[wireguard] Add plugin for WireGuard VPN tunnels - #4426
Open
suraj-cmd wants to merge 1 commit into
Open
Conversation
WireGuard is in the mainline kernel and wireguard-tools is packaged for RHEL, Fedora, Debian and Ubuntu, but sos has no plugin for it and no other plugin references it. Neither the interface configuration nor the runtime tunnel state reaches an sosreport. The plugin collects /etc/wireguard/*.conf, the output of "wg show all", and the status and journal of the templated wg-quick@ unit. "wg showconf" is deliberately not run: it prints the interface private key verbatim. "wg show" masks private and preshared keys as "(hidden)" unless WG_HIDE_KEYS=never is set in the environment, per masked_key() in src/show.c, so its default output is safe. The configuration files themselves hold the private key and any per-peer preshared key in cleartext, so postproc() redacts both. Public keys, endpoints and allowed IPs are left intact, since those are what a tunnel problem is usually diagnosed from. Example of the substitution: PrivateKey = 8Gt...= -> PrivateKey = ******** Signed-off-by: Suraj Patil <surajpatil522@gmail.com>
|
Congratulations! One of the builds has completed. 🍾 You can install the built RPMs by following these steps:
Please note that the RPMs should be used only in a testing environment. |
1 similar comment
|
Congratulations! One of the builds has completed. 🍾 You can install the built RPMs by following these steps:
Please note that the RPMs should be used only in a testing environment. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
WireGuard is in the mainline kernel and
wireguard-toolsis packaged for RHEL,Fedora, Debian and Ubuntu, but sos has no plugin for it and no other plugin
references it. Neither the interface configuration nor the runtime tunnel state
reaches an sosreport.
The plugin collects
/etc/wireguard/*.conf, the output ofwg show all, andthe status and journal of the templated
wg-quick@unit.wg showconfis deliberately not run: it prints the interface private keyverbatim.
wg showmasks private and preshared keys as(hidden)unlessWG_HIDE_KEYS=neveris set in the environment, permasked_key()insrc/show.c, so its default output is safe.The configuration files themselves hold the private key and any per-peer
preshared key in cleartext, so
postproc()redacts both. Public keys,endpoints and allowed IPs are left intact, since those are what a tunnel
problem is usually diagnosed from.
Example of the substitution:
Paths, unit name and key-masking behaviour are taken from upstream
wireguard-tools(src/show.c,src/config.c,src/systemd/wg-quick@.service) rather than a running deployment. Thepostproc()regex was tested against sample config lines:PrivateKeyandPresharedKeyare redacted whilePublicKey,EndpointandAllowedIPsareleft intact.
Please place an 'X' inside each '[]' to confirm you adhere to our Contributor Guidelines