get_vpn_tunnels: a WireGuard key can contain "/" from the public key #43

New Issue

2026-10-27T08:21:23Z

christianmanivong commented

2026-10-27 08:21:23 +00:00

Priority: P3 — affects one peer in roughly every eight (an 8-character base64 prefix contains / with ~12% probability); that tunnel's metadata cannot be edited in netOrk.

get_vpn_tunnels() builds the WireGuard key as f"wireguard-{iface}-{pubkey[:8]}". Base64 uses /, and netOrk uses the key as a URL path segment (PATCH /devices/{id}/vpn-tunnels/{tunnel_key}, and the UI route /devices/:id/vpn-tunnels/:tunnelKey). Even percent-encoded, %2F is decoded before routing, so a key with / does not match the route and the tunnel's site link cannot be set.

napalm-opnsense makes the prefix URL-safe (+ → -, / → _, NAPALM/napalm-opnsense#32). Doing the same here changes the key of every affected peer once; netOrk carries metadata across a key change (NetOrk/netork#1654).

Priority: P3 — affects one peer in roughly every eight (an 8-character base64 prefix contains `/` with ~12% probability); that tunnel's metadata cannot be edited in netOrk. `get_vpn_tunnels()` builds the WireGuard key as `f"wireguard-{iface}-{pubkey[:8]}"`. Base64 uses `/`, and netOrk uses the key as a URL path segment (`PATCH /devices/{id}/vpn-tunnels/{tunnel_key}`, and the UI route `/devices/:id/vpn-tunnels/:tunnelKey`). Even percent-encoded, `%2F` is decoded before routing, so a key with `/` does not match the route and the tunnel's site link cannot be set. napalm-opnsense makes the prefix URL-safe (`+` → `-`, `/` → `_`, NAPALM/napalm-opnsense#32). Doing the same here changes the key of every affected peer once; netOrk carries metadata across a key change (NetOrk/netork#1654).

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: NAPALM/napalm-linux#43