"roaming" between source ports does not work

[Matthias May]

Hi

== Premise
* I've recently implemented support for wireguard in our LTE-router.

== Source Environment
* The basis is OpenWRT.
* Used versions:
* On the client/initiator:
 * wg
  * 1.0.20200908
  * ad33b2d2267a37e0f65c97e65e7d4d926d5aef7d530c251b63fbf919048eead9
 * wg-tools
  * 1.0.20200827
  * 51bc85e33a5b3cf353786ae64b0f1216d7a871447f058b6137f793eb0f53b7fd
* On the server/responder:
 * Debian stretch (9.13), installed from repository
 * deb http://deb.debian.org/debian/ unstable main
 * # wg --version
 * wireguard-tools v1.0.20200827
 * I don't really know what the version of the build dkms is

== Issue
* We've implemented an automated test that seems to have a problem.
 * Each night, the device is configured to connect to the debian box.
  * This works fine the first time.
  * However it doesn't work anymore after this first time.

== Observerion
When the "client" connects the first time, wg-output on the "server"
looks like this:
> interface: wg1
>   public key: 7GxCG4m+6Kf4wjJ9vbQaGFASLGXLB5ddPWgBYw4gOk8=
>   private key: (hidden)
>   listening port: 51821
>
> peer: fizBdi/YkdzFLaq6Hnq+OZaGmbJBYC15QSP1Mik/EFU=
>   endpoint: 172.29.42.230:38442
>   allowed ips: 10.0.41.3/32
>   latest handshake: 44 seconds ago
>   transfer: 8.01 MiB received, 7.96 MiB sent

and on the "client:
> interface: wg1
>   public key: fizBdi/YkdzFLaq6Hnq+OZaGmbJBYC15QSP1Mik/EFU=
>   private key: (hidden)
>   listening port: 38442
>
> peer: 7GxCG4m+6Kf4wjJ9vbQaGFASLGXLB5ddPWgBYw4gOk8=
>   endpoint: 172.29.60.13:51821
>   allowed ips: 10.0.41.0/24
>   latest handshake: 1 minute, 3 seconds ago
>   transfer: 187.06 KiB received, 189.96 KiB sent

Ports and IPs match, everything works.

However on the second run of the test:
On the "server" still:
> peer: fizBdi/YkdzFLaq6Hnq+OZaGmbJBYC15QSP1Mik/EFU=
>   endpoint: 172.29.42.230:38442
>   allowed ips: 10.0.41.3/32
>   latest handshake: 4 minutes, 52 seconds ago
>   transfer: 8.05 MiB received, 7.99 MiB sent

But the "client" shows:
> interface: wg1
>   public key: fizBdi/YkdzFLaq6Hnq+OZaGmbJBYC15QSP1Mik/EFU=
>   private key: (hidden)
>   listening port: 47858

The client device has been restarted in between.

Since the listen-port is set to 0, it obviously has now a new,
different, source-port.
The server doesn't pick this up.
Since peers may roam between IPs, i was under the impression, that it
would also roam between ports.


Is this working as intended?
If yes: How should the configuration look like to support clients doing
a power-cycle?


I'm aware, that i could set a static port on the client, but this won't
work when going through NAT with port-scrambling.
So i don't really have control over the source-port of the connection
anyway.
I suppose this would also apply when a router/firewall inbetween has
some aggressive killing of states where the keepalive is not fast
enough, and source-port scrambling is done.

But the main usecase i'm looking at here is: restart of a device.

BR
Matthias