[Bug 1825378] Re: systemd-networkd doesn't set wireguard peer endpoint

[Timo Aaltonen]

Hello Ko-Zu, or anyone else affected,

Accepted systemd into disco-proposed. The package will build now and be
available at https://launchpad.net/ubuntu/+source/systemd/240-6ubuntu5.1
in a few hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.  Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested and change the tag from
verification-needed-disco to verification-done-disco. If it does not fix
the bug for you, please add a comment stating that, and change the tag
to verification-failed-disco. In either case, without details of your
testing we will not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance for helping!

N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.

** Changed in: systemd (Ubuntu Disco)
       Status: In Progress => Fix Committed

** Tags added: verification-needed verification-needed-disco

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to systemd in Ubuntu.
https://bugs.launchpad.net/bugs/1825378

Title:
  systemd-networkd doesn't set wireguard peer endpoint

Status in systemd package in Ubuntu:
  Fix Committed
Status in systemd source package in Cosmic:
  Invalid
Status in systemd source package in Disco:
  Fix Committed
Status in systemd source package in Eoan:
  Fix Committed

Bug description:
  [impact]

  systemd does not set endpoints for wireguard interfaces correctly.
  This makes wireguard unusable.

  [test case]

  install a disco or eoan system and set up a wireguard interface:

  $ sudo add-apt-repository ppa:wireguard/wireguard
  $ sudo apt install wireguard
  ...(this does a lot of stuff)...

  create a file as below; There is no need to setup remote server to
  reproduce this issue, but PublicKey/PrivateKey should be valid one
  (used instructions from https://www.linode.com/docs/networking/vpn
  /set-up-wireguard-vpn-on-ubuntu/#configure-wireguard-server):

  $ cat /etc/systemd/network/wg0.netdev
  [NetDev]
  Name=wg0
  Kind=wireguard

  [WireGuard]
  PrivateKey=uMuCbguKYdKanRYMbDSriIdgxGxJR57Us1zEy8wRc1M=
  ListenPort=51820

  [WireGuardPeer]
  PublicKey=ZRyl+kvb6o2/6Da5YLum6GnSrzDj3J002+2kmK5CnS4=
  AllowedIPs=10.0.0.0/8
  Endpoint=192.168.1.1:51820

  $ sudo systemctl restart systemd-networkd
  $ sudo wg show wg0

  interface: wg0
    public key: BnvFgvPiVb5xURfzZ5liV1P77qeGeJDIX3C1iNquA2k=
    private key: (hidden)
    listening port: 51820

  peer: ZRyl+kvb6o2/6Da5YLum6GnSrzDj3J002+2kmK5CnS4=
    allowed ips: 10.0.0.0/8

  the last command should print remote endpoint address, e.g.:

  peer: ZRyl+kvb6o2/6Da5YLum6GnSrzDj3J002+2kmK5CnS4=
    endpoint: 192.168.1.1:51820
    allowed ips: 10.0.0.0/8

  [regression potential]

  any changes to systemd contain the potential for serious regressions.
  However, this is cherry picked directly from upstream, with the
  releases requiring patching (disco and eoan) being at exactly the same
  version and very close to upstream already.  Additionally, while this
  does add 2 new functions (from upstream commit
  https://github.com/systemd/systemd/pull/11580/commits/abd48ec87f2ac5dd571a99dcb4db88c4affdffc8),
  they are only used - and code is only changed in - wireguard.c, so any
  regressions should be limited to wireguard interfaces (unless systemd
  crashes completely).

  [other info]

  this bug is not present in cosmic and earlier, and is already fixed in
  upstream systemd, so this is needed only for disco and eoan.

  original description:

  ---

  systemd/disco 240 shipped with Ubuntu 19.04 beta does not set
  endpoints for [WireguradPeer] properly.

  This regression was introduced in v241 and merged into v240.
  systemd 241 doesn't set wireguard peer endpoint
  https://github.com/systemd/systemd/issues/11579

  Revert of the regression was landed on v240 stable branch
  https://github.com/systemd/systemd-stable/pull/39

  1)2) confirmed with,

  systemd/disco 240-6ubuntu5 amd64

  3)
  put a netdev file /etc/systemd/network/wg0.netdev

  ---
  [NetDev]
  Name=wg0
  Kind=wireguard

  [WireGuard]
  PrivateKey=**************
  ListenPort=51820

  [WireGuardPeer]
  PublicKey=*************
  AllowedIPs=10.0.0.0/8
  Endpoint=192.168.1.1:51820
  ----

  and run
  ---
  # systemctl restart systemd-networkd
  # wg show wg0

  interface: wg0
    public key: *****************
    private key: (hidden)
    listening port: 51820

  peer: *****************
    allowed ips: 10.0.0.0/8
  ----

  4)
  the last command should print remote endpoint address.
  ---
  # wg show wg0

  interface: wg0
    public key: *****************
    private key: (hidden)
    listening port: 51820

  peer: *****************
    endpoint: 192.168.1.1:51820
    allowed ips: 10.0.0.0/8
  ----

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1825378/+subscriptions