AMajor/SoftEtherVPN
1
0
Fork 0
mirror of https://github.com/SoftEtherVPN/SoftEtherVPN.git synced 2025-07-07 00:04:57 +03:00
Code Releases Activity

Cedar: Implement support for WireGuard

Browse Source 
Please note that the implementation is not 100% conformant to the protocol whitepaper (https://www.wireguard.com/papers/wireguard.pdf).
More specifically: all peers are expected to send a handshake initiation once the current keypair is about to expire or is expired.
I decided not to do that because our implementation is meant to act as a server only. A true WireGuard peer acts, instead, as both a client and a server.
Once the keypair is expired, we immediately delete the session.

The cookie mechanism can be implemented in future.

As for authentication: unfortunately using the already existing methods is not possible due to the protocol not providing a way to send strings to a peer.
That's because WireGuard doesn't have a concept of "users": it identifies a peer through the public key, which is determined using the source address.
As a solution, this commit adds a special authentication method: once we receive the handshake initiation message and decrypt the peer's public key, we check whether it's in the allowed key list.
If it is, we retrieve the associated Virtual Hub and user; if the hub exists and the user is in it, the authentication is successful.

The allowed key list is stored in the configuration file like this:

declare WireGuardKeyList
{
	declare 96oA7iMvjn7oXiG3ghBDPaSUytT75uXceLV+Fx3XMlM=
	{
		string Hub DEFAULT
		string User user
	}
}
This commit is contained in:
Davide Beatrici
2020-09-01 07:00:17 +02:00
parent 8495388933
commit dd1eebdbed
22 changed files with 1611 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/bin/hamcore/strtable_ru.stb
View File

@ -1769,6 +1769,7 @@ LS_SSL_START SSL communication for connection "%S" has been started. The encry
LS_CONNECTION_ERROR Connection "%S" terminated by the cause "%s" (code %u).
LS_FARMMEMBER_NOT_ADMIN Connection "%S": Although the server is a cluster member, the client attempted that to directly connect to the Virtual Hub "%S" while not being administrator user "%S". The user name provided by the client is "%S". Access is refused.
LS_HUB_NOT_FOUND Connection "%S": Virtual Hub "%S" that the client is trying to connect to does not exist on the server.
LS_WG_KEY_NOT_FOUND Connection "%S": The WireGuard key is not associated with a user on the server.
LS_IP_DENIED Connection "%S": The source IP address "%S" of the client has refused based on the Source IP Address Limit List defined for the Virtual Hub.
LS_LICENSE_ERROR Connection "%S": Because a license-related error has been occurred, the client is unable to connect to the server.
LS_BETA_EXPIRES This beta version of SoftEther VPN Server is expired. The beta version period of use has expired. Download a new beta version or full version from http://selinks.org/.
@ -1800,6 +1801,16 @@ LP_SESSION_CREATED Session created.
LP_SESSION_DELETED Session deleted.
# (WireGuard log)
LW_PREFIX_SESSION [WireGuard] %r:%u -> %r:%u:
LW_KEYPAIR_EXPIRED Current keypair (%x -> %x) is expired!
LW_KEYPAIR_UNKNOWN The packet was encrypted with an unknown keypair!
LW_DECRYPT_FAIL Decryption failure!
LW_REPLAY_ATTACK Replay attack detected!
LW_FLOOD_ATTACK Flood attack detected!
LW_HUB_DISCONNECT The administrator of the Virtual Hub has disconnected this session.
# (OpenVPN Logs)
LO_PREFIX_RAW OpenVPN Module:
LO_PREFIX_SESSION OpenVPN Session %u (%r:%u -> %r:%u):
@ -1902,7 +1913,8 @@ LH_AUTH_PASSWORD Password authentication
LH_AUTH_PLAIN_PASSWORD External server authentication
LH_AUTH_CERT Certificate authentication
LH_AUTH_TICKET Ticket authentication
LH_AUTH_OPENVPN_CERT OpenVPN certificate authentication
LH_AUTH_WIREGUARD_KEY WireGuard public key authentication
LH_AUTH_OPENVPN_CERT OpenVPN certificate authentication
LH_AUTH_RADIUS_NOT_SUPPORT Connection "%S": The authentication method of the user "%S" has been specified as RADIUS Authentication or Active Directory Authentication (NT Domain Authentication). However, the edition of the VPN Server is "%S". This edition does not support RADIUS Authentication nor Active Directory Authentication (NT Domain Authentication). The connection will be denied.
LH_AUTH_RADIUS_NOT_SUPPORT_ON_OPEN_SOURCE Connection "%S": The authentication method of the user "%S" has been specified as RADIUS Authentication or Active Directory Authentication (NT Domain Authentication). However, such an external user-authentication function hasn't been implemented on the Open-Source version of SoftEther VPN yet. The connection will be denied.
LH_AUTH_CERT_NOT_SUPPORT_ON_OPEN_SOURCE Connection "%S": The authentication method of the user "%S" has been specified as Certificate Authentication. However, the Certificate Authentication function hasn't been implemented on the Open-Source version of SoftEther VPN yet. The connection will be denied.