trouble installing on Fedora and CentOS

trouble installing on Fedora and CentOS

[adam souzis]

[-- Attachment #1: Type: text/plain, Size: 1756 bytes --]

I've been impressed with Wireguard, its design has helped simplify the
implementation of a distributed sandbox app I am building quite a bit. But
I have had mixed results getting it running on different distributions.

The good news is that I can report that I was able to build, install and
run Wireguard on CoreOs.

The bad news is I was unable to get Wireguard working on either CentOS 7,
Fedora 26 or Fedora 25 (running these on AWS), it doesn't appear to be
installing the kernel module properly.

Here's what I see when install the RPM:

+ dkms add -m wireguard -v 0.0.20170629 -q --rpm_safe_upgrade

+ dkms build -m wireguard -v 0.0.20170629 -q

+ dkms install -m wireguard -v 0.0.20170629 -q

D: %post(wireguard-dkms-1:0.0.20170629-2.fc25.noarch): waitpid(14760) rc
14760 status 100

warning: %post(wireguard-dkms-1:0.0.20170629-2.fc25.noarch) scriptlet
failed, exit status 1

Non-fatal POSTIN scriptlet failure in rpm package wireguard-dkms


Looks like it might have worked:

[fedora@ip-1~]$ sudo dkms status

wireguard, 0.0.20170629: added

BUT:

[fedora@ip-1 ~]$ sudo ip link add dev wg0 type wireguard

RTNETLINK answers: Operation not supported
I tried this on the latest version of the RPM and this earlier version. I
also tried compiling it from source on Fedora but make failed early on.

I disabled selinux, verified the kernel config is good and manually enabled
udp_tunnel for good measure. Any other suggestions? (I did see an earlier
post here recommending using kernel-ml for centos 7 but I need to use the
Atomic Host variant and swapping out the kernel on that is non-trivial. I
was hoping using a recent Fedora would solve the kernel compatibility
issues.)

thank you!
Adam
ᐧ

[-- Attachment #2: Type: text/html, Size: 2939 bytes --]

Re: trouble installing on Fedora and CentOS

[Bruno Wolff III]

On Tue, Aug 08, 2017 at 12:58:58 -0700,
  adam souzis <adam@souzis.com> wrote:
>
>The bad news is I was unable to get Wireguard working on either CentOS 7,
>Fedora 26 or Fedora 25 (running these on AWS), it doesn't appear to be
>installing the kernel module properly.

I run it on rawhide (Fedora 27 effectivel) by building from source.

I have a local clone of the git repo and do the following:
cd WireGuard/src
make clean all
su
make install

That installs the kernel module in the running kernel. You'll need kernel-devel 
installed and maybe kernel-headers. If you are updating the module, you will 
want to stop wireguard and use rmmod wireguard to remove the existing module, 
so the new one will get loaded (or reboot the system).

Re: trouble installing on Fedora and CentOS

[adam souzis]

[-- Attachment #1: Type: text/plain, Size: 1125 bytes --]

OK, you inspired me to try harder to build it from source -- turns out on
both fedora 25 and 26 `uname -r` doesn't match the kernel src installed by
kernel-devel, once I fixed that it builds and installs and appears to work.

thanks!
Adam
ᐧ

On Tue, Aug 8, 2017 at 1:08 PM, Bruno Wolff III <bruno@wolff.to> wrote:

> On Tue, Aug 08, 2017 at 12:58:58 -0700,
>  adam souzis <adam@souzis.com> wrote:
>
>>
>> The bad news is I was unable to get Wireguard working on either CentOS 7,
>> Fedora 26 or Fedora 25 (running these on AWS), it doesn't appear to be
>> installing the kernel module properly.
>>
>
> I run it on rawhide (Fedora 27 effectivel) by building from source.
>
> I have a local clone of the git repo and do the following:
> cd WireGuard/src
> make clean all
> su
> make install
>
> That installs the kernel module in the running kernel. You'll need
> kernel-devel installed and maybe kernel-headers. If you are updating the
> module, you will want to stop wireguard and use rmmod wireguard to remove
> the existing module, so the new one will get loaded (or reboot the system).
>

[-- Attachment #2: Type: text/html, Size: 1955 bytes --]

Re: trouble installing on Fedora and CentOS

[Jason A. Donenfeld]

Hi Joe,

Could you look into Adam's issue with your package?

