WireSep

Privilege separated implementation of WireGuard

Privilege separation, long-term secrets in a separate process
Short-term secrets separated per tunnel interface
Fork/re-exec for a different memory layout between different networks
Tight pledge(2) and no file system access after startup
Easy to read and write config file format for humans, easy to parse for machines (only depends on POSIX yacc(1))
Uses connected sockets for performance and reliability

Latest release

wiresep-0.11.3.tar.gz (April 26, 2020)
sha256 - changes - license ISC

Now that a kernel version is integrated into OpenBSD and will probably ship with OpenBSD 6.8, this project is in maintenance mode and will only receive fixes for critical bugs.

Requirements

OpenBSD 6.7

Install

$ doas pkg_add wiresep

Generate a new private key for the tun0 interface.

$ doas wiresep-keygen tun0

Then create a configuration and store it in /etc/wiresep/wiresep.conf. A simple example looks like the following:

# This is an example of a server listening on the public ip 198.51.100.7 port
# 1022. It uses the tun0 device with the internal ip addresses 2001:db8::7
# and 172.16.0.1 and allows communication with the peer Jane and Joe. Jane is
# allowed to use any source ip, while Joe may only use 2001:db8::4 or
# 172.16.0.11/30 as the source ip of his packets. The private key for the tun0
# interface can be generated with `wiresep-keygen tun0`.

interface tun0 {
    ifaddr 2001:db8::7/126
    ifaddr 172.16.0.1/24

    listen 198.51.100.7:1022

    peer jane {
        pubkey BhyBpDfD7joIPPpjBW/g/Wdhiu3iVOzQhKodbsLqJ3A=
        allowedips *
    }

    peer joe {
        pubkey AhyBpDfD7joIPPpjBW/g/Wdhiu3iVOzQhKodbsLqJ3A=
        allowedips 2001:db8::4
        allowedips 172.16.0.11/30
    }
}

See wiresep.conf(5) for a complete description of the configuration file.

Once everyting is set, run wiresep(8):

$ doas wiresep

Documentation

Refer to the manuals for documentation and a configuration example:

The design documents can be found in the doc directory.

Code and repository

Browse the release archive, browse the source code online or clone the repository:

$ git clone https://netsend.nl/wiresep.git

Known issues

Interface aliases are not supported for outbound connections. In order to properly support local address selection without having to rely on an unpledged superuser process a new system call that combines bind(2) and connect(2) would be required.

Contact

You can send a message to tim at this domain. When sending in patches I prefer the format created by git-format-patch(1).