Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
DescriptionDavide Principi
2022-12-22 10:25:19 UTC
Description of problem:
The wg-quick@wg0 service fails to start, if Endpoint has form hostname:port.
Version-Release number of selected component (if applicable):
wireguard-tools-1.0.20210914-2.el9.x86_64
How reproducible:
Configure wg-quick using a hostname:port endpoint.
Steps to Reproduce:
1. Edit /etc/wireguard/wg0.conf
2. Start the service wg-quick@wg0
Actual results:
The service fails to start.
output of `aureport -ts 12/22/2022 10:00 -a`
AVC Report
===============================================================
# date time comm subj syscall class permission obj result event
===============================================================
1. 12/22/2022 10:03:49 wg system_u:system_r:wireguard_t:s0 41 udp_socket create system_u:system_r:wireguard_t:s0 denied 1728
2. 12/22/2022 10:03:49 wg system_u:system_r:wireguard_t:s0 41 udp_socket create system_u:system_r:wireguard_t:s0 denied 1729
3. 12/22/2022 10:03:49 wg system_u:system_r:wireguard_t:s0 262 file getattr system_u:object_r:net_conf_t:s0 denied 1730
4. 12/22/2022 10:03:49 wg system_u:system_r:wireguard_t:s0 257 file read system_u:object_r:net_conf_t:s0 denied 1731
5. 12/22/2022 10:03:49 wg system_u:system_r:wireguard_t:s0 257 file read system_u:object_r:net_conf_t:s0 denied 1732
6. 12/22/2022 10:03:49 wg system_u:system_r:wireguard_t:s0 41 udp_socket create system_u:system_r:wireguard_t:s0 denied 1733
7. 12/22/2022 10:03:49 wg system_u:system_r:wireguard_t:s0 41 udp_socket create system_u:system_r:wireguard_t:s0 denied 1734
output of `systemctl status wg-quick@wg0`:
× wg-quick - WireGuard via wg-quick(8) for wg0
Loaded: loaded (/usr/lib/systemd/system/wg-quick@.service; disabled; preset: disabled)
Active: failed (Result: exit-code) since Thu 2022-12-22 10:03:49 UTC; 41s ago
Docs: man:wg-quick(8)
man:wg(8)
https://www.wireguard.com/https://www.wireguard.com/quickstart/https://git.zx2c4.com/wireguard-tools/about/src/man/wg-quick.8https://git.zx2c4.com/wireguard-tools/about/src/man/wg.8
Process: 65938 ExecStart=/usr/bin/wg-quick up wg0 (code=exited, status=1/FAILURE)
Main PID: 65938 (code=exited, status=1/FAILURE)
CPU: 24ms
Dec 22 10:03:49 cs2.dp.nethserver.net systemd[1]: Starting WireGuard via wg-quick(8) for wg0...
Dec 22 10:03:49 cs2.dp.nethserver.net wg-quick[65938]: [#] ip link add wg0 type wireguard
Dec 22 10:03:49 cs2.dp.nethserver.net wg-quick[65938]: [#] wg setconf wg0 /dev/fd/63
Dec 22 10:03:49 cs2.dp.nethserver.net wg-quick[65961]: Name or service not known: `cs1.dp.nethserver.net:55820'
Dec 22 10:03:49 cs2.dp.nethserver.net wg-quick[65961]: Configuration parsing error
Dec 22 10:03:49 cs2.dp.nethserver.net wg-quick[65938]: [#] ip link delete dev wg0
Dec 22 10:03:49 cs2.dp.nethserver.net systemd[1]: wg-quick: Main process exited, code=exited, status=1/FAILURE
Dec 22 10:03:49 cs2.dp.nethserver.net systemd[1]: wg-quick: Failed with result 'exit-code'.
Dec 22 10:03:49 cs2.dp.nethserver.net systemd[1]: Failed to start WireGuard via wg-quick(8) for wg0.
Expected results:
Service is started, VPN established.
