From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: ** X-Spam-Status: No, score=2.4 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, HTML_MESSAGE,MAILING_LIST_MULTI,MIME_HTML_MOSTLY,MIME_QP_LONG_LINE, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 587D6C35DE1 for ; Tue, 25 Feb 2020 13:09:30 +0000 (UTC) Received: from krantz.zx2c4.com (krantz.zx2c4.com [192.95.5.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 2561020CC7 for ; Tue, 25 Feb 2020 13:09:27 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 2561020CC7 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=libassi.se Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=wireguard-bounces@lists.zx2c4.com Received: from krantz.zx2c4.com (localhost [IPv6:::1]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 93d978d2; Tue, 25 Feb 2020 13:05:55 +0000 (UTC) Received: from krantz.zx2c4.com (localhost [127.0.0.1]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 21f07577 for ; Tue, 25 Feb 2020 13:05:49 +0000 (UTC) Received: from smtp2.outgoing.loopia.se (smtp2.outgoing.loopia.se [93.188.3.37]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id b730ac57 for ; Tue, 25 Feb 2020 13:05:49 +0000 (UTC) Received: from s807.loopia.se (localhost [127.0.0.1]) by s807.loopia.se (Postfix) with ESMTP id 5D94C2E43E4A for ; Tue, 25 Feb 2020 14:08:34 +0100 (CET) Received: from s499.loopia.se (unknown [172.22.191.5]) by s807.loopia.se (Postfix) with ESMTP id 3EAF42E27ADF; Tue, 25 Feb 2020 14:08:34 +0100 (CET) Received: from s472.loopia.se (unknown [172.22.191.5]) by s499.loopia.se (Postfix) with ESMTP id 39F7E1CDAF02; Tue, 25 Feb 2020 14:08:34 +0100 (CET) X-Virus-Scanned: amavisd-new at amavis.loopia.se Received: from s630.loopia.se ([172.22.191.5]) by s472.loopia.se (s472.loopia.se [172.22.190.12]) (amavisd-new, port 10024) with UTF8LMTP id VTLuVodHVSCI; Tue, 25 Feb 2020 14:08:32 +0100 (CET) X-Loopia-Auth: user X-Loopia-User: peter@libassi.se X-Loopia-Originating-IP: IPv6:2a00:801:3cd:df4b:9505:d796:fd39:7746 Received: from [IPv6:2a00:801:3cd:df4b:9505:d796:fd39:7746] (unknown [IPv6:2a00:801:3cd:df4b:9505:d796:fd39:7746]) (Authenticated sender: peter@libassi.se) by s630.loopia.se (Postfix) with ESMTPSA id B81CF13ABECC; Tue, 25 Feb 2020 14:08:31 +0100 (CET) From: Peter Libassi Mime-Version: 1.0 (1.0) Date: Tue, 25 Feb 2020 14:08:30 +0100 Message-Id: <97422B13-B927-4D86-BB45-AC1E9FBD8E79@libassi.se> References: <4c6af2b0-62bc-84bd-f1ec-ce11a152d348@gmail.com> In-Reply-To: <4c6af2b0-62bc-84bd-f1ec-ce11a152d348@gmail.com> Subject: Re: FreeBSD wireguard wg-quick remote IP address assignment is incorrect To: Jan Novak , WireGuard mailing list X-Mailer: iPhone Mail (17D50) X-BeenThere: wireguard@lists.zx2c4.com X-Mailman-Version: 2.1.15 Precedence: list List-Id: Development discussion of WireGuard List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============8697779894563161453==" Errors-To: wireguard-bounces@lists.zx2c4.com Sender: "WireGuard" --===============8697779894563161453== Content-Type: multipart/alternative; boundary=Apple-Mail-23D62BF1-3634-4296-8017-ACC755F05135 Content-Transfer-Encoding: 7bit --Apple-Mail-23D62BF1-3634-4296-8017-ACC755F05135 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable >> 25 feb. 2020 kl. 07:24 skrev Jan Novak : > =EF=BB=BFAm 25.02.20 um 07:07 schrieb Peter Libassi: >>>> 23 feb. 2020 kl. 16:32 skrev Jason A. Donenfeld : >>> On Sun, Feb 23, 2020 at 2:25 PM Peter Libassi wrote: >>>> Ok, Well even if using another local IP in range 127.0.0.0/8 we can=E2=80= =99t be certain we will clash with something else. >>>> How about adding a directive for the remote interface address in wg.con= f? Like this: >>>> # cat /usr/local/etc/wireguard/wg0.conf >>>> [Interface] >>>> PrivateKey =3D <-> >>>> ListenPort =3D 7777 >>>> Address =3D 192.168.2.1/32 >>>> RemoteAddress =3D 192.168.2.2 >>>> [Peer] >>>> PublicKey =3D <-> >>>> AllowedIPs =3D 192.168.2.0/24 >>>> Endpoint =3D 172.16.0.23:7777 >>>> # diff /usr/local/bin/wg-quick.org ./wg-quick >>>> 17a18 >>>>> REMOTE_ADDRESS=3D"" >>>> 86a88 >>>>> RemoteAddress) REMOTEADDRESS=3D"$value"; continue ;; >>>> 175c177,181 >>>> < cmd ifconfig "$INTERFACE" inet "$1" "${1%%/*}" alias >>>> --- >>>>> if [[ -n $REMOTEADDRESS ]]; then >>>>> cmd ifconfig "$INTERFACE" inet "$1" "$REMOTEADDRESS" alias >>>>> else >>>>> cmd ifconfig "$INTERFACE" inet "$1" "${1%%/*}" alias >>>>> fi >>> This is not a correct fix; we're not going to add a configuration nob >>> to work around FreeBSD network stack gotchas. >>> Rather, I'd prefer to see all the FreeBSD wg-quick semantics redone >>> around multiple routing tables and marks, much like on Linux, though I >>> don't know if that's possible. Barring that, a proper solution >>> probably involves re-reading the ifconfig man page a few dozen times >>> to find out how to have interface addresses as we need them. >> It works perfectly for my single site-2-site use case. You have two optio= ns as I see it. Either convince the FreeBSD team to drop the dest_address re= quirement or implement local/remote address awareness per [Peer] in the wg-q= uick script. >=20 > Hi Peter, >=20 > Can you show me an example for "... implement local/remote address awarene= ss per [Peer] in the wg-quick script... " >=20 >=20 > Bfo >=20 >=20 >=20 Here is one way to do it: root@vpn1:~ # cat /usr/local/etc/wireguard/wg0.conf [Interface] PrivateKey =3D <-> ListenPort =3D 7777 =20 [Peer] PublicKey =3D <-> LinkAddress =3D 10.0.0.1/10.0.0.2 Endpoint =3D 192.168.59.155:7777 AllowedIPs =3D 10.0.0.2/32 =20 [Peer] PublicKey =3D <-> LinkAddress =3D 10.1.1.1/10.1.1.2 Endpoint =3D 192.168.58.155:7777 AllowedIPs =3D 10.1.1.2/32 =20 $ diff /usr/local/bin/wg-quick wg-quick 16a17 > LADDRESSES=3D( ) 63c64 < local interface_section=3D0 line key value stripped path --- > local interface_section=3D0 peer_section=3D0 line key value stripped= path 95a97,102 > [[ $key =3D=3D "[Peer]" ]] && peer_section=3D1 > if [[ $peer_section -eq 1 ]]; then > case "$key" in > LinkAddress) LADDRESSES+=3D( ${value//,/ } ); contin= ue ;; > esac > fi 175c182 < cmd ifconfig "$INTERFACE" inet "$1" "${1%%/*}" alias --- > cmd ifconfig "$INTERFACE" inet "${1%/*}/32" "${1#*/}" alias 419c426 < for i in "${ADDRESSES[@]}"; do --- > for i in "${LADDRESSES[@]}"; do =20 root@vpn1:~ # /home/peter/wg-quick up wg0 [#] wireguard-go wg0 INFO: (wg0) 2020/02/25 13:49:54 Starting wireguard-go version 0.0.20200121 [#] wg setconf wg0 /tmp/tmp.vXURfmKj/sh-np.pCIWwG [#] ifconfig wg0 inet 10.0.0.1/32 10.0.0.2 alias [#] ifconfig wg0 inet 10.1.1.1/32 10.1.1.2 alias [#] ifconfig wg0 mtu 1420 [#] ifconfig wg0 up [#] route -q -n add -inet 10.1.1.2/32 -interface wg0 [#] route -q -n add -inet 10.0.0.2/32 -interface wg0 [+] Backgrounding route monitor =20 root@vpn1:~ # ifconfig wg0 wg0: flags=3D8051 metric 0 mtu 1420 options=3D80000 inet 10.0.0.1 --> 10.0.0.2 netmask 0xffffffff inet 10.1.1.1 --> 10.1.1.2 netmask 0xffffffff groups: tun nd6 options=3D101 Opened by PID 2033 =20 root@VPN1:~ # netstat -rn4 Routing tables =20 Internet: Destination Gateway Flags Netif Expire default 192.168.59.2 UGS em0 10.0.0.1 link#4 UHS lo0 10.0.0.2 link#4 UH wg0 10.0.0.2/32 wg0 US wg0 10.1.1.1 link#4 UHS lo0 10.1.1.2 link#4 UH wg0 10.1.1.2/32 wg0 US wg0 127.0.0.1 link#3 UH lo0 192.168.59.0/24 link#1 U em0 192.168.59.154 link#1 UHS lo0 192.168.153.0/24 link#2 U em1 192.168.153.130 link#2 UHS lo0 =20 root@vpn1:~ # ping -c1 10.0.0.1 PING 10.0.0.1 (10.0.0.1): 56 data bytes 64 bytes from 10.0.0.1: icmp_seq=3D0 ttl=3D64 time=3D0.373 ms =20 --- 10.0.0.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/stddev =3D 0.373/0.373/0.373/0.000 ms =20 root@vpn1:~ # ping -c1 10.1.1.1 PING 10.1.1.1 (10.1.1.1): 56 data bytes 64 bytes from 10.1.1.1: icmp_seq=3D0 ttl=3D64 time=3D0.277 ms =20 --- 10.1.1.1 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/stddev =3D 0.277/0.277/0.277/0.000 ms =20 /Peter= --Apple-Mail-23D62BF1-3634-4296-8017-ACC755F05135 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

