Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

net/wireguard: use stock rc script, rename server #1049

Merged
merged 7 commits into from
Dec 7, 2018
Merged

net/wireguard: use stock rc script, rename server #1049

merged 7 commits into from
Dec 7, 2018

Conversation

mimugmail
Copy link
Member

Finally found the time to move to stock rc script. I renamed Server to Local as it confused many users coming from OpenVPN not understanding why configure server when using as client.

Still stack traces with 11.1 and 11.2 HBSD, reported from port maintainer that it's stable in 12.0 :(

@fichtner fichtner self-assigned this Dec 7, 2018
@fichtner fichtner merged commit 7a54d7d into opnsense:master Dec 7, 2018
@fichtner
Copy link
Member

fichtner commented Dec 7, 2018

good for an unreleased 12.0 it seems ;) merged, thanks!

@mimugmail
Copy link
Member Author

@fichtner I now also have a report that it works on stock FBSD 11.2, but 19.1b image crashes :/

@fichtner
Copy link
Member

fichtner commented Dec 7, 2018

dirty programming vs hardening features :>

@fichtner
Copy link
Member

fichtner commented Dec 7, 2018

cc @lattera

@mimugmail
Copy link
Member Author

mimugmail commented Dec 7, 2018 •
edited by fichtner
Loading

This is the stack trace, something with UFS:

hbsd_wireguard_ufscrash

Thx to @decke for debugging ..

@lattera
Copy link

lattera commented Dec 7, 2018

This will warrant longer debugging. Do you have steps to reproduce?

@mimugmail
Copy link
Member Author

On OPNsense:

opnsense-code plugins
cd /usr/plugins/net/wireguard
make upgrade

Via UI:

VPN -> WireGuard -> Local:

Add a new instance, leave pub and private empty, Tunnel Address 10.10.61.10/24, Save

Go to Endpoints, add an endpoint, give pubkey

T28Qn5VFzT4wiwEPd7DscwcP3Rsmq23QcnjH1N5G/wc=

Shared secret empty, endpoint se1.wg.azirevpn.net, port 51820.

Go back to Local, open your instance and on dropdown Endpoints choose the one and save.

Then go to General and enable WireGuard.

Now when you restart (just hit Apply/Save) for a couple of times you'll get a stacktrace .. sometimes it takes 20 restarts, sometime only 2. Tested with 18.7 and 19.1b.

@mimugmail
Copy link
Member Author

I installed FreeBSD 11.1 with ZFS and bootstrapped to OPNsense .. error seems to be gone but with exactly every second restart of wireguard I get the following (and wireguard doesn't start):

