Closed liuxyon closed 1 year ago
Hello, @liuxyon!
Put compiled dtlspipe binary to /usr/local/bin/dtlspipe
Put file with following contents into /etc/systemd/system/dtlspipe-server.service
:
[Unit]
Description=dtlspipe server
Documentation=https://github.com/Snawoot/dtlspipe/
After=network.target network-online.target
Requires=network-online.target
[Service]
EnvironmentFile=/etc/default/dtlspipe-server
DynamicUser=yes
StateDirectory=dtlspipe
Environment=HOME=%S/dtlspipe
ExecStart=/usr/local/bin/dtlspipe $OPTIONS
TimeoutStopSec=5s
PrivateTmp=true
ProtectSystem=full
[Install]
WantedBy=default.target
Put file with following contents into /etc/default/dtlspipe-server
:
OPTIONS=server 0.0.0.0:2815 127.0.0.1:56218
DTLSPIPE_PSK=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
where OPTIONS
are corresponding command line arguments and DTLSPIPE_PSK
is PSK. We pass it as an env variable to hide it from process command line in the process list like ps -ef
.
Set actual listen address instead of 0.0.0.0:2815
.
Set actual destination UDP endpoint instead of 127.0.0.1:56218
.
Execute following commands as root:
systemctl daemon-reload
systemctl enable --now dtlspipe-server
You'll need to put binary somewhere as well, e. g. to /usr/local/bin/dtlspipe
.
Then you should auto start it with arguments as you need. Here is pfSense documentation how to do it: https://docs.netgate.com/pfsense/en/latest/development/boot-commands.html
this tool is use DTLS1.3 version?
this tool is use DTLS1.3 version?
No, it operates DTLS1.2 only
then this option is this config in file? skip-hello-verify=true
Can you clarify how the various run option parameters are written in the configuration file?
Can you clarify how the various run option parameters are written in the configuration file?
Note that dtlspipe
itself has no configuration files, it accepts only command line arguments. All files above are actually SystemD files: unit file and env file with options. Please refer to systemd documentation for further reference.
In systemd case above words from OPTIONS go as is to command line arguments of startup command /usr/local/bin/dtlspipe $OPTIONS
. That means, in that example actual command line will be run is: /usr/local/bin/dtlspipe server 0.0.0.0:2815 127.0.0.1:56218
, which corresponds to command line for server operation.
If you need to add option -skip-hello-verify
, then your /etc/default/dtlspipe-server
will look like this:
OPTIONS= -skip-hello-verify server 0.0.0.0:2815 127.0.0.1:56218
DTLSPIPE_PSK=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
ok. then pfsense freebsd system put file in /root/dtlspipe/dtlspipe.freebsd-amd64 and file dtlspipe-client, and add nohup /root/dtlspipe/dtlspipe.freebsd-amd64 -c /root/dtlspipe/dtlspipe-client > /dev/null 2>&1 & in pfsense shellcmd it is right?
@liuxyon not sure if nohup is needed at all, maybe you can even get away with just /root/dtlspipe/dtlspipe.freebsd-amd64 client ... ... > /dev/null 2>&1
. But yes, you got the idea. It may take a bit of experimentation, though.
thanks! The connection is successful using ipv4, is it possible to connect using ipv6? server [::]:2815 [::1]:56218 it is right?
In addition, I would like to know how many additional data headers MTU will be added using DTLS?
thanks! The connection is successful using ipv4, is it possible to connect using ipv6? server [::]:2815 [::1]:56218 it is right?
Yes, you may use any combination between endpoints. E.g. [::]:2815 127.0.0.1:56218
will work as well.
In addition, I would like to know how many additional data headers MTU will be added using DTLS?
It might be dependent on negotiated ciphersuite, but last time I checked I think it was between 29 and 81 bytes. So, I guess, subtract 100 from MTU for a good measure. Or check exact numbers with tcpdump/wireshark.
how i get list of DTLS1.2 ciphers ? What is used by default ciphers value? When can I upgrade to DTLS1.3? now i am using WG MTU 1390 for test.