25 feb. 2020 kl. 07:24 skrev Jan Novak <repcom@gmail.co= m>:

= =EF=BB=BFAm 25.02.20 um 07:07 schrieb Peter Libassi:
23 feb. 2020 kl. 16:32 sk= rev Jason A. Donenfeld <Jason@zx2c4.com>:
On Sun, Feb 23, 2020 at 2:25 PM Peter Libassi <peter@libassi.se&= gt; wrote:
Ok, Well even if usin= g another local IP in range 127.0.0.0/8 we can=E2=80=99t be certain we will c= lash with something else.
<= blockquote type=3D"cite">

How about a= dding a directive for the remote interface address in wg.conf? Like this:

# cat /usr/local/etc/wireguard/wg0.conf=
=
[Interface]=
PrivateKey =3D <-><= /span>
<= blockquote type=3D"cite">
ListenPort =3D 7777=
=
Address =3D 192.16= 8.2.1/32
RemoteAddre= ss =3D 192.168.2.2
=
=
[Peer]
<= /blockquote>
PublicKey =3D <-><= br>
AllowedIPs =3D 192.168.2.0= /24
Endpoint =3D 17= 2.16.0.23:7777

# diff /usr/local/bin/w= g-quick.org ./wg-quick
17a18
REMOTE_ADDRESS=3D""
86a88
RemoteAddress) REMOTEADDRESS=3D"$valu= e"; continue ;;
175c177,181
< cmd ifconfig "$INTERFACE" inet "$1" "${1%%/*}" alias
---
   if [= [ -n $REMOTEADDRESS ]]; then
cmd ifconfig "$INTERFACE" i= net "$1" "$REMOTEADDRESS" alias
   else<= /span>
         &n= bsp;     cmd ifconfig "$INTERFACE" inet "$1" "${1%%= /*}" alias
<= blockquote type=3D"cite">    fi
=
This is not a correct fix; we're not going to add a con= figuration nob
to work around FreeBSD network stack gotcha= s.

Rather, I'd prefer to see all the Fre= eBSD wg-quick semantics redone
around multiple routing tab= les and marks, much like on Linux, though I
don't know if t= hat's possible. Barring that, a proper solution
probably i= nvolves re-reading the ifconfig man page a few dozen times
to find out how to have interface addresses as we need them.
It works perfectly for= my single site-2-site use case. You have two options as I see it. Either co= nvince the FreeBSD team to drop the dest_address requirement or implement lo= cal/remote address awareness per [Peer] in the wg-quick script.


Hi Peter,

Can you show me an e= xample for "... implement local/remote address awareness per [Peer] in the w= g-quick script... "


Bfo



Here is one way to do it:

root@vpn1:~ # cat /usr/local/etc/wireguard/wg= 0.conf

[Interface]

  PrivateKey =3D <->

  ListenPo= rt =3D 7777

 

[Peer]

  PublicKey =3D <->

&nb= sp; LinkAddress =3D 10.0.0.1/10.0.0.2

  Endpoint =3D 192.168.59.155= :7777

  AllowedIPs =3D 10.0.0.2/32

 

[Peer]=

  P= ublicKey =3D <->

  LinkAddress =3D 10.1.1.1/10.1.1.2

&nbs= p; Endpoint =3D 192.168.58.155:7777

  AllowedIPs =3D 10.1.1.2/32

 

$ diff /usr/local/bin/wg-quick wg-quick

16a17

<= p class=3D"MsoNormal" style=3D"-webkit-text-size-adjust: auto; margin: 0cm 0= cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">> LADDRE= SSES=3D( )

63c64

<       local inte= rface_section=3D0 line key value stripped path

---

>  &= nbsp;    local interface_section=3D0 peer_section=3D0 line ke= y value stripped path

