3 ms·

What's stopping the initial handshake packet from being replayed into the network stack? Seems like there would be no packets lost that way. Also, what is the p

What's stopping the initial handshake packet from being replayed into the network stack? Seems like there would be no packets lost that way. Also, what is the purpose of checking for "udp[8] = 1" in the eBPF filter?

zekica 3y ago
udp[8] = 1 filters only handshake packets. Without it, data packets would also be sent to the userspace daemon. I'm not sure if initial handshakes can be replayed, but since WireGuard ignores unknown clients, it might be possible.
tptacek 3y ago
Nothing. It's a good idea. (As the sibling comment points out: the BPF filter snags just initiation packets, which is what we want; it's the WireGuard equivalent of sniffing for TCP SYNs to see connections starting).
yencabulator 3y ago
Yeah, sounds like an NFQUEUE helper that releases the packet after it has added the keys.
- tptacek 3y ago
  Say more!
  - yencabulator 3y ago
    So NFQUEUE is an nftables verdict that puts the packet into a numbered queue going to userspace. A userspace process gets packets from the queue, and at some later point issues a verdict on each packet, which can be drop or allow the packet to pass. You can also pcap-style ask to see just first N bytes of the packet, to decrease overhead. Out of that, you can construct a userspace process that reads a packet from the queue, decrypts the noise initiation, requests configuration, adds wireguard config via netlink, and then releases the packet. And you can do that with multiple packets in flight concurrently. It also allows things like fail-open if the userspace process is broken or overwhelmed, which would be useful here (already in-kernel wg peers would keep working), and spreading load over multiple workers. https://netfilter.org/projects/nftables/manpage.html https://netfilter.org/projects/nftables/manpage.html (search for queue) https://wiki.nftables.org/wiki-nftables/index.php/Queueing_to_userspace https://wiki.nftables.org/wiki-nftables/index.php/Queueing_t... Here's a nice & simple Rust library for the userspace part, to give an idea of what the shape of the API is: https://docs.rs/nfq/latest/nfq/ https://docs.rs/nfq/latest/nfq/ Also, I'm available for contract work ;) Say hi to Ben from Tv.

zekica 3y ago

udp[8] = 1 filters only handshake packets. Without it, data packets would also be sent to the userspace daemon. I'm not sure if initial handshakes can be replayed, but since WireGuard ignores unknown clients, it might be possible.

tptacek 3y ago

Nothing. It's a good idea. (As the sibling comment points out: the BPF filter snags just initiation packets, which is what we want; it's the WireGuard equivalent of sniffing for TCP SYNs to see connections starting).

yencabulator 3y ago

Yeah, sounds like an NFQUEUE helper that releases the packet after it has added the keys.

tptacek 3y ago
Say more!
- yencabulator 3y ago
  So NFQUEUE is an nftables verdict that puts the packet into a numbered queue going to userspace. A userspace process gets packets from the queue, and at some later point issues a verdict on each packet, which can be drop or allow the packet to pass. You can also pcap-style ask to see just first N bytes of the packet, to decrease overhead. Out of that, you can construct a userspace process that reads a packet from the queue, decrypts the noise initiation, requests configuration, adds wireguard config via netlink, and then releases the packet. And you can do that with multiple packets in flight concurrently. It also allows things like fail-open if the userspace process is broken or overwhelmed, which would be useful here (already in-kernel wg peers would keep working), and spreading load over multiple workers. https://netfilter.org/projects/nftables/manpage.html https://netfilter.org/projects/nftables/manpage.html (search for queue) https://wiki.nftables.org/wiki-nftables/index.php/Queueing_to_userspace https://wiki.nftables.org/wiki-nftables/index.php/Queueing_t... Here's a nice & simple Rust library for the userspace part, to give an idea of what the shape of the API is: https://docs.rs/nfq/latest/nfq/ https://docs.rs/nfq/latest/nfq/ Also, I'm available for contract work ;) Say hi to Ben from Tv.