Implement support for Wireguard in PIA #1836

FireMasterK · 2023-09-01T22:19:15Z

Closes #612
Untested, as I don't have a PIA account

Warning: I don't really write a lot of Go code, so the structure may be bad!

garlik82 · 2023-09-03T21:31:17Z

I'm willing to test this. Already built the image but what should I put in my compose file?

FireMasterK · 2023-09-03T22:10:52Z

I'm willing to test this. Already built the image but what should I put in my compose file?

You should be able to set your account credentials in the openvpn user credentials, and set VPN_TYPE=wireguard. You need not configure any wireguard keys, as ephemeral keys are automatically registered and used in the API.

garlik82 · 2023-09-03T22:28:48Z

I'm willing to test this. Already built the image but what should I put in my compose file?

You should be able to set your account credentials in the openvpn user credentials, and set VPN_TYPE=wireguard. You need not configure any wireguard keys, as ephemeral keys are automatically registered and used in the API.

ERROR VPN settings: provider settings: VPN provider name is not valid for Wireguard: value is not one of the possible choices: private internet access must be one of airvpn, custom, ivpn, mullvad, nordvpn, surfshark or windscrib.

This is what I get.

If I put custom instead of PIA I get the error saying no endpoint set

FireMasterK · 2023-09-03T22:55:04Z

ERROR VPN settings: provider settings: VPN provider name is not valid for Wireguard: value is not one of the possible choices: private internet access must be one of airvpn, custom, ivpn, mullvad, nordvpn, surfshark or windscrib.

This is what I get.

If I put custom instead of PIA I get the error saying no endpoint set

I've fixed this in the latest commit, please build and try it again.

garlik82 · 2023-09-04T05:21:18Z

ERROR VPN settings: provider settings: VPN provider name is not valid for Wireguard: value is not one of the possible choices: private internet access must be one of airvpn, custom, ivpn, mullvad, nordvpn, surfshark or windscrib.
This is what I get.
If I put custom instead of PIA I get the error saying no endpoint set

I've fixed this in the latest commit, please build and try it again.

Now I get this:

ERROR [vpn] finding a VPN server: filtering servers: no server found: for VPN wireguard; protocol udp; region dk copenhagen; encryption preset strong

FireMasterK · 2023-09-04T19:52:51Z

I've fixed this in the latest commit, please build and try it again.

Now I get this:

ERROR [vpn] finding a VPN server: filtering servers: no server found: for VPN wireguard; protocol udp; region dk copenhagen; encryption preset strong

Hi, please try again, this should now be fixed!

garlik82 · 2023-09-04T20:46:35Z

How do I know the right thing to put in SERVER_REGIONS= ?

FireMasterK · 2023-09-04T21:02:34Z

How do I know the right thing to put in SERVER_REGIONS= ?

Anything that works with OpenVPN should most likely work with Wireguard too.

garlik82 · 2023-09-04T21:13:04Z

How do I know the right thing to put in SERVER_REGIONS= ?

Anything that works with OpenVPN should most likely work with Wireguard too.

It doesn't. Must likely it's searching on servers.json for a wireguard server but PIA only has ovpn server in the built in server list.

https://raw.githubusercontent.com/qdm12/gluetun/master/internal/storage/servers.json (builtin server list)
https://serverlist.piaservers.net/vpninfo/servers/v6 (pia server list)

FireMasterK · 2023-09-04T23:01:25Z

It doesn't. Must likely it's searching on servers.json for a wireguard server but PIA only has ovpn server in the built in server list.

https://raw.githubusercontent.com/qdm12/gluetun/master/internal/storage/servers.json (builtin server list) https://serverlist.piaservers.net/vpninfo/servers/v6 (pia server list)

Could you give it a go again? I managed to reproduce those errors without an account, and each of them should be fixed now.

You may need to disable the firewall with FIREWALL=off (not sure how to work around it currently)

garlik82 · 2023-09-05T06:04:44Z

almost there.

