{"id":13639113,"url":"https://github.com/max-moser/network-manager-wireguard","last_synced_at":"2026-01-18T13:10:46.934Z","repository":{"id":29332057,"uuid":"121376654","full_name":"max-moser/network-manager-wireguard","owner":"max-moser","description":"NetworkManager VPN Plugin: Wireguard","archived":false,"fork":false,"pushed_at":"2023-06-14T07:26:21.000Z","size":750,"stargazers_count":470,"open_issues_count":45,"forks_count":57,"subscribers_count":24,"default_branch":"master","last_synced_at":"2026-01-17T20:57:34.086Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/max-moser.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"COPYING","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":"AUTHORS"}},"created_at":"2018-02-13T11:51:15.000Z","updated_at":"2026-01-12T17:48:08.000Z","dependencies_parsed_at":"2024-01-14T09:09:57.038Z","dependency_job_id":"24ff016e-467e-4105-95ea-8731cf7f8724","html_url":"https://github.com/max-moser/network-manager-wireguard","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/max-moser/network-manager-wireguard","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/max-moser%2Fnetwork-manager-wireguard","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/max-moser%2Fnetwork-manager-wireguard/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/max-moser%2Fnetwork-manager-wireguard/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/max-moser%2Fnetwork-manager-wireguard/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/max-moser","download_url":"https://codeload.github.com/max-moser/network-manager-wireguard/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/max-moser%2Fnetwork-manager-wireguard/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28536706,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-18T13:04:05.990Z","status":"ssl_error","status_checked_at":"2026-01-18T13:01:44.092Z","response_time":98,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-02T01:00:57.801Z","updated_at":"2026-01-18T13:10:46.905Z","avatar_url":"https://github.com/max-moser.png","language":"C","funding_links":[],"categories":["Projects"],"sub_categories":["User Interface"],"readme":"# Network-Manager VPN Plugin for WireGuard\n\nThis project is a VPN Plugin for NetworkManager that handles client-side WireGuard connections.  \nIt is based on the [OpenVPN Plugin](https://git.gnome.org/browse/network-manager-openvpn) and was started as a Bachelor's Thesis at [SBA Research](https://www.sba-research.org/).\n\n\n\n## Guide\n\n\n### Compilation\nFor compilation, the project uses autoconf and related things.\n* `./autogen.sh`\n* `make`\n\n\n### Installation\nIn order to get the plugin running, its sources have to be compiled and the result has to be installed. This can be done by following these steps: \n* Compile the project\n* `sudo make sysconfdir=/etc libdir=/usr/lib install` (don't worry; for uninstalling, there is the target `uninstall`)\n\n\n### Execution\nOnce the installation is completed, the Plugin can be used per NetworkManager (usually graphically via the applet).\n\nWhen a new WireGuard connection is created and configured via the NetworkManager GUI (can also be called via `nm-connection-editor`), it is the Connection Editor Plugin which is executed.\nWhen the connection is activated, it is the service plugin that is being called.\n\nA very basic testing suite is provided in the form of the Python script `examples/dbus/dbus.py`, which looks up the Plugin via name on D-Bus and sends it a Connect() instruction. More or less the same thing (and more) can however be achieved by just using NetworkManager after installing the package, so there should not be a need for this - except for the fact that the script is easily modifiable.\n\n\n### Viewing Logs\nThe logs that are created by NetworkManager can be viewed with `journalctl -u NetworkManager` (at least on Arch Linux). For following new input, `journalctl` also supports the follow flag, much like `tail` (`-f`).