95a97,102

>     &n= bsp;         [[ $key =3D=3D "[Peer]"= ]] && peer_section=3D1

>      &n= bsp;        if [[ $peer_section -eq 1 ]];= then

>          &n= bsp;            case "= $key" in

>          =              Lin= kAddress) LADDRESSES+=3D( ${value//,/ } ); continue ;;

>  &= nbsp;            = ;        esac

>   &= nbsp;           fi

175= c182

<          &nb= sp;    cmd ifconfig "$INTERFACE" inet "$1" "${1%%/*}" alias

---

>          &= nbsp;    cmd ifconfig "$INTERFACE" inet "${1%/*}/32" "${1#*/}= " alias

419c426

<       for i in "$= {ADDRESSES[@]}"; do

---

>       for= i in "${LADDRESSES[@]}"; do

 

root@vpn1:~ # /home/peter/wg-qui= ck up wg0

[#] wireguard-go wg0

INFO: (wg0) 2020/02/25 13:49:54 Start= ing wireguard-go version 0.0.20200121

[#] wg setconf wg0 /tmp/tmp.vXURfm= Kj/sh-np.pCIWwG

[#] ifconfig wg0 inet 10.0.0.1/32 10.0.0.2 alias

[#]= ifconfig wg0 inet 10.1.1.1/32 10.1.1.2 alias

[#] ifconfig wg0 mtu 1420<= o:p>

[#] ifconfig wg0 up

[#] route -q -n add -inet 10.1.1.2/32 -interface= wg0

[#] route -q -n add -inet 10.0.0.2/32 -interface wg0

=

[+] Backgro= unding route monitor

 

root@vpn1:~ # ifconfig wg0

<= p class=3D"MsoNormal" style=3D"-webkit-text-size-adjust: auto; margin: 0cm 0= cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">wg0: flags=3D= 8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1420

 &nb= sp;      options=3D80000<LINKSTATE>

 = ;       inet 10.0.0.1 --> 10.0.0.2 netmask 0= xffffffff

        inet 10.1.1.1 -->= ; 10.1.1.2 netmask 0xffffffff

       = groups: tun

        nd6 options=3D10= 1<PERFORMNUD,NO_DAD>

        Op= ened by PID 2033

 

root@VPN1:~ # netstat -rn4

Routing tables<= o:p>

 

Internet:

Destination      =   Gateway          &n= bsp; Flags     Netif Expire

default   =          192.168.59.2  &nb= sp;    UGS         em= 0

10.0.0.1           l= ink#4            = ; UHS         lo0

10.0.0.2 &= nbsp;         link#4  &nbs= p;          UH   = ;       wg0

10.0.0.2/32   &= nbsp;    wg0        &= nbsp;       US     &n= bsp;    wg0

10.1.1.1      &= nbsp;    link#4       &nbs= p;     UHS       &nbs= p; lo0

10.1.1.2         &nb= sp; link#4           =   UH          wg0

10.1= .1.2/32        wg0    = ;            US =          wg0

127.0.0.1  =         link#3    &nb= sp;        UH    &nbs= p;     lo0

192.168.59.0/24    link#1&n= bsp;            U&nbs= p;          em0

<= p class=3D"MsoNormal" style=3D"-webkit-text-size-adjust: auto; margin: 0cm 0= cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">192.168.59.= 154     link#1        = ;     UHS       =   lo0

192.168.153.0/24   link#2    &n= bsp;        U    &nbs= p;      em1

192.168.153.130    li= nk#2            = UHS         lo0

 

root= @vpn1:~ # ping -c1 10.0.0.1

PING 10.0.0.1 (10.0.0.1): 56 data bytes=

= 64 bytes from 10.0.0.1: icmp_seq=3D0 ttl=3D64 time=3D0.373 ms

=

 =

= --- 10.0.0.1 ping statistics ---

1 packets transmitted, 1 packets received,= 0.0% packet loss

round-trip min/avg/max/stddev =3D 0.373/0.373/0.373/0.0= 00 ms

 

root@vpn1:~ # ping -c1 10.1.1.1

PING 10.1.1.1 (10.1.1= .1): 56 data bytes

64 bytes from 10.1.1.1: icmp_seq=3D0 ttl=3D64 time=3D= 0.277 ms

 

--- 10.1.1.1 ping statistics ---

1 packets transm= itted, 1 packets received, 0.0% packet loss

round-trip min/avg/max/stdde= v =3D 0.277/0.277/0.277/0.000 ms

 

/Peter

= --Apple-Mail-23D62BF1-3634-4296-8017-ACC755F05135-- --===============8697779894563161453== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ WireGuard mailing list WireGuard@lists.zx2c4.com https://lists.zx2c4.com/mailman/listinfo/wireguard --===============8697779894563161453==--