root@OPNsense:/usr/plugins/net/wireguard # /usr/local/etc/rc.d/wireguard restart
wg-quick: `wg0' is not a WireGuard interface
[#] wireguard-go wg0
WARNING WARNING WARNING WARNING WARNING WARNING WARNING
W                                                     G
W   This is alpha software. It will very likely not   G
W   do what it is supposed to do, and things may go   G
W   horribly wrong. You have been warned. Proceed     G
W   at your own risk.                                 G
W                                                     G
WARNING WARNING WARNING WARNING WARNING WARNING WARNING
INFO: (wg0) 2018/12/09 06:44:33 Starting wireguard-go version 0.0.20181018
[#] wg setconf wg0 /tmp/tmp.2BxwrRHk/sh-np.LsW0oP
[#] ifconfig wg0 inet 10.10.9.61/19 10.10.9.61 alias
[#] ifconfig wg0 mtu 1420
[#] ifconfig wg0 up
[#] resolvconf -a wg0 -x
[#] route -q -n add -inet 0.0.0.0/1 -interface wg0
[#] route -q -n add -inet 128.0.0.0/1 -interface wg0
[#] route -q -n add -inet 193.180.164.58 -gateway 81.24.66.129
[+] Backgrounding route monitor
root@OPNsense:/usr/plugins/net/wireguard # /usr/local/etc/rc.d/wireguard restart
[#] rm -f /var/run/wireguard/wg0.sock
[#] resolvconf -d wg0
local_unbound does not exist in /etc/rc.d or the local startup
directories (/usr/local/etc/rc.d), or is not executable
[#] wireguard-go wg0
WARNING WARNING WARNING WARNING WARNING WARNING WARNING
W                                                     G
W   This is alpha software. It will very likely not   G
W   do what it is supposed to do, and things may go   G
W   horribly wrong. You have been warned. Proceed     G
W   at your own risk.                                 G
W                                                     G
WARNING WARNING WARNING WARNING WARNING WARNING WARNING
INFO: (wg0) 2018/12/09 06:44:36 Starting wireguard-go version 0.0.20181018
[#] wg setconf wg0 /tmp/tmp.514T1VvR/sh-np.8skRrC
[#] ifconfig wg0 inet 10.10.9.61/19 10.10.9.61 alias
[#] ifconfig wg0 mtu 1420
[#] ifconfig wg0 up
[#] resolvconf -a wg0 -x
cp: /dev/null.bak: Operation not supported
local_unbound does not exist in /etc/rc.d or the local startup
directories (/usr/local/etc/rc.d), or is not executable
[#] rm -f /var/run/wireguard/wg0.sock
root@OPNsense:/usr/plugins/net/wireguard # /usr/local/etc/rc.d/wireguard restart
wg-quick: `wg0' is not a WireGuard interface
[#] wireguard-go wg0
WARNING WARNING WARNING WARNING WARNING WARNING WARNING
W                                                     G
W   This is alpha software. It will very likely not   G
W   do what it is supposed to do, and things may go   G
W   horribly wrong. You have been warned. Proceed     G
W   at your own risk.                                 G
W                                                     G
WARNING WARNING WARNING WARNING WARNING WARNING WARNING
INFO: (wg0) 2018/12/09 06:44:39 Starting wireguard-go version 0.0.20181018
[#] wg setconf wg0 /tmp/tmp.mLONnkfF/sh-np.VFvLL3
[#] ifconfig wg0 inet 10.10.9.61/19 10.10.9.61 alias
[#] ifconfig wg0 mtu 1420
[#] ifconfig wg0 up
[#] resolvconf -a wg0 -x
[#] route -q -n add -inet 0.0.0.0/1 -interface wg0
[#] route -q -n add -inet 128.0.0.0/1 -interface wg0
[#] route -q -n add -inet 193.180.164.58 -gateway 81.24.66.129
[+] Backgrounding route monitor
root@OPNsense:/usr/plugins/net/wireguard # /usr/local/etc/rc.d/wireguard restart
[#] rm -f /var/run/wireguard/wg0.sock
[#] resolvconf -d wg0
local_unbound does not exist in /etc/rc.d or the local startup
directories (/usr/local/etc/rc.d), or is not executable
[#] wireguard-go wg0
WARNING WARNING WARNING WARNING WARNING WARNING WARNING
W                                                     G
W   This is alpha software. It will very likely not   G
W   do what it is supposed to do, and things may go   G
W   horribly wrong. You have been warned. Proceed     G
W   at your own risk.                                 G
W                                                     G
WARNING WARNING WARNING WARNING WARNING WARNING WARNING
INFO: (wg0) 2018/12/09 06:44:41 Starting wireguard-go version 0.0.20181018
[#] wg setconf wg0 /tmp/tmp.l81stWjW/sh-np.8psznG
[#] ifconfig wg0 inet 10.10.9.61/19 10.10.9.61 alias
[#] ifconfig wg0 mtu 1420
[#] ifconfig wg0 up
[#] resolvconf -a wg0 -x
cp: /dev/null.bak: Operation not supported
local_unbound does not exist in /etc/rc.d or the local startup
directories (/usr/local/etc/rc.d), or is not executable
[#] rm -f /var/run/wireguard/wg0.sock
root@OPNsense:/usr/plugins/net/wireguard # /usr/local/etc/rc.d/wireguard restart
wg-quick: `wg0' is not a WireGuard interface
[#] wireguard-go wg0
WARNING WARNING WARNING WARNING WARNING WARNING WARNING
W                                                     G
W   This is alpha software. It will very likely not   G
W   do what it is supposed to do, and things may go   G
W   horribly wrong. You have been warned. Proceed     G
W   at your own risk.                                 G
W                                                     G
WARNING WARNING WARNING WARNING WARNING WARNING WARNING
INFO: (wg0) 2018/12/09 06:44:43 Starting wireguard-go version 0.0.20181018
[#] wg setconf wg0 /tmp/tmp.uBL4Lrz7/sh-np.myBSvf
[#] ifconfig wg0 inet 10.10.9.61/19 10.10.9.61 alias
[#] ifconfig wg0 mtu 1420
[#] ifconfig wg0 up
[#] resolvconf -a wg0 -x
[#] route -q -n add -inet 0.0.0.0/1 -interface wg0
[#] route -q -n add -inet 128.0.0.0/1 -interface wg0
[#] route -q -n add -inet 193.180.164.58 -gateway 81.24.66.129
[+] Backgrounding route monitor
root@OPNsense:/usr/plugins/net/wireguard # /usr/local/etc/rc.d/wireguard restart
[#] rm -f /var/run/wireguard/wg0.sock
[#] resolvconf -d wg0
local_unbound does not exist in /etc/rc.d or the local startup
directories (/usr/local/etc/rc.d), or is not executable
[#] wireguard-go wg0
WARNING WARNING WARNING WARNING WARNING WARNING WARNING
W                                                     G
W   This is alpha software. It will very likely not   G
W   do what it is supposed to do, and things may go   G
W   horribly wrong. You have been warned. Proceed     G
W   at your own risk.                                 G
W                                                     G
WARNING WARNING WARNING WARNING WARNING WARNING WARNING
INFO: (wg0) 2018/12/09 06:44:45 Starting wireguard-go version 0.0.20181018
[#] wg setconf wg0 /tmp/tmp.fdtyQ05s/sh-np.gy5dEf
[#] ifconfig wg0 inet 10.10.9.61/19 10.10.9.61 alias
[#] ifconfig wg0 mtu 1420
[#] ifconfig wg0 up
[#] resolvconf -a wg0 -x
cp: /dev/null.bak: Operation not supported
local_unbound does not exist in /etc/rc.d or the local startup
directories (/usr/local/etc/rc.d), or is not executable
[#] rm -f /var/run/wireguard/wg0.sock