\n\n\n\n## Files\n\n\n### Scripts\nOver the course of the project, I created some files that are not required for the project itself, but rather for its development.  \nHere is a brief overview over some of them:\n* `includes2strings.py`: Searches the input for `-I` flags (useful for extracting the include dirs from a Makefile)\n* `examples/dbus/dbus.py`: A small script that tests the availability of the Plugin and its responsiveness to D-Bus messages\n\n\n### Configuration\n\n#### D-Bus Allowance\n\nD-Bus does not allow just anybody to own any D-Bus service name they like. Thus, it may be necessary to tell D-Bus that it is not forbidden to use the name `org.freedesktop.NetworkManager.wireguard`.  \nThis can be achieved by placing an appropriate file (like `nm-wireguard-service.conf`) inside the directory `/etc/dbus-1/system.d` or similar.\n\nThe following is an example for the content of such a file:\n~~~~xml\n\u003c!DOCTYPE busconfig PUBLIC\n \"-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN\"\n \"http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd\"\u003e\n\n\u003cbusconfig\u003e\n\t\u003cpolicy context=\"default\"\u003e\n\t\t\u003callow own_prefix=\"org.freedesktop.NetworkManager.wireguard\"/\u003e\n\t\t\u003callow send_destination=\"org.freedesktop.NetworkManager.wireguard\"/\u003e\n\t\t\u003cdeny own_prefix=\"org.freedesktop.NetworkManager.openvpn\"/\u003e\n\t\t\u003cdeny send_destination=\"org.freedesktop.NetworkManager.openvpn\"/\u003e\n\t\u003c/policy\u003e\n\u003c/busconfig\u003e\n~~~~\n\n#### NetworkManager Plugin Configuration\n\nNetworkManager has to be told where the plugins live in order to be able to call them. This is done via `service.name` files, which usually reside in `/etc/NetworkManager/VPN` or `/usr/lib/NetworkManager/VPN` (e.g. `/usr/lib/NetworkManager/VPN/nm-wireguard-service.name`).\n\nAn example for the content of these files would be:\n~~~~ini\n# This file is obsoleted by a file in /usr/local/lib/NetworkManager/VPN\n\n[VPN Connection]\nname=wireguard\nservice=org.freedesktop.NetworkManager.wireguard\nprogram=/usr/local/libexec/nm-wireguard-service\nsupports-multiple-connections=false\n\n[libnm]\nplugin=/usr/local/lib/NetworkManager/libnm-vpn-plugin-wireguard.so\n\n[GNOME]\nauth-dialog=/usr/local/libexec/nm-wireguard-auth-dialog\nproperties=/usr/local/lib/NetworkManager/libnm-wireguard-properties\nsupports-external-ui-mode=false\nsupports-hints=false\n~~~~\n\n\n\n## Knowledge\n\n\n### Service (the Plugin itself)\n\nThe service is responsible for setting up a VPN connection with the supplied parameters. For this, it has to implement a [D-Bus interface](https://developer.gnome.org/NetworkManager/stable/gdbus-org.freedesktop.NetworkManager.VPN.Plugin.html) and listen to incoming requests, which will be sent by NetworkManager in due time (i.e. when the user tells NM to set up the appropriate VPN connection).  \nIf the binary service is not running at the time when NM wants to set up the connection, it will try to start the binary ad hoc.\n\nIn principle, this piece of software can be written in any language, but in order to make the implementation sane, there should at least exist convenient D-Bus bindings for the language. Further, there are parts of the code already implemented in C, which might make it more convenient to just stick to that.\n\n\n### Auth-Dialog\n\nThe auth-dialog is responsible for figuring out missing bits of required sensitive information (such as passwords).\n\nIt reads the required secrets (and bits of data) for the VPN connection from STDIN in a key/value pair format (see below), until the string \"DONE\" occurs.  \nIf there are still secrets (i.e. passwords) that are required but not supplied (which passwords are required can be determined by looking at the supplied `hints` flags), the auth-dialog will check if the keyring contains those secrets.  \nIf there are still secrets missing (and user interaction is allowed per flag), a GTK dialog will be built up in order to prompt the user for passwords.\n\nAfter all is said and done, the binary writes the found secrets to STDOUT (in a line-based format, as seen below) and waits for \"QUIT\" to be read from STDIN before exiting.\n\nThe behaviour of the binary can be modified by passing various options:\n* `-u UUID`: The UUID of the VPN connection, used for looking up secrets from the keyring\n* `-n NAME`: The name of the VPN connection, shown on the popup dialog\n* `-s SERVICE`: Specifies the name of the VPN service, e.g. `org.freedesktop.NetworkManager.openvpn` (used to check for compatibility)\n* `-i`: Allow interaction with the user (i.e. allow a GUI dialog to be created)\n* `--external-ui-mode`: Give a textual description of the dialog instead of creating a GTK dialog\n* `-r`: Force the creation of a dialog, even if all passwords were already found\n* `-t HINT`: Give hints about what passwords are required \n\nExample input:\n~~~~\nDATA_KEY=key\nDATA_VAL=value\nDATA_KEY=another-key\nDATA_VAL=another-value\nSECRET_KEY=password\nSECRET_VAL=verysecurepassword\nDONE\n~~~~\n\nExample output:\n~~~~\npassword\nverysecurepassword\n~~~~\n\n\n### Connection Editor Plugin\n\nThe Connection Editor Plugin is responsible for providing a GUI inside NetworkManager where all relevant properties for a VPN connection can be specified. If you don't know what I'm talking about, just think about the GUI where you entered the information needed to connect to your local Wifi. That's probably pretty similar.\n\nThe Editor Plugin is also responsible for providing means of importing and exporting VPN connections from and to external files in a custom format.\n\nNetworkManager integrates the VPN editors by looking up _shared objects_ in the above mentioned configuration file and accessing them at run-time.  \nThis means however that the editor plugin GUI has to be provided by a shared object, which means that the editor cannot be written in just any language.\n\n\n### Storage of the Connections\n\nSaved connections are stored in `/etc/NetworkManager/system-connections`, with owner `root:root` and access permissions `0700`.  \nThis guarantees that nobody can have a look at the saved system-wide connections (and their stored secrets) that isn't supposed to.\n\nAn example of such a system-connection file would be (one can see that the user-input data is stored as key-value pairs with internally used keys in the vpn section):\n~~~~ini\n[connection]\nid=wiretest\nuuid=8298d5ea-73d5-499b-9376-57409a7a2331\ntype=vpn\nautoconnect=false\npermissions=\n\n[vpn]\nlocal-ip4=192.168.1.2/24\nlocal-listen-port=51820\nlocal-private-key=CBomGS37YC4ak+J2+NPuHtmgIk6gC7yQZKHnboJd3F8=\npeer-allowed-ips=192.168.1.254\npeer-endpoint=8.16.32.11:51820\npeer-public-key=GRk7K3A3JCaoVN1ZhFEtEvyU6+g+FdGaCtSObIYvXX0=\nservice-type=org.freedesktop.NetworkManager.wireguard\n\n[vpn-secrets]\npassword\nverysecurepassword\n\n[ipv4]\ndns-search=\nmethod=auto\n\n[ipv6]\naddr-gen-mode=stable-privacy\ndns-search=\nip6-privacy=0\nmethod=auto\n~~~~\n\n\n\n\n# Resources\n\nNM VPN Plugin:  \nhttps://developer.gnome.org/libnm-glib/stable/libnm-glib-NMVPNPlugin.html  \nhttps://developer.gnome.org/NetworkManager/stable/gdbus-org.freedesktop.NetworkManager.VPN.Plugin.html  \n\nSettings VPN (sent via DBus on Connect(a{sa{sv}}) method):  \nhttps://developer.gnome.org/libnm/stable/NMSettingVpn.html#nm-setting-vpn-get-data-item\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmax-moser%2Fnetwork-manager-wireguard","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmax-moser%2Fnetwork-manager-wireguard","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmax-moser%2Fnetwork-manager-wireguard/lists"}