ERROR [vpn] getting Wireguard connection: HTTP status code is not OK: https://www.privateinternetaccess.com/gtoken/generateToken: 403 403 Forbidden: response received: <title>403 Forbidden</title>

403 Forbidden

cloudflare </html

qdm12

Thanks for the contribution!

Unfortunately this requires connectivity before the VPN is up, and that's a deal breaker for Gluetun. I'm slowly working towards a solution but this is far from done. The PR won't be useless though, it will be used at some point in the future 👍 !

qdm12 · 2023-09-13T14:41:02Z

internal/provider/privateinternetaccess/portforward_test.go

-			result := replaceInString(testCase.s, testCase.substitutions)
+			result := ReplaceInString(testCase.s, testCase.substitutions)


please keep this unexported (lowercase first letter), there is no need to export it

qdm12 · 2023-09-13T14:41:58Z

internal/provider/privateinternetaccess/utils.go

+// replaceInErr is used to remove sensitive information from errors.
+func ReplaceInErr(err error, substitutions map[string]string) error {
+	s := ReplaceInString(err.Error(), substitutions)
+	return errors.New(s) //nolint:goerr113
+}
+
+// replaceInString is used to remove sensitive information.
+func ReplaceInString(s string, substitutions map[string]string) string {
+	for old, new := range substitutions {
+		s = strings.ReplaceAll(s, old, new)
+	}
+	return s
+}
+
+func makeNOKStatusError(response *http.Response, substitutions map[string]string) (err error) {
+	url := response.Request.URL.String()
+	url = ReplaceInString(url, substitutions)
+
+	b, _ := io.ReadAll(response.Body)
+	shortenMessage := string(b)
+	shortenMessage = strings.ReplaceAll(shortenMessage, "\n", "")
+	shortenMessage = strings.ReplaceAll(shortenMessage, "  ", " ")
+	shortenMessage = ReplaceInString(shortenMessage, substitutions)
+
+	return fmt.Errorf("%w: %s: %d %s: response received: %s",
+		ErrHTTPStatusCodeNotOK, url, response.StatusCode,
+		response.Status, shortenMessage)
+}


please move this back to original location; you can do a subsequent PR to move these around after for cleanup if necessary, but let's keep this PR focused on what it's supposed to do.

qdm12 · 2023-09-13T14:43:13Z

internal/provider/privateinternetaccess/wireguardconfigurator.go

+
+func (p *Provider) GetWireguardConnection(ctx context.Context, connection models.Connection, wireguardSettings settings.Wireguard, ipv6Supported bool) (settings wireguard.Settings, err error) {
+	// create http client to make requests to the server's API
+	client, err := newHTTPClient(connection.Hostname)


handle the error

Suggested change

client, err := newHTTPClient(connection.Hostname)

client, err := newHTTPClient(connection.Hostname)

if err != nil {

return fmt.Errorf("creating http client: %w", err)

}

qdm12 · 2023-09-13T14:43:24Z

internal/provider/privateinternetaccess/wireguardconfigurator.go

+)
+
+func (p *Provider) GetWireguardConnection(ctx context.Context, connection models.Connection, wireguardSettings settings.Wireguard, ipv6Supported bool) (settings wireguard.Settings, err error) {
+	// create http client to make requests to the server's API


nit comment unneeded

Suggested change

// create http client to make requests to the server's API

qdm12 · 2023-09-13T14:43:35Z

internal/provider/privateinternetaccess/wireguardconfigurator.go

+	// create http client to make requests to the server's API
+	client, err := newHTTPClient(connection.Hostname)
+
+	// generate a new private key


nit comment unneeded

Suggested change

// generate a new private key

qdm12 · 2023-09-13T15:34:54Z

.gitignore

@@ -1 +1,2 @@
 scratch.txt
+.idea/


remove before merging

qdm12 · 2023-09-13T15:36:01Z

internal/provider/privateinternetaccess/tokenutils.go

@@ -0,0 +1,72 @@
+package privateinternetaccess


rename file to token.go, avoid utils in filename or directory, it's rather meaningless

qdm12 · 2023-09-13T15:37:29Z

internal/provider/privateinternetaccess/tokenutils.go

+func fetchToken(ctx context.Context, client *http.Client,
+	tokenType string, authFilePath string) (token string, err error) {


since this is used outside openvpn-only, we should inject the username and password and not use the openvpn auth file anymore (especially if it's for Wireguard, that makes it super strange)

qdm12 · 2023-09-13T15:38:38Z

internal/provider/privateinternetaccess/tokenutils.go

+	case "gtoken":
+		path = "/gtoken/generateToken"
+	default:
+		return "", fmt.Errorf("token type %q is not supported", tokenType)


you could even panic here, since that would be a programming error:

