wireguard.go 9.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367
  1. package logic
  2. import (
  3. "errors"
  4. "fmt"
  5. "os"
  6. "os/exec"
  7. "strconv"
  8. "strings"
  9. "time"
  10. "github.com/gravitl/netmaker/logger"
  11. "github.com/gravitl/netmaker/models"
  12. "github.com/gravitl/netmaker/netclient/ncutils"
  13. "github.com/gravitl/netmaker/netclient/wireguard"
  14. "golang.zx2c4.com/wireguard/wgctrl"
  15. "golang.zx2c4.com/wireguard/wgctrl/wgtypes"
  16. )
  17. // RemoveConf - removes a configuration for a given WireGuard interface
  18. func RemoveConf(iface string, printlog bool) error {
  19. var err error
  20. confPath := ncutils.GetNetclientPathSpecific() + iface + ".conf"
  21. err = removeWGQuickConf(confPath, printlog)
  22. return err
  23. }
  24. // HasPeerConnected - checks if a client node has connected over WG
  25. func HasPeerConnected(node *models.Node) bool {
  26. client, err := wgctrl.New()
  27. if err != nil {
  28. return false
  29. }
  30. defer client.Close()
  31. device, err := client.Device(node.Interface)
  32. if err != nil {
  33. return false
  34. }
  35. for _, peer := range device.Peers {
  36. if peer.PublicKey.String() == node.PublicKey {
  37. if peer.Endpoint != nil {
  38. return true
  39. }
  40. }
  41. }
  42. return false
  43. }
  44. // IfaceDelta - checks if the new node causes an interface change
  45. func IfaceDelta(currentNode *models.Node, newNode *models.Node) bool {
  46. // single comparison statements
  47. if newNode.Endpoint != currentNode.Endpoint ||
  48. newNode.PublicKey != currentNode.PublicKey ||
  49. newNode.Address != currentNode.Address ||
  50. newNode.Address6 != currentNode.Address6 ||
  51. newNode.IsEgressGateway != currentNode.IsEgressGateway ||
  52. newNode.IsIngressGateway != currentNode.IsIngressGateway ||
  53. newNode.IsRelay != currentNode.IsRelay ||
  54. newNode.UDPHolePunch != currentNode.UDPHolePunch ||
  55. newNode.IsPending != currentNode.IsPending ||
  56. newNode.ListenPort != currentNode.ListenPort ||
  57. newNode.MTU != currentNode.MTU ||
  58. newNode.PersistentKeepalive != currentNode.PersistentKeepalive ||
  59. newNode.DNSOn != currentNode.DNSOn ||
  60. len(newNode.AllowedIPs) != len(currentNode.AllowedIPs) {
  61. return true
  62. }
  63. // multi-comparison statements
  64. if newNode.IsEgressGateway == "yes" {
  65. if len(currentNode.EgressGatewayRanges) != len(newNode.EgressGatewayRanges) {
  66. return true
  67. }
  68. for _, address := range newNode.EgressGatewayRanges {
  69. if !StringSliceContains(currentNode.EgressGatewayRanges, address) {
  70. return true
  71. }
  72. }
  73. }
  74. if newNode.IsRelay == "yes" {
  75. if len(currentNode.RelayAddrs) != len(newNode.RelayAddrs) {
  76. return true
  77. }
  78. for _, address := range newNode.RelayAddrs {
  79. if !StringSliceContains(currentNode.RelayAddrs, address) {
  80. return true
  81. }
  82. }
  83. }
  84. for _, address := range newNode.AllowedIPs {
  85. if !StringSliceContains(currentNode.AllowedIPs, address) {
  86. return true
  87. }
  88. }
  89. return false
  90. }
  91. // == Private Functions ==
  92. // gets the server peers locally
  93. func getSystemPeers(node *models.Node) (map[string]string, error) {
  94. peers := make(map[string]string)
  95. client, err := wgctrl.New()
  96. if err != nil {
  97. return peers, err
  98. }
  99. defer client.Close()
  100. device, err := client.Device(node.Interface)
  101. if err != nil {
  102. return nil, err
  103. }
  104. for _, peer := range device.Peers {
  105. if IsBase64(peer.PublicKey.String()) && peer.Endpoint != nil && CheckEndpoint(peer.Endpoint.String()) {
  106. peers[peer.PublicKey.String()] = peer.Endpoint.String()
  107. }
  108. }
  109. return peers, nil
  110. }
