Re: Reading configuration from stdin

["Jason A. Donenfeld" <Jason@zx2c4.com>]

Hi Manuel,

Thanks for the patch. A few comments on the general idea below:

On Sun, Dec 10, 2017 at 1:43 PM, Manuel Sch=C3=B6lling
<manuel.schoelling@gmx.de> wrote:
> I am currently working on a NetworkManager plugin for WireGuard in Rust
> [1/2].
> The plugin has to pass the configuration to the wg tool and I am
> wondering if this could be done using interprocess communication.
> Btw, this NetworkManager plugin should not only work for the regular
> WireGuard but also for my wireguard peer-to-peer tool [3] whose
> development is currently stalled by a rust bug [4].

I'd suggest the following for a WireGuard NetworkManager plugin:

1. If you want to do stuff for wireguard-p2p, can you make it a
separate "extra" plugin, so that the generic WireGuard one is globally
useful? And then people who use the p2p stuff can use a separate
plugin that piggybacks upon the first?

2. Write it in a language that will be accepted by upstream. I have no
clue their thoughts on Rust.

3. Rather than calling wg(8), maybe it's best to speak the Netlink API
directly? I can give you a hand with this, if you want. The API is
documented in this header:
https://git.zx2c4.com/WireGuard/tree/src/uapi/wireguard.h


> Would it make sense (aka be secure) if we make it possible to call 'wg
> setconf wg0 -' so the wg tool does not read the configuration from a
> file but from stdin? Same for 'wg set wg0 private-key -' and 'wg set
> wg0 psk -'?

wg-quick(8) does this precise thing, and generally this is a fine way
of passing config information. However, usually you can get away with
using the more explicit /dev/stdin or /proc/self/fd/0, as Aaron
suggested. Are there reasons to prefer - over /dev/stdin?

Jason