[Solved] Wireguard handshake stuck after systemd 250 upgrade

[bnicolae]

After upgrading to linux-aarch64-5.15.5, wireguard simply does not finish the handshake with the server and is stuck. It works just fine with the older version (linux-aarch64-5.15.1). Using an alternative kernel like linux-rpi-5.10.90 fails too.

The output of wg show looks like this:
$this->bbcode_second_pass_code('', 'peer: <redacted>
endpoint: <redacted>
allowed ips: <redacted>
// latest handshake: X seconds ago: this line is missing
transfer: 0 B received, Y KiB sent // no data received, which means server is not replying
')

Solved: Looks like the upgrade from systemd 249 to 250 is the culprit. More details here: https://github.com/systemd/systemd/issues/21964

[graysky]

The fact that it is affecting you under both kernels points to something in vanilla linux. Are you up to bisecting the kernel?

[bnicolae]

After more analysis, I discoverd this is in fact a systemd issue, not a kernel issue. The breaking change was introduced in v250. More details here: https://github.com/systemd/systemd/issues/21964