  111. func initWireguard(node *models.Node, privkey string, peers []wgtypes.PeerConfig, hasGateway bool, gateways []string) error {
  112. key, err := wgtypes.ParseKey(privkey)
  113. if err != nil {
  114. return err
  115. }
  116. wgclient, err := wgctrl.New()
  117. if err != nil {
  118. return err
  119. }
  120. defer wgclient.Close()
  121. var ifacename string
  122. if node.Interface != "" {
  123. ifacename = node.Interface
  124. } else {
  125. logger.Log(2, "no server interface provided to configure")
  126. }
  127. if node.Address == "" {
  128. logger.Log(2, "no server address to provided configure")
  129. }
  130. if ncutils.IsKernel() {
  131. logger.Log(2, "setting kernel device", ifacename)
  132. network, err := GetNetwork(node.Network)
  133. if err != nil {
  134. logger.Log(0, "failed to get network"+err.Error())
  135. return err
  136. }
  137. net := strings.Split(network.AddressRange, "/")
  138. mask := net[len(net)-1]
  139. setKernelDevice(ifacename, node.Address, mask)
  140. }
  141. nodeport := int(node.ListenPort)
  142. var conf = wgtypes.Config{
  143. PrivateKey: &key,
  144. ListenPort: &nodeport,
  145. ReplacePeers: true,
  146. Peers: peers,
  147. }
  148. if !ncutils.IsKernel() {
  149. if err := wireguard.WriteWgConfig(node, key.String(), peers); err != nil {
  150. logger.Log(1, "error writing wg conf file: ", err.Error())
  151. return err
  152. }
  153. // spin up userspace + apply the conf file
  154. var deviceiface = ifacename
  155. confPath := ncutils.GetNetclientPathSpecific() + ifacename + ".conf"
  156. d, _ := wgclient.Device(deviceiface)
  157. for d != nil && d.Name == deviceiface {
  158. _ = RemoveConf(ifacename, false) // remove interface first
  159. time.Sleep(time.Second >> 2)
  160. d, _ = wgclient.Device(deviceiface)
  161. }
  162. time.Sleep(time.Second >> 2)
  163. err = applyWGQuickConf(confPath)
  164. if err != nil {
  165. logger.Log(1, "failed to create wireguard interface")
  166. return err
  167. }
  168. } else {
  169. ipExec, err := exec.LookPath("ip")
  170. if err != nil {
  171. return err
  172. }
  173. _, err = wgclient.Device(ifacename)
  174. if err != nil {
  175. if os.IsNotExist(err) {
  176. fmt.Println("Device does not exist: ")
  177. fmt.Println(err)
  178. } else {
  179. return errors.New("Unknown config error: " + err.Error())
  180. }
  181. }
  182. err = wgclient.ConfigureDevice(ifacename, conf)
  183. if err != nil {
  184. if os.IsNotExist(err) {
  185. fmt.Println("Device does not exist: ")
  186. fmt.Println(err)
  187. } else {
  188. fmt.Printf("This is inconvenient: %v", err)
  189. }
  190. }
  191. if _, err := ncutils.RunCmd(ipExec+" link set down dev "+ifacename, false); err != nil {
  192. logger.Log(2, "attempted to remove interface before editing")
  193. return err
  194. }
  195. if node.PostDown != "" {
  196. runcmds := strings.Split(node.PostDown, "; ")
  197. _ = ncutils.RunCmds(runcmds, false)
  198. }
  199. // set MTU of node interface
  200. if _, err := ncutils.RunCmd(ipExec+" link set mtu "+strconv.Itoa(int(node.MTU))+" up dev "+ifacename, true); err != nil {
  201. logger.Log(2, "failed to create interface with mtu", strconv.Itoa(int(node.MTU)), "-", ifacename)
  202. return err
  203. }
  204. if node.PostUp != "" {
  205. runcmds := strings.Split(node.PostUp, "; ")
  206. _ = ncutils.RunCmds(runcmds, true)
  207. }
  208. if hasGateway {
  209. for _, gateway := range gateways {
  210. _, _ = ncutils.RunCmd(ipExec+" -4 route add "+gateway+" dev "+ifacename, true)
  211. }
  212. }
  213. if node.Address6 != "" {
  214. logger.Log(1, "adding address:", node.Address6)
  215. _, _ = ncutils.RunCmd(ipExec+" address add dev "+ifacename+" "+node.Address6+"/64", true)
  216. }
  217. wireguard.SetPeers(ifacename, node, peers)
  218. }
  219. return err
  220. }
  221. func setKernelDevice(ifacename, address, mask string) error {