Options: -ciphers value
I saw some articles writing that DTLS1.3 has better performance https://www.wolfssl.com/whats-new-dtls-1-3/ https://inria.hal.science/hal-03035402/document
thanks! The connection is successful using ipv4, is it possible to connect using ipv6? server [::]:2815 [::1]:56218 it is right?
Yes, you may use any combination between endpoints. E.g.
[::]:2815 127.0.0.1:56218
will work as well.In addition, I would like to know how many additional data headers MTU will be added using DTLS?
It might be dependent on negotiated ciphersuite, but last time I checked I think it was between 29 and 81 bytes. So, I guess, subtract 100 from MTU for a good measure. Or check exact numbers with tcpdump/wireshark.
client side use ipv6 show wrong: /root/dtlspipe/dtlspipe: No match. it is can't run. use remote ipv4 is normal.
how i get list of DTLS1.2 ciphers ?
With dtlspipe ciphers
command. It's mentioned in help.
What is used by default ciphers value?
By default ciphers list from dtlspipe ciphers
subcommand are used. Client and server negotiate first common cipher from their lists (which can be set with -ciphers
option).
When can I upgrade to DTLS1.3? now i am using WG MTU 1390 for test.
Options: -ciphers value
I saw some articles writing that DTLS1.3 has better performance https://www.wolfssl.com/whats-new-dtls-1-3/ https://inria.hal.science/hal-03035402/document
DTLS 1.3 will be available as soon as pion/dtls library will support it.
client side use ipv6 show wrong: /root/dtlspipe/dtlspipe: No match. it is can't run. use remote ipv4 is normal.
I tested, works for me.
i tested on pfsense show: nohup /root/dtlspipe/dtlspipe -timeout 60s -psk 7fd671ac4699ad3c859907163f30d921 client 10.50.1.254:62116 [2a0d:2408:515::1]:39880 /root/dtlspipe/dtlspipe: No match.
Under what circumstances will No match occur?
@liuxyon can't tell for sure. Looks like this error comes not from dtlspipe, but from shell even before program is being run. Can you please try to put IPv6 address argument into single quotes like this:
nohup /root/dtlspipe/dtlspipe -timeout 60s -psk 7fd671ac4699ad3c859907163f30d921 client 10.50.1.254:62116 '[2a0d:2408:515::1]:39880'
use ' ' it is running. but handshake with remote server failed
DTLSPIPE: 2023/09/29 18:50:27.713577 client.go:108: DTL handshake with remote server failed: handshake error: context deadline exceeded DTLSPIPE: 2023/09/29 18:50:27.713669 client.go:109: [-] conn 10.50.1.254:62116 <=> 10.50.1.254:51821 DTLSPIPE: 2023/09/29 18:50:28.393000 client.go:93: [+] conn 10.50.1.254:62116 <=> 10.50.1.254:51821
systemctl status dtlspipe-server ● dtlspipe-server.service - dtlspipe server Loaded: loaded (/etc/systemd/system/dtlspipe-server.service; enabled; preset: enabled) Active: active (running) since Fri 2023-09-29 18:49:09 HKT; 6min ago Docs: https://github.com/Snawoot/dtlspipe/ Main PID: 24645 (dtlspipe) Tasks: 5 (limit: 2182) Memory: 2.5M CPU: 14ms CGroup: /system.slice/dtlspipe-server.service └─24645 /usr/local/bin/dtlspipe -skip-hello-verify -timeout 60s -ciphers TLS_PSK_WITH_AES_128_GCM_SHA256 server "[::]:39880" "[::]:39780"
Sep 29 18:49:09 uk.xiaoyu.net systemd[1]: Started dtlspipe-server.service - dtlspipe server. Sep 29 18:49:09 uk.xiaoyu.net dtlspipe[24645]: DTLSPIPE: 2023/09/29 18:49:09.985154 main.go:137: starting dtlspipe server: [::]:39880 =[unwrap from DTLS]=> [::]:39780
systemctl status dtlspipe-server ● dtlspipe-server.service - dtlspipe server Loaded: loaded (/etc/systemd/system/dtlspipe-server.service; enabled; preset: enabled) Active: active (running) since Fri 2023-09-29 18:40:43 HKT; 4min 56s ago Docs: https://github.com/Snawoot/dtlspipe/ Main PID: 24499 (dtlspipe) Tasks: 5 (limit: 2182) Memory: 2.5M CPU: 10ms CGroup: /system.slice/dtlspipe-server.service └─24499 /usr/local/bin/dtlspipe -skip-hello-verify -timeout 60s -ciphers TLS_PSK_WITH_AES_128_GCM_SHA256 server "[::]:39880" 127.0.0.1:39780
use this server "[::]:39880" "[2a0d:2408:515::1]:39780" and pfsense system restart, then it is work.
