AMajor/SoftEtherVPN
1
0
Fork 0
mirror of https://github.com/SoftEtherVPN/SoftEtherVPN.git synced 2025-07-10 01:34:58 +03:00
Code Releases Activity

Cedar: Implement support for WireGuard

Browse Source 
Please note that the implementation is not 100% conformant to the protocol whitepaper (https://www.wireguard.com/papers/wireguard.pdf).
More specifically: all peers are expected to send a handshake initiation once the current keypair is about to expire or is expired.
I decided not to do that because our implementation is meant to act as a server only. A true WireGuard peer acts, instead, as both a client and a server.
Once the keypair is expired, we immediately delete the session.

The cookie mechanism can be implemented in future.

As for authentication: unfortunately using the already existing methods is not possible due to the protocol not providing a way to send strings to a peer.
That's because WireGuard doesn't have a concept of "users": it identifies a peer through the public key, which is determined using the source address.
As a solution, this commit adds a special authentication method: once we receive the handshake initiation message and decrypt the peer's public key, we check whether it's in the allowed key list.
If it is, we retrieve the associated Virtual Hub and user; if the hub exists and the user is in it, the authentication is successful.

The allowed key list is stored in the configuration file like this:

declare WireGuardKeyList
{
	declare 96oA7iMvjn7oXiG3ghBDPaSUytT75uXceLV+Fx3XMlM=
	{
		string Hub DEFAULT
		string User user
	}
}
This commit is contained in:
Davide Beatrici
2020-09-01 07:00:17 +02:00
parent 8495388933
commit dd1eebdbed
22 changed files with 1611 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/bin/hamcore/strtable_tw.stb
View File

@ -1789,6 +1789,7 @@ LS_SSL_START 連接 "%S" 的 SSL 通信已啟動。加密演算法名為 "%S"
LS_CONNECTION_ERROR 連接 "%S"因原因 "%s" (代碼 %u)已終止。
LS_FARMMEMBER_NOT_ADMIN 連接 "%S": 服務端是群集成員，但用戶端在非管理員 (%S) 使用者情況下，嘗試直接與虛擬 HUB "%S" 連接。用戶端用戶名為 "%S"。訪問被拒絕。
LS_HUB_NOT_FOUND 連接 "%S": 客戶端正在嘗試連接的虛擬 HUB "%S" 在服務端上不存在。
LS_WG_KEY_NOT_FOUND Connection "%S": The WireGuard key is not associated with a user on the server.
LS_IP_DENIED 連接 "%S": 基於虛擬 HUB 上定義的源 IP 訪問限制列表，用戶端的源 IP 位址 "%S" 被拒絕。
LS_LICENSE_ERROR 連接 "%S": 因為發生許可證相關錯誤，用戶端無法連接到服務端。
LS_BETA_EXPIRES SoftEther VPN Server 測試版已過期。測試版使用期限已到。請從 http://selinks.org/ 下載新的測試版或完整版。
@ -1820,6 +1821,16 @@ LP_SESSION_CREATED Session created.
LP_SESSION_DELETED Session deleted.
# (WireGuard 日誌)
LW_PREFIX_SESSION [WireGuard] %r:%u -> %r:%u:
LW_KEYPAIR_EXPIRED Current keypair (%x -> %x) is expired!
LW_KEYPAIR_UNKNOWN The packet was encrypted with an unknown keypair!
LW_DECRYPT_FAIL Decryption failure!
LW_REPLAY_ATTACK Replay attack detected!
LW_FLOOD_ATTACK Flood attack detected!
LW_HUB_DISCONNECT The administrator of the Virtual Hub has disconnected this session.
# (OpenVPN 日誌)
LO_PREFIX_RAW OpenVPN 模組:
LO_PREFIX_SESSION OpenVPN 會話%u (%r:%u -> %r:%u):
@ -1922,7 +1933,8 @@ LH_AUTH_PASSWORD 密碼驗證
LH_AUTH_PLAIN_PASSWORD 外部伺服器身份驗證
LH_AUTH_CERT 證書驗證
LH_AUTH_TICKET 票證驗證
LH_AUTH_OPENVPN_CERT OpenVPN certificate authentication
LH_AUTH_WIREGUARD_KEY WireGuard public key authentication
LH_AUTH_OPENVPN_CERT OpenVPN certificate authentication
LH_AUTH_RADIUS_NOT_SUPPORT 連接 "%S": 用戶 "%S" 身份驗證方法 RADIUS 或 Active Directory (NT 域)，但 VPN Server 是 "%S"，因為 RADIUS 或 Active Directory (NT 域)不能使用。連接被拒絕。
LH_AUTH_RADIUS_NOT_SUPPORT_ON_OPEN_SOURCE "%S" 的連接方法: 用戶 "%S" 的身份驗證方法被指定為 RADIUS 身份驗證或 Active Directory 身份驗證 (NT 域驗證)。然而，這樣一個外部用戶身份驗證功能尚未在 SoftEther VPN 的開源版本上實施。該連接將被拒絕。
LH_AUTH_CERT_NOT_SUPPORT_ON_OPEN_SOURCE "%S" 的連接方法: 用戶 "%S" 的身份驗證方法被指定為證書認證。然而，證書驗證功能尚未在 SoftEther VPN 的開源版本上實施。該連接將被拒絕。