Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Wag, MFA and Enrollment for WireGuard

github.com

Post reply on HN
Print view View original

61–68 of 68 posts

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#61

Post by ta1243 »

Nullence wrote: post #47
ta1243 wrote: post #26

This looks nice, but a couple of things > curl http://public.server.address:8080/register_device?key=e83253... > The service will return a fully templated response It looks like the "registration" involves the server generating a private key then sending to the client, rather than the client generating a private key and sending the public key to the server. Not only that but your example is http! Probably worth repla…

Howdy! Kind of forgot that I put this up, the registration url can also take an optional pubkey parameter, so you dont have to rely on the server generating the private key for you (docs are a little lacking so I understand the confusion!) To answer your last question, eBPF XDP which is what I use can only do PASS, DROP or REDIRECT. So I stick with the easiest possible outcome and do PASS/DROP, which means your conne…

The problem I've seen when I've looked at this is signalling to the user that the session has ended. Sure your EBF filter stops passing traffic, but the user as to know that they need to visit a page to reauthenticate

That requires integration with a client, which is a massive pain to integrate

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#62

Post by ta1243 »

Nullence wrote: post #57
20after4 wrote: post #41

Earlier quoted context omitted.

> I've on and off looked for a wireguard client which can do something like the captive portal detection on wifi. Ideally it would be an extra line in the config file (like persistentkeepalive), which does a URL pull. Could be checked periodically (like with the keepalive). If it returns "OK", then fine, if it doesn't return then there's a network problem, but if it returns a "Location" header, the client would pop u…

Ironically I've also been thinking about this on and off for a bit, as it is definitely one of the pain points of using Wag at the moment. My only problem is that if you capture that route and then redirect it, or whatnot, your peers wont be able to log in to wifi in public areas like coffee-shops/libraries/etc because the route will be trying to go via a VPN which wont be returning any real data. Such as where you s…

Detecting captive portals re-establishing is a separate, but linked issue. It's mostly solved too.

Setting aside a VPN client, your browser and/or OS will send out a http get request to a site which returns "OK" or "success". If it returns a redirection, then it will go "ahha I'm behind a captive portal" and pop up a page for you to log in.

VPNs do something similar. The MozillaVPN client for example will periodically check for reauthentication by doing a http call over the non-VPN route to a server and looking for a response saying "success". If it needs a redirect it flags up a message on the client to disable your client and reroute traffic via normal networking to allow reauthenticaiton.

What I want from a wireguard client is it to check for captive portals outside (in a situation I'm routing the entire of 0.0/0 via wireguard), but also check for reachability inside the tunnel. Have "check" and "checktime" parameters, which poll a given server (presumably via the tunnel) preset a popup to reauthenticate.

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#63

Post by hnarn »

ta1243 wrote: post #61
Nullence wrote: post #47

Earlier quoted context omitted.

Howdy! Kind of forgot that I put this up, the registration url can also take an optional pubkey parameter, so you dont have to rely on the server generating the private key for you (docs are a little lacking so I understand the confusion!) To answer your last question, eBPF XDP which is what I use can only do PASS, DROP or REDIRECT. So I stick with the easiest possible outcome and do PASS/DROP, which means your conne…

The problem I've seen when I've looked at this is signalling to the user that the session has ended. Sure your EBF filter stops passing traffic, but the user as to know that they need to visit a page to reauthenticate That requires integration with a client, which is a massive pain to integrate

It sounds like upon expiry, you could redirect all 80/443 traffic to the same node, serving an error page. In my mind, that's better than having to install a client.

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#64

Post by Nullence »

hnarn wrote: post #63
ta1243 wrote: post #61

Earlier quoted context omitted.

The problem I've seen when I've looked at this is signalling to the user that the session has ended. Sure your EBF filter stops passing traffic, but the user as to know that they need to visit a page to reauthenticate That requires integration with a client, which is a massive pain to integrate

It sounds like upon expiry, you could redirect all 80/443 traffic to the same node, serving an error page. In my mind, that's better than having to install a client.

