Wireguard on android w/o kernel module

Wireguard on android w/o kernel module

[Maximilian Eschenbacher]

[-- Attachment #1: Type: text/plain, Size: 3502 bytes --]

Good day to all of you,

I'm using wireguard version 0.0.20180601 from google play store on a
stock BQ Aquaris X with android version 8.1 without the wireguard kernel
module.

I am unable to start any tunnels. Every time I am trying to do so there
is a window which tells me: "Error brining up tunnel: VPN service not
authorized by user". I have been looking around the android settings
because this sounds like a configuration issue which I could be able to
solve as an end user, however, I didn't turn up anything useful.

Here's the `adb logcat` output:

06-01 18:27:03.518  6265  6906 D WireGuard/GoBackend: Changing tunnel test1 to state UP
06-01 18:27:03.519  6265  6906 I WireGuard/GoBackend: Bringing tunnel up
06-01 18:27:03.542  6265  6265 E WireGuard/b: Error bringing up tunnel: VPN service not authorized by user
06-01 18:27:03.542  6265  6265 E WireGuard/b: b.b.a.b: java.lang.Exception: VPN service not authorized by user
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at b.b.a.a.d(Unknown Source:19)
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at b.b.a.a.e(Unknown Source:4)
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at b.b.a.a$n.a(Unknown Source:18)
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at b.b.a.a.b(Unknown Source:35)
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at b.b.a.a.c(Unknown Source:15)
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at com.wireguard.android.e.a.a(Unknown Source:0)
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at com.wireguard.android.e.e.run(Unknown Source:4)
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at android.os.Handler.handleCallback(Handler.java:790)
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at android.os.Handler.dispatchMessage(Handler.java:99)
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at android.os.Looper.loop(Looper.java:164)
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at android.app.ActivityThread.main(ActivityThread.java:6518)
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at java.lang.reflect.Method.invoke(Native Method)
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:438)
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:807)
06-01 18:27:03.542  6265  6265 E WireGuard/b: Caused by: java.lang.Exception: VPN service not authorized by user
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at com.wireguard.android.backend.GoBackend.a(Unknown Source:25)
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at com.wireguard.android.backend.GoBackend.a(Unknown Source:74)
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at com.wireguard.android.d.b.b(Unknown Source:2)
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at com.wireguard.android.d.w.a(Unknown Source:6)
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at com.wireguard.android.e.a.a(Unknown Source:0)
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at com.wireguard.android.e.c.run(Unknown Source:6)
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at android.os.AsyncTask$SerialExecutor$1.run(AsyncTask.java:245)
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1162)
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:636)
06-01 18:27:03.542  6265  6265 E WireGuard/b: 	at java.lang.Thread.run(Thread.java:764)

Am I missing something obvious?

Best regards

Max

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Wireguard on android w/o kernel module

[Jason A. Donenfeld]

Hello Maximilian,

This happens when either:

a) You reject the permissions prompt shown when the app opens.
b) Another VPN application is set to "always on" mode.

You can investigate (b) by fishing around in the system VPN settings
and seeing what's there, possibly removing authorization for those.
Afterwards, close the application, reopen it, and it should prompt you
to accept permissions.

We'll happily accept a patch automating this kind of thing, if the
Android frameworks allow it.

Jason

Re: Wireguard on android w/o kernel module

[Maximilian Eschenbacher]

[-- Attachment #1: Type: text/plain, Size: 385 bytes --]

Hey Jason,

thanks for the quick response.

On 01/06/2018 18:42:41, Jason A. Donenfeld wrote:
>You can investigate (b) by fishing around in the system VPN settings
>and seeing what's there, possibly removing authorization for those.
>Afterwards, close the application, reopen it, and it should prompt you
>to accept permissions.

This was exactly what had happened.

Best regards

Max

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Wireguard on android w/o kernel module

[Jose Marinez]

[-- Attachment #1: Type: text/plain, Size: 954 bytes --]

Pardon me, as I just sent a related message without reading this one first. The fact remains, there should be a better way to handle and prevent this. Perhaps, at a minimum and in the interim, to suggest investigating the installation of another VPN client settings right in the error message.


Thanks,Jose

On Friday, June 1, 2018, 12:54 PM, Maximilian Eschenbacher <maximilian+wireguard@eschenbacher.email> wrote:

Hey Jason,

thanks for the quick response.

On 01/06/2018 18:42:41, Jason A. Donenfeld wrote:
>You can investigate (b) by fishing around in the system VPN settings
>and seeing what's there, possibly removing authorization for those.
>Afterwards, close the application, reopen it, and it should prompt you
>to accept permissions.

This was exactly what had happened.

Best regards

Max
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard




[-- Attachment #2: Type: text/html, Size: 2078 bytes --]

Re: Wireguard on android w/o kernel module

[Jason A. Donenfeld]

On Sat, Jun 2, 2018 at 11:47 PM Jose Marinez <jedi_papi@yahoo.com> wrote:
> Pardon me, as I just sent a related message without reading this one first. The fact remains, there should be a better way to handle and prevent this.

Care to poke around in the APIs and see if you can come up with
something automatic and useful?

Jason

Re: Wireguard on android w/o kernel module

[Jose Marinez]

[-- Attachment #1: Type: text/plain, Size: 849 bytes --]

Hi Jason,
I'm looking into that specific aspect as we speak. Google at times has "peculiar ways" to conceive of how users would interact with Android, maybe this is one of them. However, I've seen developers abuse APIs in self interest for a number of reasons.
On iOS, once a VPN app is disconnected, it automatically ceases the right to "always on."
I'll dig around and get back to you on this.  


Thanks,Jose

On Saturday, June 2, 2018, 5:49 PM, Jason A. Donenfeld <Jason@zx2c4.com> wrote:

On Sat, Jun 2, 2018 at 11:47 PM Jose Marinez <jedi_papi@yahoo.com> wrote:
> Pardon me, as I just sent a related message without reading this one first. The fact remains, there should be a better way to handle and prevent this.

Care to poke around in the APIs and see if you can come up with
something automatic and useful?

Jason




[-- Attachment #2: Type: text/html, Size: 1703 bytes --]