@lattera
Copy link

lattera commented Dec 9, 2018

Have you tried running Wireguard on stock HardenedBSD? I'm thinking of filing a bug report with Wireguard.

@decke
Copy link

decke commented Dec 10, 2018

@lattera: You probably haven't noticed that wireguard is a pure userland (Golang) implementation. From the stacktrace it seems that removing a pidfile or unix socket ends in a UFS kernel panic. I don't see how filing a wireguard bug would help here.

@mimugmail
Copy link
Member Author

@lattera I just setup stock HardendBSD on UFS and installed WireGuard. Can not reproduce the error.
@fichtner mentioned something with tunefs which might only OPNsense related .. I'll do some more testing when time allowes.

@lattera
Copy link

lattera commented Dec 10, 2018

@decke Ah. I don't know anything about Wireguard, other than it's a new VPN tech.

@mimugmail That makes sense. HardenedBSD hasn't made any changes to the filesystems supported by FreeBSD. Thank you for trying to reproduce with stock HardenedBSD.

@fichtner How does OPNsense use tunefs? Perhaps @mimugmail can try running tunefs on his HardenedBSD setup then starting Wireguard. FreeBSD did introduce changes to UFS between 11.1 and 11.2.

@fichtner
Copy link
Member

same as FreeBSD simply to enable softdep... need to run a side by side test and isolate the cause... it all revolves around https://github.com/WireGuard/WireGuard/blob/master/src/tools/wg-quick/freebsd.bash IMO

@decke
Copy link

decke commented Dec 12, 2018

We got a bugreport with a stock FreeBSD 11.2 that seems to trigger a similar or the same issue.
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=233955

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@fichtner fichtner

Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@mimugmail @fichtner @lattera @decke