Adam,

Can you provide the full output of whatever is behind "warning:
%post(wireguard-dkms-1:0.0.20170629-2.fc25.noarch) scriptlet failed,
exit status 1"? Is there a debug switch to get more verbose logs?

Why not install this directly from copr? Additionally, why are you
installing 0629? That package is very old.

https://copr.fedorainfracloud.org/coprs/jdoss/wireguard/

Jason



On Tue, Aug 8, 2017 at 9:58 PM, adam souzis <adam@souzis.com> wrote:
>
> I've been impressed with Wireguard, its design has helped simplify the im=
plementation of a distributed sandbox app I am building quite a bit. But I =
have had mixed results getting it running on different distributions.
>
> The good news is that I can report that I was able to build, install and =
run Wireguard on CoreOs.
>
> The bad news is I was unable to get Wireguard working on either CentOS 7,=
 Fedora 26 or Fedora 25 (running these on AWS), it doesn't appear to be ins=
talling the kernel module properly.
>
> Here's what I see when install the RPM:
>
> + dkms add -m wireguard -v 0.0.20170629 -q --rpm_safe_upgrade
>
> + dkms build -m wireguard -v 0.0.20170629 -q
>
> + dkms install -m wireguard -v 0.0.20170629 -q
>
> D: %post(wireguard-dkms-1:0.0.20170629-2.fc25.noarch): waitpid(14760) rc =
14760 status 100
>
> warning: %post(wireguard-dkms-1:0.0.20170629-2.fc25.noarch) scriptlet fai=
led, exit status 1
>
> Non-fatal POSTIN scriptlet failure in rpm package wireguard-dkms
>
>
> Looks like it might have worked:
>
> [fedora@ip-1~]$ sudo dkms status
>
> wireguard, 0.0.20170629: added
>
> BUT:
>
> [fedora@ip-1 ~]$ sudo ip link add dev wg0 type wireguard
>
> RTNETLINK answers: Operation not supported
>
> I tried this on the latest version of the RPM and this earlier version. I=
 also tried compiling it from source on Fedora but make failed early on.
>
> I disabled selinux, verified the kernel config is good and manually enabl=
ed udp_tunnel for good measure. Any other suggestions? (I did see an earlie=
r post here recommending using kernel-ml for centos 7 but I need to use the=
 Atomic Host variant and swapping out the kernel on that is non-trivial. I =
was hoping using a recent Fedora would solve the kernel compatibility issue=
s.)
>
> thank you!
> Adam
> =E1=90=A7
>
> _______________________________________________
> WireGuard mailing list
> WireGuard@lists.zx2c4.com
> https://lists.zx2c4.com/mailman/listinfo/wireguard
>

Re: trouble installing on Fedora and CentOS

[Joe Doss]

Hey Adam,

Thanks for using WireGuard. See my response below.

On 08/08/2017 02:58 PM, adam souzis wrote:
> I've been impressed with Wireguard, its design has helped simplify the 
> implementation of a distributed sandbox app I am building quite a bit. 
> But I have had mixed results getting it running on different distributions.
> 
> The good news is that I can report that I was able to build, install and 
> run Wireguard on CoreOs.
> 
> The bad news is I was unable to get Wireguard working on either CentOS 
> 7, Fedora 26 or Fedora 25 (running these on AWS), it doesn't appear to 
> be installing the kernel module properly.
> 
> Here's what I see when install the RPM:
> 
> + dkms add -m wireguard -v 0.0.20170629 -q --rpm_safe_upgrade
> 
> + dkms build -m wireguard -v 0.0.20170629 -q
> 
> + dkms install -m wireguard -v 0.0.20170629 -q
> 
> D: %post(wireguard-dkms-1:0.0.20170629-2.fc25.noarch): waitpid(14760) rc 
> 14760 status 100
> 
> warning: %post(wireguard-dkms-1:0.0.20170629-2.fc25.noarch) scriptlet 
> failed, exit status 1
> 
> Non-fatal POSTIN scriptlet failure in rpm package wireguard-dkms
Are you running into this issue on a freshly provisioned server? Or 
after you do a system update? Do you reboot into the most current kernel 
if you do update? Does the kernel update along with kernel-devel and 
kernel-headers?

