You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

186 lines
4.6 KiB

  1. #!/bin/sh
  2. # Copyright 2016-2017 Dan Luedtke <mail@danrl.com>
  3. # Licensed to the public under the Apache License 2.0.
  4. WG=/usr/bin/wg
  5. if [ ! -x $WG ]; then
  6. logger -t "wireguard" "error: missing wireguard-tools (${WG})"
  7. exit 0
  8. fi
  9. [ -n "$INCLUDE_ONLY" ] || {
  10. . /lib/functions.sh
  11. . ../netifd-proto.sh
  12. init_proto "$@"
  13. }
  14. proto_wireguard_init_config() {
  15. proto_config_add_string "private_key"
  16. proto_config_add_int "listen_port"
  17. proto_config_add_int "mtu"
  18. proto_config_add_string "fwmark"
  19. available=1
  20. no_proto_task=1
  21. }
  22. proto_wireguard_setup_peer() {
  23. local peer_config="$1"
  24. local public_key
  25. local preshared_key
  26. local allowed_ips
  27. local route_allowed_ips
  28. local endpoint_host
  29. local endpoint_port
  30. local persistent_keepalive
  31. config_get public_key "${peer_config}" "public_key"
  32. config_get preshared_key "${peer_config}" "preshared_key"
  33. config_get allowed_ips "${peer_config}" "allowed_ips"
  34. config_get_bool route_allowed_ips "${peer_config}" "route_allowed_ips" 0
  35. config_get endpoint_host "${peer_config}" "endpoint_host"
  36. config_get endpoint_port "${peer_config}" "endpoint_port"
  37. config_get persistent_keepalive "${peer_config}" "persistent_keepalive"
  38. # peer configuration
  39. echo "[Peer]" >> "${wg_cfg}"
  40. echo "PublicKey=${public_key}" >> "${wg_cfg}"
  41. if [ "${preshared_key}" ]; then
  42. echo "PresharedKey=${preshared_key}" >> "${wg_cfg}"
  43. fi
  44. for allowed_ip in $allowed_ips; do
  45. echo "AllowedIPs=${allowed_ip}" >> "${wg_cfg}"
  46. done
  47. if [ "${endpoint_host}" ]; then
  48. case "${endpoint_host}" in
  49. *:*)
  50. endpoint="[${endpoint_host}]"
  51. ;;
  52. *)
  53. endpoint="${endpoint_host}"
  54. ;;
  55. esac
  56. if [ "${endpoint_port}" ]; then
  57. endpoint="${endpoint}:${endpoint_port}"
  58. else
  59. endpoint="${endpoint}:51820"
  60. fi
  61. echo "Endpoint=${endpoint}" >> "${wg_cfg}"
  62. fi
  63. if [ "${persistent_keepalive}" ]; then
  64. echo "PersistentKeepalive=${persistent_keepalive}" >> "${wg_cfg}"
  65. fi
  66. # add routes for allowed ips
  67. if [ ${route_allowed_ips} -ne 0 ]; then
  68. for allowed_ip in ${allowed_ips}; do
  69. case "${allowed_ip}" in
  70. *:*/*)
  71. proto_add_ipv6_route "${allowed_ip%%/*}" "${allowed_ip##*/}"
  72. ;;
  73. */*)
  74. proto_add_ipv4_route "${allowed_ip%%/*}" "${allowed_ip##*/}"
  75. ;;
  76. esac
  77. done
  78. fi
  79. }
  80. proto_wireguard_setup() {
  81. local config="$1"
  82. local wg_dir="/tmp/wireguard"
  83. local wg_cfg="${wg_dir}/${config}"
  84. local private_key
  85. local listen_port
  86. local mtu
  87. # load configuration
  88. config_load network
  89. config_get private_key "${config}" "private_key"
  90. config_get listen_port "${config}" "listen_port"
  91. config_get addresses "${config}" "addresses"
  92. config_get mtu "${config}" "mtu"
  93. config_get fwmark "${config}" "fwmark"
  94. # create interface
  95. ip link del dev "${config}" 2>/dev/null
  96. ip link add dev "${config}" type wireguard
  97. if [ "${mtu}" ]; then
  98. ip link set mtu "${mtu}" dev "${config}"
  99. fi
  100. proto_init_update "${config}" 1
  101. # generate configuration file
  102. umask 077
  103. mkdir -p "${wg_dir}"
  104. echo "[Interface]" > "${wg_cfg}"
  105. echo "PrivateKey=${private_key}" >> "${wg_cfg}"
  106. if [ "${listen_port}" ]; then
  107. echo "ListenPort=${listen_port}" >> "${wg_cfg}"
  108. fi
  109. if [ "${fwmark}" ]; then
  110. echo "FwMark=${fwmark}" >> "${wg_cfg}"
  111. fi
  112. config_foreach proto_wireguard_setup_peer "wireguard_${config}"
  113. # apply configuration file
  114. ${WG} setconf ${config} "${wg_cfg}"
  115. WG_RETURN=$?
  116. # delete configuration file
  117. rm -f "${wg_cfg}"
  118. # check status
  119. if [ ${WG_RETURN} -ne 0 ]; then
  120. sleep 5
  121. proto_setup_failed "${config}"
  122. exit 1
  123. fi
  124. # add ip addresses
  125. for address in ${addresses}; do
  126. case "${address}" in
  127. *:*/*)
  128. proto_add_ipv6_address "${address%%/*}" "${address##*/}"
  129. ;;
  130. *.*/*)
  131. proto_add_ipv4_address "${address%%/*}" "${address##*/}"
  132. ;;
  133. *:*)
  134. proto_add_ipv6_address "${address%%/*}" "128"
  135. ;;
  136. *.*)
  137. proto_add_ipv4_address "${address%%/*}" "32"
  138. ;;
  139. esac
  140. done
  141. # endpoint dependency
  142. wg show "${config}" endpoints | \
  143. sed -E 's/\[?([0-9.:a-f]+)\]?:([0-9]+)/\1 \2/' | \
  144. while IFS=$'\t ' read -r key address port; do
  145. [ -n "${port}" ] || continue
  146. proto_add_host_dependency "${config}" "${address}"
  147. done
  148. proto_send_update "${config}"
  149. }
  150. proto_wireguard_teardown() {
  151. local config="$1"
  152. ip link del dev "${config}" >/dev/null 2>&1
  153. }
  154. [ -n "$INCLUDE_ONLY" ] || {
  155. add_protocol wireguard
  156. }