Suggested change

return "", fmt.Errorf("token type %q is not supported", tokenType)

panic(fmt.Sprintf("token type %q is not supported", tokenType))

qdm12 · 2023-09-13T15:42:53Z

internal/provider/privateinternetaccess/wireguardconfigurator.go

+	publicKey := privateKey.PublicKey()
+
+	// fetch token from PIA's API
+	token, err := fetchToken(ctx, client, "gtoken", p.authFilePath)


⚠️ This calls www.privateinternetaccess.com and that's a deal breaker for the killswitch and to avoid leaking data outside the tunnel (especially from other containers/devices connecting through gluetun). For example if the tunnel takes 5 seconds to setup, data will leak for 5 seconds; if the tunnel never manages to setup, it would leak for hours.
That's also why I did not implement this yet, but don't worry, your code will be used at some point.

I'm working on a few other moving parts, and the idea is that connecting to privateinternetaccess.com over https (and its dns resolution) would be the only one allowed outside the vpn, temporarily. But this is far from done, so expect this pull request to stay opened for a few months unfortunately.

Theoretically, if the agent were to connect via openvpn over a sideband, download the necessary wireguard configs over the ovpn tunnel, then bring up the primary wireguard tunnel using the downloaded wireguard credentials, would that address the leakage risk?

Obviously the scenario assumes all tunnelled traffic is only routed over wireguard, and thus is blocked till the wireguard tunnel is up. I would assume this should be the default behaviour anyways in the event of the PIA dropping the wireguard tunnel to rotate IPs.

Nikamura · 2023-11-12T18:14:03Z

any way I could help to get support added for PIA wireguard?

Skylinar · 2024-06-17T20:16:16Z

Is there a chance that this will be implemented somewhen? I would love to have that feature.

qdm12 · 2024-06-17T22:47:27Z

any way I could help to get support added for PIA wireguard?
Is there a chance that this will be implemented somewhen? I would love to have that feature.

Note you can already use it with the custom provider and wireguard. Not super easy, but it still relatively easy to do, and quite a few users are already doing this. This is still blocked by #137 which will get merged after release v3.39.0

FireMasterK added 2 commits September 1, 2023 23:09

Add .idea/ directory to gitignore.

9d41b3e

Implement support for Wireguard in PIA

61c76dc

FireMasterK mentioned this pull request Sep 1, 2023

Feature request: Wireguard support for PIA #612

Open

4 tasks

Add PIA to Wireguard allowed providers list.

fdca594

FireMasterK force-pushed the pia-wg branch from fbbf940 to 73355f3 Compare September 4, 2023 20:16

Add wireguard servers to list from api.

4dc40fe

FireMasterK force-pushed the pia-wg branch from 73355f3 to 4dc40fe Compare September 4, 2023 21:29

FireMasterK added 4 commits September 4, 2023 23:07

Fix server updating.

ea7c224

Update servers.json for PIA.

fa4b3c1

Set default pia wireguard port to 1337.

a95d3fb

Handle token fetch error correctly.