This issue is caused by you running a kernel that doesn't have the 
correct kernel-header package installed:

[root@localhost ~]# dkms status
wireguard, 0.0.20170726: added

[root@localhost wireguard-0.0.20170726]# dkms build -m wireguard -v 
0.0.20170726
Error! echo
Your kernel headers for kernel 4.11.8-300.fc26.x86_64 cannot be found at
/lib/modules/4.11.8-300.fc26.x86_64/build or 
/lib/modules/4.11.8-300.fc26.x86_64/source.

[root@localhost ~]# uname -a
Linux localhost.localdomain 4.11.8-300.fc26.x86_64 #1 SMP Thu Jun 29 
20:09:48 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

[root@localhost ~]# rpm -qa |grep kernel
kernel-devel-4.11.11-300.fc26.x86_64
kernel-core-4.11.8-300.fc26.x86_64
kernel-headers-4.11.11-300.fc26.x86_64

I just tested the latest package on Vagrant and it works after running a 
dnf update and rebooting into the most current kernel that matches the 
currently installed kernel headers package.

[root@localhost ~]# uname -a
Linux localhost.localdomain 4.11.11-300.fc26.x86_64 #1 SMP Mon Jul 17 
16:32:11 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

[root@localhost ~]# rpm -qa |grep kernel
kernel-devel-4.11.11-300.fc26.x86_64
kernel-core-4.11.8-300.fc26.x86_64
kernel-headers-4.11.11-300.fc26.x86_64
kernel-core-4.11.11-300.fc26.x86_64

[root@localhost ~]# dkms build -m wireguard -v 0.0.20170726
Module wireguard/0.0.20170726 already built for kernel 
4.11.11-300.fc26.x86_64/4

[root@localhost ~]# ip link add dev wg0 type wireguard

[root@localhost ~]# wg show
interface: wg0

You either want to install the kernel-headers package that matches your 
currently running kernel or dnf update and reboot, then DKMS will auto 
build the WireGuard kernel module on boot.

Joe

--
Joe Doss
joe@solidadmin.com

Re: trouble installing on Fedora and CentOS

[adam souzis]

[-- Attachment #1: Type: text/plain, Size: 4443 bytes --]

Hi Joe,

Thanks for looking into this, yes you are correct that my machine's kernel
version didn't match with what the rpm expected, I discovered this when I
tried to build from source. Maybe this error should be fatal or output a
message suggesting the expected kernel?

Have you tried to get your packages to working on an Atomic Host build?
When I did, the install failed:

[fedora@atomic~]$ uname -r

4.11.11-300.fc26.x86_64

[fedora@atomic~]$ sudo rpm-ostree install
./wireguard-dkms-0.0.20170726-1.fc26.noarch.rpm

Checking out tree 0715ce8... done

Resolving dependencies... done

Overlaying... done

*error: *Running %post for wireguard-dkms: Executing
bwrap(/usr/wireguard-dkms.post): Child process exited with code 8

So I just copied the wireguard.ko and wg binaries over from a regular
Fedora 26, did an insmod and things are working, so I'm good for now.

thanks,

Adam
ᐧ

On Tue, Aug 8, 2017 at 6:51 PM, Joe Doss <joe@solidadmin.com> wrote:

