS maintainers and contributors
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2 or later as
@@ -29,10 +29,12 @@ from vyos.configverify import verify_bond_bridge_member
from vyos.ifconfig import WireGuardIf
from vyos.utils.kernel import check_kmod
from vyos.utils.network import check_port_availability
+from vyos.validate import is_wireguard_key_pair
from vyos import ConfigError
from vyos import airbag
airbag.enable()
+
def get_config(config=None):
"""
Retrive CLI config as dictionary. Dictionary can never be empty, as at least the
@@ -105,6 +107,9 @@ def verify(wireguard):
if peer['public_key'] in public_keys:
raise ConfigError(f'Duplicate public-key defined on peer "{tmp}"')
+ if 'disable' not in peer and is_wireguard_key_pair(wireguard['private_key'], peer['public_key']):
+ raise ConfigError(f'Peer "{tmp}" has the same public key as the interface "{wireguard["ifname"]}"')
+
public_keys.append(peer['public_key'])
def apply(wireguard):