WireGuard: importing a peer tunnel overwrites an existing tunnel #1915

Adding or importing a WireGuard peer tunnel can overwrite an existing tunnel. This happens when a tunnel in the middle of the list was deleted before impoting.

Steps to reproduce

• Open the WireGuard page, "Peer tunnels" tab
• Add three peer tunnels: tunA, tunB, tunC. They get the names wg1, wg2 and wg3
• Delete tunB (wg2) and apply the changes
• Click "Import peer tunnel" and load any valid WireGuard configuration file. "Add peer tunnel" has the same problem

Expected behavior

The new tunnel gets a name that is not in use, like wg2 or wg4. tunC stays as it was.

Actual behavior

The new tunnel is saved as wg3, on top of tunC:

• tunC's name, address and private key are replaced by the imported ones
• tunC's old peer stays attached to wg3, so wg3 now has two peers: the old one and the imported one

The firewall picks the next tunnel name by counting the existing WireGuard interfaces, not by looking for a free name. Adding a WireGuard server is not affected, because it already checks for a free name.

Components

• Image version: NethSecurity 8.8.0 (r33051-f5dae5ece4)
• ns-api-3.7.3-r2

See also

• https://community.nethserver.org/t/wireguard-tunnel-add-peer-tunnel-import-peer-tunnel-overwriting-peers/28933

Thanks to Turbond for the report and the analysis on the community.