> Hey Adam,
>
> Thanks for using WireGuard. See my response below.
>
> On 08/08/2017 02:58 PM, adam souzis wrote:
>
>> I've been impressed with Wireguard, its design has helped simplify the
>> implementation of a distributed sandbox app I am building quite a bit. But
>> I have had mixed results getting it running on different distributions.
>>
>> The good news is that I can report that I was able to build, install and
>> run Wireguard on CoreOs.
>>
>> The bad news is I was unable to get Wireguard working on either CentOS 7,
>> Fedora 26 or Fedora 25 (running these on AWS), it doesn't appear to be
>> installing the kernel module properly.
>>
>> Here's what I see when install the RPM:
>>
>> + dkms add -m wireguard -v 0.0.20170629 -q --rpm_safe_upgrade
>>
>> + dkms build -m wireguard -v 0.0.20170629 -q
>>
>> + dkms install -m wireguard -v 0.0.20170629 -q
>>
>> D: %post(wireguard-dkms-1:0.0.20170629-2.fc25.noarch): waitpid(14760) rc
>> 14760 status 100
>>
>> warning: %post(wireguard-dkms-1:0.0.20170629-2.fc25.noarch) scriptlet
>> failed, exit status 1
>>
>> Non-fatal POSTIN scriptlet failure in rpm package wireguard-dkms
>>
> Are you running into this issue on a freshly provisioned server? Or after
> you do a system update? Do you reboot into the most current kernel if you
> do update? Does the kernel update along with kernel-devel and
> kernel-headers?
>
> This issue is caused by you running a kernel that doesn't have the correct
> kernel-header package installed:
>
> [root@localhost ~]# dkms status
> wireguard, 0.0.20170726: added
>
> [root@localhost wireguard-0.0.20170726]# dkms build -m wireguard -v
> 0.0.20170726
> Error! echo
> Your kernel headers for kernel 4.11.8-300.fc26.x86_64 cannot be found at
> /lib/modules/4.11.8-300.fc26.x86_64/build or
> /lib/modules/4.11.8-300.fc26.x86_64/source.
>
> [root@localhost ~]# uname -a
> Linux localhost.localdomain 4.11.8-300.fc26.x86_64 #1 SMP Thu Jun 29
> 20:09:48 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
>
> [root@localhost ~]# rpm -qa |grep kernel
> kernel-devel-4.11.11-300.fc26.x86_64
> kernel-core-4.11.8-300.fc26.x86_64
> kernel-headers-4.11.11-300.fc26.x86_64
>
> I just tested the latest package on Vagrant and it works after running a
> dnf update and rebooting into the most current kernel that matches the
> currently installed kernel headers package.
>
> [root@localhost ~]# uname -a
> Linux localhost.localdomain 4.11.11-300.fc26.x86_64 #1 SMP Mon Jul 17
> 16:32:11 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
>
> [root@localhost ~]# rpm -qa |grep kernel
> kernel-devel-4.11.11-300.fc26.x86_64
> kernel-core-4.11.8-300.fc26.x86_64
> kernel-headers-4.11.11-300.fc26.x86_64
> kernel-core-4.11.11-300.fc26.x86_64
>
> [root@localhost ~]# dkms build -m wireguard -v 0.0.20170726
> Module wireguard/0.0.20170726 already built for kernel
> 4.11.11-300.fc26.x86_64/4
>
> [root@localhost ~]# ip link add dev wg0 type wireguard
>
> [root@localhost ~]# wg show
> interface: wg0
>
> You either want to install the kernel-headers package that matches your
> currently running kernel or dnf update and reboot, then DKMS will auto
> build the WireGuard kernel module on boot.
>
> Joe
>
> --
> Joe Doss
> joe@solidadmin.com
>
> _______________________________________________
> WireGuard mailing list
> WireGuard@lists.zx2c4.com
> https://lists.zx2c4.com/mailman/listinfo/wireguard
>

[-- Attachment #2: Type: text/html, Size: 6343 bytes --]

Re: trouble installing on Fedora and CentOS

[Joe Doss]

On 08/09/2017 07:39 AM, adam souzis wrote:
> Hi Joe,
> 
> Thanks for looking into this, yes you are correct that my machine's 
> kernel version didn't match with what the rpm expected, I discovered 
> this when I tried to build from source. Maybe this error should be fatal 
> or output a message suggesting the expected kernel?

I am not sure how must effort that will require. If anyone has any ideas 
on how to make this edge case better I am all ears.

For the time being, just ensure you have the right kernel-headers 
installed for your running kernel and you should be fine.

> Have you tried to get your packages to working on an Atomic Host build? 
> When I did, the install failed:
> 
> [fedora@atomic~]$ uname -r
> 
> 4.11.11-300.fc26.x86_64
> 
> [fedora@atomic~]$ sudo rpm-ostree install 
> ./wireguard-dkms-0.0.20170726-1.fc26.noarch.rpm
> 
> Checking out tree 0715ce8... done
> 
> Resolving dependencies... done
> 
> Overlaying... done
> 
> *error: *Running %post for wireguard-dkms: Executing 
> bwrap(/usr/wireguard-dkms.post): Child process exited with code 8
> 
> So I just copied the wireguard.ko and wg binaries over from a regular 
> Fedora 26, did an insmod and things are working, so I'm good for now.


If I get some time I will ask the folks in #atomic what the best method 
is for adjusting a F26 RPM to work in Atomic. My hunch it is failing 
when it tries to write the WireGuard files to /usr/src/ which is read 
only (I think).

Joe




--
Joe Doss
joe@solidadmin.com