Additional info:
wg0.conf:
[Interface]
Address = 10.5.4.2
ListenPort = 55820
PrivateKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
[Peer]
PublicKey = +ukw0EPWCQQmsqFXacL3N5+TF2hrcdI3BdwF5Y2UDG0=
AllowedIPs = 10.5.4.1/32
PersistentKeepalive = 25
Endpoint = otherside.example.com:55820
Using IP address instead of hostname works around the issue, however same SELinux denials of bug 2129438 persist:
8. 12/22/2022 10:23:26 wg system_u:system_r:wireguard_t:s0 41 udp_socket create system_u:system_r:wireguard_t:s0 denied 1740
9. 12/22/2022 10:23:26 wg system_u:system_r:wireguard_t:s0 41 udp_socket create system_u:system_r:wireguard_t:s0 denied 1741
Description of problem: The wg-quick@wg0 service fails to start, if Endpoint has form hostname:port. Version-Release number of selected component (if applicable): wireguard-tools-1.0.20210914-2.el9.x86_64 How reproducible: Configure wg-quick using a hostname:port endpoint. Steps to Reproduce: 1. Edit /etc/wireguard/wg0.conf 2. Start the service wg-quick@wg0 Actual results: The service fails to start. output of `aureport -ts 12/22/2022 10:00 -a` AVC Report =============================================================== # date time comm subj syscall class permission obj result event =============================================================== 1. 12/22/2022 10:03:49 wg system_u:system_r:wireguard_t:s0 41 udp_socket create system_u:system_r:wireguard_t:s0 denied 1728 2. 12/22/2022 10:03:49 wg system_u:system_r:wireguard_t:s0 41 udp_socket create system_u:system_r:wireguard_t:s0 denied 1729 3. 12/22/2022 10:03:49 wg system_u:system_r:wireguard_t:s0 262 file getattr system_u:object_r:net_conf_t:s0 denied 1730 4. 12/22/2022 10:03:49 wg system_u:system_r:wireguard_t:s0 257 file read system_u:object_r:net_conf_t:s0 denied 1731 5. 12/22/2022 10:03:49 wg system_u:system_r:wireguard_t:s0 257 file read system_u:object_r:net_conf_t:s0 denied 1732 6. 12/22/2022 10:03:49 wg system_u:system_r:wireguard_t:s0 41 udp_socket create system_u:system_r:wireguard_t:s0 denied 1733 7. 12/22/2022 10:03:49 wg system_u:system_r:wireguard_t:s0 41 udp_socket create system_u:system_r:wireguard_t:s0 denied 1734 output of `systemctl status wg-quick@wg0`: × wg-quick - WireGuard via wg-quick(8) for wg0 Loaded: loaded (/usr/lib/systemd/system/wg-quick@.service; disabled; preset: disabled) Active: failed (Result: exit-code) since Thu 2022-12-22 10:03:49 UTC; 41s ago Docs: man:wg-quick(8) man:wg(8) https://www.wireguard.com/ https://www.wireguard.com/quickstart/ https://git.zx2c4.com/wireguard-tools/about/src/man/wg-quick.8 https://git.zx2c4.com/wireguard-tools/about/src/man/wg.8 Process: 65938 ExecStart=/usr/bin/wg-quick up wg0 (code=exited, status=1/FAILURE) Main PID: 65938 (code=exited, status=1/FAILURE) CPU: 24ms Dec 22 10:03:49 cs2.dp.nethserver.net systemd[1]: Starting WireGuard via wg-quick(8) for wg0... Dec 22 10:03:49 cs2.dp.nethserver.net wg-quick[65938]: [#] ip link add wg0 type wireguard Dec 22 10:03:49 cs2.dp.nethserver.net wg-quick[65938]: [#] wg setconf wg0 /dev/fd/63 Dec 22 10:03:49 cs2.dp.nethserver.net wg-quick[65961]: Name or service not known: `cs1.dp.nethserver.net:55820' Dec 22 10:03:49 cs2.dp.nethserver.net wg-quick[65961]: Configuration parsing error Dec 22 10:03:49 cs2.dp.nethserver.net wg-quick[65938]: [#] ip link delete dev wg0 Dec 22 10:03:49 cs2.dp.nethserver.net systemd[1]: wg-quick: Main process exited, code=exited, status=1/FAILURE Dec 22 10:03:49 cs2.dp.nethserver.net systemd[1]: wg-quick: Failed with result 'exit-code'. Dec 22 10:03:49 cs2.dp.nethserver.net systemd[1]: Failed to start WireGuard via wg-quick(8) for wg0. Expected results: Service is started, VPN established. Additional info: wg0.conf: [Interface] Address = 10.5.4.2 ListenPort = 55820 PrivateKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX [Peer] PublicKey = +ukw0EPWCQQmsqFXacL3N5+TF2hrcdI3BdwF5Y2UDG0= AllowedIPs = 10.5.4.1/32 PersistentKeepalive = 25 Endpoint = otherside.example.com:55820 Using IP address instead of hostname works around the issue, however same SELinux denials of bug 2129438 persist: 8. 12/22/2022 10:23:26 wg system_u:system_r:wireguard_t:s0 41 udp_socket create system_u:system_r:wireguard_t:s0 denied 1740 9. 12/22/2022 10:23:26 wg system_u:system_r:wireguard_t:s0 41 udp_socket create system_u:system_r:wireguard_t:s0 denied 1741