Encapsulation

Encapsulation

[James Wilson]

[-- Attachment #1: Type: text/plain, Size: 297 bytes --]

Hi,

Just out of curiosity, how does a "wireguard packet' look like on the wire
??

I'm guessing:

 Ethernet
 IP
 UDP
|------------------|
| IP                 |
| WG payload |
|------------------|


What's in the box is encrypted

Is that right ?? If not, what does it look like?

Thanks,

James

[-- Attachment #2: Type: text/html, Size: 587 bytes --]

Re: Encapsulation

[Jason A. Donenfeld]

[-- Attachment #1: Type: text/plain, Size: 95 bytes --]

 https://www.wireguard.io/protocol/

https://www.wireguard.io/papers/wireguard.pdf section 5.4

[-- Attachment #2: Type: text/html, Size: 326 bytes --]

Re: Encapsulation

[Daniel Kahn Gillmor]

On Wed 2017-03-01 16:38:05 -0800, James Wilson wrote:
> Hi,
>
> Just out of curiosity, how does a "wireguard packet' look like on the wire
> ??
>
> I'm guessing:
>
>  Ethernet
>  IP
>  UDP
> |------------------|
> | IP               |
> | WG payload       |
> |------------------|
>
>
> What's in the box is encrypted
>
> Is that right ?? If not, what does it look like?

I believe the cleartext (after decryption) is an actual IP packet, so
everything from layer3 up the stack.


If anyone wants to document this sort of thing explicitly in a useful
way, you might consider writing a wireshark dissector:

  https://www.wireshark.org/docs/wsdg_html_chunked/ChDissectAdd.html

and you can clone wireshark's source with:

   git clone https://code.wireshark.org/review/wireshark

The simplest thing would be to start with a dissector for the ciphertext
itself, for the few pieces of metadata that are outside the encrypted
packet (see e.g. §5.4.2 of
https://www.wireguard.io/papers/wireguard.pdf)

If you want to get more clever, you could add a mechanism to the
wireguard module to extract session keys, and then make a decryptor
plugin to wireshark. But start with just the ciphertext ;)

      --dkg

Re: Encapsulation

[James Wilson]

[-- Attachment #1: Type: text/plain, Size: 1659 bytes --]

Thanks Daniel, that's what I was trying to figure out.

If what you're saying is true, if the encrypted blob contains an IP packet
it would mean that it would look like this

Ethernet
IP
UDP
Ethernet
IP
WG payload


James


On Wed, Mar 1, 2017 at 8:38 PM, Daniel Kahn Gillmor <dkg@fifthhorseman.net>
wrote:

> On Wed 2017-03-01 16:38:05 -0800, James Wilson wrote:
> > Hi,
> >
> > Just out of curiosity, how does a "wireguard packet' look like on the
> wire
> > ??
> >
> > I'm guessing:
> >
> >  Ethernet
> >  IP
> >  UDP
> > |------------------|
> > | IP               |
> > | WG payload       |
> > |------------------|
> >
> >
> > What's in the box is encrypted
> >
> > Is that right ?? If not, what does it look like?
>
> I believe the cleartext (after decryption) is an actual IP packet, so
> everything from layer3 up the stack.
>
>
> If anyone wants to document this sort of thing explicitly in a useful
> way, you might consider writing a wireshark dissector:
>
>   https://www.wireshark.org/docs/wsdg_html_chunked/ChDissectAdd.html
>
> and you can clone wireshark's source with:
>
>    git clone https://code.wireshark.org/review/wireshark
>
> The simplest thing would be to start with a dissector for the ciphertext
> itself, for the few pieces of metadata that are outside the encrypted
> packet (see e.g. §5.4.2 of
> https://www.wireguard.io/papers/wireguard.pdf)
>
> If you want to get more clever, you could add a mechanism to the
> wireguard module to extract session keys, and then make a decryptor
> plugin to wireshark. But start with just the ciphertext ;)
>
>       --dkg
>

[-- Attachment #2: Type: text/html, Size: 2673 bytes --]

Re: Encapsulation

[Jason A. Donenfeld]

[-- Attachment #1: Type: text/plain, Size: 174 bytes --]

Hey James,

You're quite mistaken. WireGuard is layer 3 only.

Ethernet
IP
UDP
WireGuard header
==================
IP
Payload

Everything below the line is encrypted.

Jason

[-- Attachment #2: Type: text/html, Size: 667 bytes --]

Re: Encapsulation

[Peter Wu]

On Wed, Mar 01, 2017 at 05:38:01PM -0800, Daniel Kahn Gillmor wrote:
> On Wed 2017-03-01 16:38:05 -0800, James Wilson wrote:
> > Hi,
> >
> > Just out of curiosity, how does a "wireguard packet' look like on the wire
> > ??
> >
> > I'm guessing:
> >
> >  Ethernet
> >  IP
> >  UDP
> > |------------------|
> > | IP               |
> > | WG payload       |
> > |------------------|
> >
> >
> > What's in the box is encrypted
> >
> > Is that right ?? If not, what does it look like?
> 
> I believe the cleartext (after decryption) is an actual IP packet, so
> everything from layer3 up the stack.

It is more like:

    Ethernet
    IP (to WireGuard peer)
    UDP (UDP payload is as follows:)
        WireGuard header (type, counter)
        Packet (encrypted, decrypted contents are as follows:)
            IP (original)
            (IP payload like ICMP, TCP, etc.)

If it helps, see this picture of the packet dissection for an ICMP
packet tunneled over WireGuard: https://i.imgur.com/MzubvX3.png

> If anyone wants to document this sort of thing explicitly in a useful
> way, you might consider writing a wireshark dissector:

As you can see above I have already been working on one and will publish
it soon after adding some documentation. :-)
-- 
Kind regards,
Peter Wu
https://lekensteyn.nl