1fdda76

Save PIA auth config before.

e22fd60

FireMasterK force-pushed the pia-wg branch from 3de07f8 to e22fd60 Compare September 4, 2023 23:01

qdm12 reviewed Sep 13, 2023

View reviewed changes

qdm12 force-pushed the master branch 2 times, most recently from 7793495 to a194906 Compare September 28, 2023 07:08

qdm12 force-pushed the master branch 2 times, most recently from 57a0645 to 059b128 Compare November 23, 2023 08:37

qdm12 force-pushed the master branch from 9baa495 to d8b9b2a Compare January 19, 2024 16:44

qdm12 force-pushed the master branch 2 times, most recently from bba6a9f to 23b0320 Compare March 25, 2024 18:44

qdm12 force-pushed the master branch from 4d53eb6 to 10f43d7 Compare August 4, 2024 08:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement support for Wireguard in PIA #1836

Implement support for Wireguard in PIA #1836

FireMasterK commented Sep 1, 2023

garlik82 commented Sep 3, 2023

FireMasterK commented Sep 3, 2023

garlik82 commented Sep 3, 2023 •

edited

Loading

FireMasterK commented Sep 3, 2023

garlik82 commented Sep 4, 2023 •

edited

Loading

FireMasterK commented Sep 4, 2023

ERROR [vpn] finding a VPN server: filtering servers: no server found: for VPN wireguard; protocol udp; region dk copenhagen; encryption preset strong

garlik82 commented Sep 4, 2023

FireMasterK commented Sep 4, 2023

garlik82 commented Sep 4, 2023 •

edited

Loading

FireMasterK commented Sep 4, 2023

garlik82 commented Sep 5, 2023 •

edited

Loading

qdm12 left a comment •

edited

Loading

qdm12 Sep 13, 2023

qdm12 Sep 13, 2023

qdm12 Sep 13, 2023

qdm12 Sep 13, 2023

qdm12 Sep 13, 2023

qdm12 Sep 13, 2023

qdm12 Sep 13, 2023

qdm12 Sep 13, 2023

qdm12 Sep 13, 2023

qdm12 Sep 13, 2023

bryanvaz Feb 22, 2024 •

edited

Loading

Nikamura commented Nov 12, 2023

Skylinar commented Jun 17, 2024

qdm12 commented Jun 17, 2024 •

edited

Loading

		result := replaceInString(testCase.s, testCase.substitutions)
		result := ReplaceInString(testCase.s, testCase.substitutions)

		func fetchToken(ctx context.Context, client *http.Client,
		tokenType string, authFilePath string) (token string, err error) {

	return "", fmt.Errorf("token type %q is not supported", tokenType)
	panic(fmt.Sprintf("token type %q is not supported", tokenType))

Implement support for Wireguard in PIA #1836

Are you sure you want to change the base?

Implement support for Wireguard in PIA #1836

Conversation

FireMasterK commented Sep 1, 2023

garlik82 commented Sep 3, 2023

FireMasterK commented Sep 3, 2023

garlik82 commented Sep 3, 2023 • edited Loading

FireMasterK commented Sep 3, 2023

garlik82 commented Sep 4, 2023 • edited Loading

ERROR [vpn] finding a VPN server: filtering servers: no server found: for VPN wireguard; protocol udp; region dk copenhagen; encryption preset strong

FireMasterK commented Sep 4, 2023

ERROR [vpn] finding a VPN server: filtering servers: no server found: for VPN wireguard; protocol udp; region dk copenhagen; encryption preset strong

garlik82 commented Sep 4, 2023

FireMasterK commented Sep 4, 2023

garlik82 commented Sep 4, 2023 • edited Loading

FireMasterK commented Sep 4, 2023

garlik82 commented Sep 5, 2023 • edited Loading

403 Forbidden

qdm12 left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bryanvaz Feb 22, 2024 • edited Loading

Choose a reason for hiding this comment

Nikamura commented Nov 12, 2023

Skylinar commented Jun 17, 2024

qdm12 commented Jun 17, 2024 • edited Loading

garlik82 commented Sep 3, 2023 •

edited

Loading

garlik82 commented Sep 4, 2023 •

edited

Loading

garlik82 commented Sep 4, 2023 •

edited

Loading

garlik82 commented Sep 5, 2023 •

edited

Loading

qdm12 left a comment •

edited

Loading

bryanvaz Feb 22, 2024 •

edited

Loading

qdm12 commented Jun 17, 2024 •

edited

Loading