Public bug reported: ## Problem Summary
I was trying to import a new Wireguard VPN connection to replace an existing one with one that has IPv6 support. I wanted to make sure the new connection worked before removing the old one, so made sure the existing was disconncted, then imported the new Wireguard configuration with a different connection name, but this resulted in a NetworkManager crash. After some digging, I found that the crash was due to reusing the same interface name for the new Wireguard connection, which netplan was merging with the existing connection's configuration and making the combination invalid. The crash is an assertion error in an Ubuntu NetworkManager patched code for netplan integration and shows up in the NetworkManager logs as ``` BUG: the profile cannot be stored in keyfile format without becoming unusable: invalid connection: ipv6.dns: this property is not allowed for 'method=disabled' ``` `ipv6.method: "disabled"` comes from the old connection and Since the old connection has IPv6 disabled and the new connection specifies an IPv6 address & nameserver address. The 2nd Wireguard connection configuration file end up both being persisted in /etc/netplan before crashing, but then the merged connection configuration fails to be loaded when NetworkManager gets automatically restarted. This makes it look like the old Wireguard connection was lost in UIs, but this invalid state persists and causes further imports with the same interface name to similarly crash, without any clear way to fix this broken state from the UIs. I would be surprised if this issue is specific to Wireguard connections, but I haven't tested for other ways netplan configuration merging could trigger crashes & invalid configurations. I tried doing the same thing in another distro (NixOS) that uses NetworkManager (version 1.56.0) without netplan integration and it successfully created the 2nd Wireguard connection without any problem, despite them sharing an interface name. I even tried activating both connections and activating the 2nd one deactivated the first one automatically. So I believe this is an Ubuntu specific issue. This NetworkManager behaviour without netplan integration seems like the desired behaviour from the perspective of a GUI or nmcli user. ## Relavant System Information - Ubuntu Desktop 26.04 (same issue in a VM or on a bare metal Kubuntu 26.04 install) - network-manager version 1.54.3-2ubuntu3 - netplan version 1.2-1ubuntu5 ## Reproduction Steps Save the following to a file wg-test.conf ``` # Example Endpoint, PrivateKey & PublicKey taken from https://git.zx2c4.com/wireguard-tools/about/src/man/wg.8 [Interface] PrivateKey = yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk= Address = 10.2.0.2/32 DNS = 10.2.0.1 [Peer] PublicKey = xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg= Endpoint = 192.95.5.67:1234 AllowedIPs = 0.0.0.0/0, ::/0 ``` Open Network Settings, Add VPN, Import from file... , then choose that file. Under the Wireguard tab, append "-old" to the Connection Name. Press the Add button. Replace the wg-test.conf file with the following (add IPv6 to Interface Address & DNS fields) ``` # Example Endpoint, PrivateKey & PublicKey taken from https://git.zx2c4.com/wireguard-tools/about/src/man/wg.8 [Interface] PrivateKey = yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk= Address = 10.2.0.2/32, 2a07:b944::2:2/128 DNS = 10.2.0.1, 2a07:b944::2:1 [Peer] PublicKey = xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg= Endpoint = 192.95.5.67:1234 AllowedIPs = 0.0.0.0/0, ::/0 ``` Import the file again in Network Settings, without changing the Connection Name. ## Result A crash will be reported in /usr/sbin/NetworkManager. `journcalctl -u NetworkManager` will show the crash is caused by the assertion error ``` BUG: the profile cannot be stored in keyfile format without becoming unusable: invalid connection: ipv6.dns: this property is not allowed for 'method=disabled' ``` which occurs in an Ubuntu patch to the NetworkManager code to add netplan integration support. The Network Settings will no longer show the initial VPN import and won't show the failed import either. However, it is actually in a subtle broken state from the perspective of the GUI, where retrying either the of these imports with the same interface name will cause a crash. This broken state is noticeable from looking at the NetworkManager service's logs, where it shows that it is failing to import a connection ``` keyfile: load: "/run/NetworkManager/system-connections/netplan-wg-test.nmconnection": failed to load connection: invalid connection: ipv6.dns: this property is not allowed for 'method=disabled' ``` Before crashing on the import of the second VPN connection, a netplan yaml file was created for this failed import. The YAML files the interface name can be found using `sudo grep -l wg-test /etc/netplan/*.yaml`. These wireguard configurations are being merged into a single netplan tunnel configuration, which can be seen by `sudo netplan get network.tunnels.wg-test`, where this combination is invalid: ``` renderer: NetworkManager addresses: - "10.2.0.2/32" - "2a07:b944::2:2/128" nameservers: addresses: - 10.2.0.1 - 2a07:b944::2:1 mode: "wireguard" port: 51820 keys: private: "yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk=" peers: - endpoint: "192.95.5.67:1234" keys: public: "xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=" allowed-ips: - "0.0.0.0/0" - "::/0" networkmanager: uuid: "940bcba2-5584-4fe0-89e0-45fe81f5317d" name: "wg-test-old" passthrough: connection.autoconnect: "false" connection.permissions: "user:dylan:;" ipv4.dns-search: "~;" ipv6.addr-gen-mode: "default" ipv6.dns-search: "~;" ipv6.ip6-privacy: "-1" proxy._: "" ipv6.method: "disabled" ``` This broken state can be cleaned up using ``` sudo rm -f `sudo grep -l wg-test: /etc/netplan/*.yaml` sudo systemctl restart NetworkManager ``` ## nmcli Reproduction This issue isn't specific to a GUI, so can also be reproduced by importing configuration files from the command line using: ``` sudo nmcli connection import type wireguard file ./wg-test.conf ``` Disconnect to avoid messing with the normal network connection and to show the problem isn't from trying to connect to 2 VPNs at the same time with the same interface name: ``` sudo nmcli connection down wg-test sudo nmcli connection modify wg-test connection.autoconnect no ``` Similarly, rename the first VPN connection with before importing the second one ``` sudo nmcli connection modify wg-test connection.id wg-test-old ``` ## Related bugs https://bugs.launchpad.net/ubuntu/+source/network-manager/+bug/2160278 crashes at the same assertion, but is about resilience to a single invalid persisted configuration. In contrast, this bug shows an invalid configuration and crash can be triggered through using Network Setting GUI interfaces or nmcli, due to netplan configuration merging. ** Affects: network-manager (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2162081 Title: crash & invalid connections from netplan wireguard configuration merging To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/network-manager/+bug/2162081/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