Probably then is how you do TLS, i.e do you give your service a wildcard cert to capture any 443 traffic.

Then how do you do that for things like ssh, or other non-http based protocols.

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#65

Post by aragilar »

Nullence wrote: post #54
mbreese wrote: post #28

Earlier quoted context omitted.

I don’t know if the parent was edited or not, but that’s not how I read the parent post. I didn’t take it as malicious, but trying to understand more about this method. I’d love for the author to tell us a bit more about how it works. I’m curious about what obstacles the author hit and how they got around them. Note: re: the flagged sibling comment. Yeah, that one doesn’t get the benefit of the doubt and was out of b…

Welp, I have no idea if anyone will read this as its been a little while since it was put up and is in a flagged comment, but hey I'll do a lil explanation of some of the issues I ran in to, and how it works. How it works: In short, Wag adds an eBPF program to a WireGuard device that it instantiates. The eBPF program uses a number of hash maps and LPM (longest prefix matching trie) maps to determine the policies that…

Ooh, this looks cool! I'm mildly curious given Windows apparently is adding support for eBPF whether you could also get this running on Windows as well.

On the patch, maybe try reposting it on the list, with the pointer to your project to see if that provokes a new review?

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#66

Post by mbreese »

Nullence wrote: post #54
mbreese wrote: post #28

Earlier quoted context omitted.

I don’t know if the parent was edited or not, but that’s not how I read the parent post. I didn’t take it as malicious, but trying to understand more about this method. I’d love for the author to tell us a bit more about how it works. I’m curious about what obstacles the author hit and how they got around them. Note: re: the flagged sibling comment. Yeah, that one doesn’t get the benefit of the doubt and was out of b…

Welp, I have no idea if anyone will read this as its been a little while since it was put up and is in a flagged comment, but hey I'll do a lil explanation of some of the issues I ran in to, and how it works. How it works: In short, Wag adds an eBPF program to a WireGuard device that it instantiates. The eBPF program uses a number of hash maps and LPM (longest prefix matching trie) maps to determine the policies that…

Thank you for posting this. These are the types of details that you just don’t get unless the author has really worked through these issues in depth.

Best of luck with the project!

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#67

Post by Nullence »

aragilar wrote: post #65
Nullence wrote: post #54

Earlier quoted context omitted.

Welp, I have no idea if anyone will read this as its been a little while since it was put up and is in a flagged comment, but hey I'll do a lil explanation of some of the issues I ran in to, and how it works. How it works: In short, Wag adds an eBPF program to a WireGuard device that it instantiates. The eBPF program uses a number of hash maps and LPM (longest prefix matching trie) maps to determine the policies that…

Ooh, this looks cool! I'm mildly curious given Windows apparently is adding support for eBPF whether you could also get this running on Windows as well. On the patch, maybe try reposting it on the list, with the pointer to your project to see if that provokes a new review?

Haha, me and a friend were both looking at the windows eBPF project and wondering if it might work. Im not really looking to support windows, but if someone comes to me and tells me it works I'll pop it on the read me

Re: Show HN: Wag, MFA and Enrollment for WireGuard

#68

Post by Nullence »

mbreese wrote: post #66
Nullence wrote: post #54

Earlier quoted context omitted.

Welp, I have no idea if anyone will read this as its been a little while since it was put up and is in a flagged comment, but hey I'll do a lil explanation of some of the issues I ran in to, and how it works. How it works: In short, Wag adds an eBPF program to a WireGuard device that it instantiates. The eBPF program uses a number of hash maps and LPM (longest prefix matching trie) maps to determine the policies that…

Thank you for posting this. These are the types of details that you just don’t get unless the author has really worked through these issues in depth. Best of luck with the project!

Thanks! It's been a bit of a labor of love for quite a while, these are the big three but there are a bunch of other little things.

Like the time I had to optimise map insertion because the linux kernel does some truly insane locking when you use specific types of eBPF maps:

https://github.com/NHAS/wag/issues/84

This is slated to be improved (or has already been improved in kernel 6.8?). But for now wag sort of just side steps it in a horribly stateful way.

Post reply on HN