net/wireguard/files/wireguard.sh

   1 #!/bin/sh
   2 # Copyright 2016 Dan Luedtke <mail@danrl.com>
   3 # Licensed to the public under the Apache License 2.0.
   4
   5
   6 WG=/usr/bin/wg
   7 if [ ! -x $WG ]; then
   8   logger -t "wireguard" "error: missing wireguard-tools (${WG})"
   9   exit 0
  10 fi
  11
  12
  13 [ -n "$INCLUDE_ONLY" ] || {
  14   . /lib/functions.sh
  15   . ../netifd-proto.sh
  16   init_proto "$@"
  17 }
  18
  19
  20 proto_wireguard_init_config() {
  21   proto_config_add_string "private_key"
  22   proto_config_add_int    "listen_port"
  23   proto_config_add_int    "mtu"
  24   proto_config_add_string "preshared_key"
  25   available=1
  26   no_proto_task=1
  27 }
  28
  29
  30 proto_wireguard_setup_peer() {
  31   local peer_config="$1"
  32
  33   local public_key
  34   local allowed_ips
  35   local route_allowed_ips
  36   local endpoint_host
  37   local endpoint_port
  38   local persistent_keepalive
  39
  40   config_get      public_key           "${peer_config}" "public_key"
  41   config_get      allowed_ips          "${peer_config}" "allowed_ips"
  42   config_get_bool route_allowed_ips    "${peer_config}" "route_allowed_ips" 0
  43   config_get      endpoint_host        "${peer_config}" "endpoint_host"
  44   config_get      endpoint_port        "${peer_config}" "endpoint_port"
  45   config_get      persistent_keepalive "${peer_config}" "persistent_keepalive"
  46
  47   # peer configuration
  48   echo "[Peer]"                                         >> "${wg_cfg}"
  49   echo "PublicKey=${public_key}"                        >> "${wg_cfg}"
  50   for allowed_ip in $allowed_ips; do
  51     echo "AllowedIPs=${allowed_ip}"                     >> "${wg_cfg}"
  52   done
  53   if [ "${endpoint_host}" ]; then
  54     case "${endpoint_host}" in
  55       *:*)
  56         endpoint="[${endpoint_host}]"
  57       ;;
  58       *)
  59         endpoint="${endpoint_host}"
  60       ;;
  61     esac
  62     if [ "${endpoint_port}" ]; then
  63       endpoint="${endpoint}:${endpoint_port}"
  64     else
  65       endpoint="${endpoint}:51820"
  66     fi
  67     echo "Endpoint=${endpoint}"                         >> "${wg_cfg}"
  68   fi
  69   if [ "${persistent_keepalive}" ]; then
  70     echo "PersistentKeepalive=${persistent_keepalive}"  >> "${wg_cfg}"
  71   fi
  72
  73   # add routes for allowed ips
  74   if [ ${route_allowed_ips} -ne 0 ]; then
  75     for allowed_ip in ${allowed_ips}; do
  76       case "${allowed_ip}" in
  77         *:*/*)
  78           proto_add_ipv6_route "${allowed_ip%%/*}" "${allowed_ip##*/}"
  79         ;;
  80         */*)
  81           proto_add_ipv4_route "${allowed_ip%%/*}" "${allowed_ip##*/}"
  82         ;;
  83       esac
  84     done
  85   fi
  86 }
  87
  88
  89 proto_wireguard_setup() {
  90   local config="$1"
  91   local wg_dir="/tmp/wireguard"
  92   local wg_cfg="${wg_dir}/${config}"
  93
  94   local private_key
  95   local listen_port
  96   local mtu
  97   local preshared_key
  98
  99   # load configuration
 100   config_load network
 101   config_get private_key   "${config}" "private_key"
 102   config_get listen_port   "${config}" "listen_port"
 103   config_get mtu           "${config}" "mtu"
 104   config_get preshared_key "${config}" "preshared_key"
 105
 106   # create interface
 107   ip link del dev "${config}" 2>/dev/null
 108   ip link add dev "${config}" type wireguard
 109
 110   if [ "${mtu}" ]; then
 111     ip link set mtu "${mtu}" dev "${config}"
 112   fi
 113
 114   proto_init_update "${config}" 1
 115
 116   # generate configuration file
 117   umask 077
 118   mkdir -p "${wg_dir}"
 119   echo "[Interface]"                     >  "${wg_cfg}"
 120   echo "PrivateKey=${private_key}"       >> "${wg_cfg}"
 121   if [ "${listen_port}" ]; then
 122     echo "ListenPort=${listen_port}"     >> "${wg_cfg}"
 123   fi
 124   if [ "${preshared_key}" ]; then
 125     echo "PresharedKey=${preshared_key}" >> "${wg_cfg}"
 126   fi
 127   config_foreach proto_wireguard_setup_peer "wireguard_${config}"
 128
 129   # apply configuration file
 130   ${WG} setconf ${config} "${wg_cfg}"
 131   WG_RETURN=$?
 132
 133   # delete configuration file
 134   rm -f "${wg_cfg}"
 135
 136   # check status
 137   if [ ${WG_RETURN} -ne 0 ]; then
 138     sleep 5
 139     proto_setup_failed "${config}"
 140     exit 1
 141   fi
 142
 143   # endpoint dependency
 144   wg show "${config}" endpoints | while IFS=$'\t:' read -r key ip port; do
 145     [ -n "${port}" ] || continue
 146     echo "adding host depedency for ${ip} at ${config}"
 147     proto_add_host_dependency "${config}" "${ip}"
 148   done
 149
 150   proto_send_update "${config}"
 151 }
 152
 153
 154 proto_wireguard_teardown() {
 155   local config="$1"
 156   ip link del dev "${config}" >/dev/null 2>&1
 157 }
 158
 159
 160 [ -n "$INCLUDE_ONLY" ] || {
 161   add_protocol wireguard
 162 }