You may also try to check IPv6 both on client and server machine with following command: curl https://api6.ipify.org
. It should output public IPv6 address.
Here it shows that PSK is weak. Is it considered more secure? https://ciphersuite.info/cs/TLS_PSK_WITH_AES_128_GCM_SHA256/ Weak TLS_PSK_WITH_AES_128_GCM_SHA25
In addition, how to deploy services on windows 11 ,windows server 2022 and andriod system?
Here it shows that PSK is weak. Is it considered more secure?
It lacks perfect forward secrecy, but still good. Or, If you really need that property, use TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA256
.
In addition, how to deploy services on windows 11 ,windows server 2022 and andriod system?
Use task scheduler to run command in background: https://pureinfotech.com/prevent-command-window-appearing-scheduled-tasks-windows-10/
Use simple VBS wrapper to run a program without window: https://superuser.com/questions/1168587/how-to-run-an-exe-application-as-a-background-task-on-startup/1619817#1619817
Use NSSM to run any command as a service: https://nssm.cc/usage
Use srvstart to run any command as a service: https://github.com/rozanski/srvstart
Just use some terminal emulator to run a command. One convenient option is Qute, which has shortcuts and autostart, as far as I remember.
Does it support multiple configurations running simultaneously? For example OPTIONS= -skip-hello-verify -timeout 60s -ciphers TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA256 server 0.0.0.0:39883 127.0.0.1:39781 DTLSPIPE_PSK= OPTIONS= -skip-hello-verify -timeout 60s -ciphers TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA256 server 0.0.0.0:39885 127.0.0.1:39782 DTLSPIPE_PSK=
Just run multiple instances of application.
what's i do change the dtlspipe-server.service?
what's i do change the dtlspipe-server.service?
systemctl disable --now dtlspipe-server
/etc/systemd/system/dtlspipe-server.service
to /etc/systemd/system/dtlspipe-server@.service
[Unit]
Description=dtlspipe server
Documentation=https://github.com/Snawoot/dtlspipe/
After=network.target network-online.target
Requires=network-online.target
[Service]
EnvironmentFile=/etc/default/dtlspipe-server-%i
DynamicUser=yes
StateDirectory=dtlspipe
Environment=HOME=%S/dtlspipe
ExecStart=/usr/local/bin/dtlspipe $OPTIONS
TimeoutStopSec=5s
PrivateTmp=true
ProtectSystem=full
[Install]
WantedBy=default.target
Note that EnvironmentFile
is now parametrized by name of instance of dtlspipe.
systemctl daemon-reload
For example, let's say we need two dtlspipe instances for Alice and Bob. Then we need to create following files:
/etc/default/dtlspipe-server-alice
:
OPTIONS= -skip-hello-verify -timeout 60s -ciphers TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA256 server 0.0.0.0:39883 127.0.0.1:39781
DTLSPIPE_PSK=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
/etc/default/dtlspipe-server-bob
:
OPTIONS= -skip-hello-verify -timeout 60s -ciphers TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA256 server 0.0.0.0:39885 127.0.0.1:39782
DTLSPIPE_PSK=YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
systemctl enable --now dtlspipe-server@alice
systemctl enable --now dtlspipe-server@bob
Ha ha. . Thank you. You are so patient... I feel like I have too many ideas...
i think should creat telegram group.
good idea!
made a typo: it's %i
instead of $i
. I updated the comment.
you creat it and i will join tg.
i want to try run it in ubuntu 23.04 and pfsense.
how i do run it with service?