summaryrefslogtreecommitdiff
path: root/src/conf_mode/interfaces-wireguard.py
diff options
context:
space:
mode:
authoraapostoliuk <a.apostoliuk@vyos.io>2023-07-31 16:24:54 +0300
committeraapostoliuk <a.apostoliuk@vyos.io>2023-08-02 12:46:50 +0300
commitfee5669514492e9543b34b3e77e08d1552dee386 (patch)
tree30c111f60d3e98060fcc394867622dcd0d074643 /src/conf_mode/interfaces-wireguard.py
parent1a44d8607f715934f2c03f28a9bf547321b26ed8 (diff)
downloadvyos-1x-fee5669514492e9543b34b3e77e08d1552dee386.tar.gz
vyos-1x-fee5669514492e9543b34b3e77e08d1552dee386.zip
wireguard: T5413: Blocked adding the peer with the router's public key
Disabeled adding the peer with the same public key as the router has. Added smoketest
Diffstat (limited to 'src/conf_mode/interfaces-wireguard.py')
-rwxr-xr-xsrc/conf_mode/interfaces-wireguard.py7
1 files changed, 6 insertions, 1 deletions
diff --git a/src/conf_mode/interfaces-wireguard.py b/src/conf_mode/interfaces-wireguard.py
index a02baba82..40404d091 100755
--- a/src/conf_mode/interfaces-wireguard.py
+++ b/src/conf_mode/interfaces-wireguard.py
@@ -1,6 +1,6 @@
#!/usr/bin/env python3
#
-# Copyright (C) 2018-2022 VyOS maintainers and contributors
+# Copyright (C) 2018-2023 VyOS maintainers and contributors
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2 or later as
@@ -29,10 +29,12 @@ from vyos.configverify import verify_bond_bridge_member
from vyos.ifconfig import WireGuardIf
from vyos.utils.kernel import check_kmod
from vyos.utils.network import check_port_availability
+from vyos.validate import is_wireguard_key_pair
from vyos import ConfigError
from vyos import airbag
airbag.enable()
+
def get_config(config=None):
"""
Retrive CLI config as dictionary. Dictionary can never be empty, as at least the
@@ -105,6 +107,9 @@ def verify(wireguard):
if peer['public_key'] in public_keys:
raise ConfigError(f'Duplicate public-key defined on peer "{tmp}"')
+ if 'disable' not in peer and is_wireguard_key_pair(wireguard['private_key'], peer['public_key']):
+ raise ConfigError(f'Peer "{tmp}" has the same public key as the interface "{wireguard["ifname"]}"')
+
public_keys.append(peer['public_key'])
def apply(wireguard):