From f58ec669ea269cdfc7fce7c62c62cbec81c5723b Mon Sep 17 00:00:00 2001 From: Suraj Patil Date: Sun, 9 Aug 2026 21:59:04 +0530 Subject: [PATCH] [wireguard] Add plugin for WireGuard VPN tunnels WireGuard is in the mainline kernel and wireguard-tools is packaged for RHEL, Fedora, Debian and Ubuntu, but sos has no plugin for it and no other plugin references it. Neither the interface configuration nor the runtime tunnel state reaches an sosreport. The plugin collects /etc/wireguard/*.conf, the output of "wg show all", and the status and journal of the templated wg-quick@ unit. "wg showconf" is deliberately not run: it prints the interface private key verbatim. "wg show" masks private and preshared keys as "(hidden)" unless WG_HIDE_KEYS=never is set in the environment, per masked_key() in src/show.c, so its default output is safe. The configuration files themselves hold the private key and any per-peer preshared key in cleartext, so postproc() redacts both. Public keys, endpoints and allowed IPs are left intact, since those are what a tunnel problem is usually diagnosed from. Example of the substitution: PrivateKey = 8Gt...= -> PrivateKey = ******** Signed-off-by: Suraj Patil --- sos/report/plugins/wireguard.py | 47 +++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 sos/report/plugins/wireguard.py diff --git a/sos/report/plugins/wireguard.py b/sos/report/plugins/wireguard.py new file mode 100644 index 0000000000..9bce008b50 --- /dev/null +++ b/sos/report/plugins/wireguard.py @@ -0,0 +1,47 @@ +# Copyright (C) 2026 Suraj Patil + +# This file is part of the sos project: https://github.com/sosreport/sos +# +# This copyrighted material is made available to anyone wishing to use, +# modify, copy, or redistribute it subject to the terms and conditions of +# version 2 of the GNU General Public License. +# +# See the LICENSE file in the source distribution for further information. + +from sos.report.plugins import Plugin, IndependentPlugin + + +class WireGuard(Plugin, IndependentPlugin): + + short_desc = 'WireGuard VPN tunnels' + + plugin_name = 'wireguard' + profiles = ('network', 'security') + + packages = ('wireguard-tools',) + files = ('/etc/wireguard',) + kernel_mods = ('wireguard',) + + def setup(self): + self.add_copy_spec('/etc/wireguard/*.conf') + + # "wg show" masks private and preshared keys as "(hidden)" unless + # WG_HIDE_KEYS=never is set in the environment, so the default + # output is safe to collect. "wg showconf" is deliberately not + # run, as it prints the private key verbatim. + self.add_cmd_output('wg show all', tags='wg_show') + + self.add_service_status('wg-quick@*') + self.add_journal(units='wg-quick@*') + + def postproc(self): + # Interface configuration files hold the interface private key + # and any per-peer preshared key in cleartext. + # + # PrivateKey = 8Gt...= -> PrivateKey = ******** + self.do_path_regex_sub( + '/etc/wireguard/.*', + r'((?:Private|Preshared)Key\s*=\s*)\S+', + r'\1********') + +# vim: set et ts=4 sw=4 :