search

rany2 / warp.sh

WARP wireguard config generator in POSIX Shell
Boost Software License 1.0
248 stars 37 forks source link

Service Token auth #13

Open gunzino opened 3 months ago

gunzino commented 3 months ago

Hello,

Would it be possible implement Service Token auth for "WARP Connector" so this would allow us to create true Site-to-Site VPN with pure WireGuard.

https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/private-net/warp-connector/

rany2 commented 3 months ago

I'll have to research it, I don't know what this is

MeesJ commented 2 months ago

I attempted using the CF_Authorization cookie obtained by authorizing with a service token at the TEAMNAME.cloudflareaccess.com/warp endpoint. However, it seems the current version of the warp.sh script isn't compliant with this authorization method. The following error is returned:

curl: (22) The requested URL returned error: 500
rany2 commented 2 months ago

I doubt that that cookie is used to obtain a WG config. I'll have a look myself but my assumption is that everything is going to be different in terms of generating the config and it will not be a straightforward modification.

MeesJ commented 2 months ago

I doubt that that cookie is used to obtain a WG config

Not directly, but the output of that cookie returns a JWT token as usual (https://developers.cloudflare.com/cloudflare-one/identity/service-tokens/).

GaryChicago commented 2 months ago

@MeesJ I did get this working (Cloudflare ZT/Teams w/ Service Auth) by pulling information from the cloudflare warp linux client. I can provide feedback here or we can start a group chat if we're interested in getting this working natively in this script.

My UDM Pro Max is natively connected via its wireguard client to cloudflare.

image

rany2 commented 1 month ago

@GaryChicago Do you know how to MITM it? warp-svc on Linux seems to embed the trusted certificates into the binary itself so it's not trivial to modify it. If you have any tips I'd appreciate it.