  222. ipExec, err := exec.LookPath("ip")
  223. if err != nil {
  224. return err
  225. }
  226. // == best effort ==
  227. ncutils.RunCmd("ip link delete dev "+ifacename, false)
  228. ncutils.RunCmd(ipExec+" link add dev "+ifacename+" type wireguard", true)
  229. ncutils.RunCmd(ipExec+" address add dev "+ifacename+" "+address+"/"+mask, true) // this was a bug waiting to happen
  230. return nil
  231. }
  232. func applyWGQuickConf(confPath string) error {
  233. if _, err := ncutils.RunCmd("wg-quick up "+confPath, true); err != nil {
  234. return err
  235. }
  236. return nil
  237. }
  238. func removeWGQuickConf(confPath string, printlog bool) error {
  239. if _, err := ncutils.RunCmd("wg-quick down "+confPath, printlog); err != nil {
  240. return err
  241. }
  242. return nil
  243. }
  244. func setWGConfig(node *models.Node, peerupdate bool) error {
  245. peers, hasGateway, gateways, err := GetServerPeers(node)
  246. if err != nil {
  247. return err
  248. }
  249. privkey, err := FetchPrivKey(node.ID)
  250. if err != nil {
  251. return err
  252. }
  253. if peerupdate {
  254. if err := wireguard.SetPeers(node.Interface, node, peers); err != nil {
  255. logger.Log(0, "error updating peers", err.Error())
  256. }
  257. logger.Log(2, "updated peers on server", node.Name)
  258. } else {
  259. err = initWireguard(node, privkey, peers[:], hasGateway, gateways[:])
  260. logger.Log(3, "finished setting wg config on server", node.Name)
  261. }
  262. peers = nil
  263. return err
  264. }
  265. func setWGKeyConfig(node *models.Node) error {
  266. privatekey, err := wgtypes.GeneratePrivateKey()
  267. if err != nil {
  268. return err
  269. }
  270. privkeystring := privatekey.String()
  271. publickey := privatekey.PublicKey()
  272. node.PublicKey = publickey.String()
  273. err = StorePrivKey(node.ID, privkeystring)
  274. if err != nil {
  275. return err
  276. }
  277. if node.Action == models.NODE_UPDATE_KEY {
  278. node.Action = models.NODE_NOOP
  279. }
  280. return setWGConfig(node, false)
  281. }
  282. func removeLocalServer(node *models.Node) error {
  283. if !IsLocalServer(node) {
  284. return nil
  285. }
  286. var err error
  287. var ifacename = node.Interface
  288. if err = RemovePrivKey(node.ID); err != nil {
  289. logger.Log(1, "failed to remove server conf from db", node.ID)
  290. }
  291. if ifacename != "" {
  292. if !ncutils.IsKernel() {
  293. if err = RemoveConf(ifacename, true); err == nil {
  294. logger.Log(1, "removed WireGuard interface:", ifacename)
  295. }
  296. } else {
  297. ipExec, err := exec.LookPath("ip")
  298. if err != nil {
  299. return err
  300. }
  301. out, err := ncutils.RunCmd(ipExec+" link del "+ifacename, false)
  302. dontprint := strings.Contains(out, "does not exist") || strings.Contains(out, "Cannot find device")
  303. if err != nil && !dontprint {
  304. logger.Log(1, "error running command:", ipExec, "link del", ifacename)
  305. logger.Log(1, out)
  306. }
  307. if node.PostDown != "" {
  308. runcmds := strings.Split(node.PostDown, "; ")
  309. _ = ncutils.RunCmds(runcmds, false)
  310. }
  311. }
  312. }
  313. home := ncutils.GetNetclientPathSpecific()
  314. if ncutils.FileExists(home + "netconfig-" + node.Network) {
  315. _ = os.Remove(home + "netconfig-" + node.Network)
  316. }
  317. if ncutils.FileExists(home + "nettoken-" + node.Network) {
  318. _ = os.Remove(home + "nettoken-" + node.Network)
  319. }
  320. if ncutils.FileExists(home + "secret-" + node.Network) {
  321. _ = os.Remove(home + "secret-" + node.Network)
  322. }
  323. if ncutils.FileExists(home + "wgkey-" + node.Network) {
  324. _ = os.Remove(home + "wgkey-" + node.Network)
  325. }
  326. if ncutils.FileExists(home + "nm-" + node.Network + ".conf") {
  327. _ = os.Remove(home + "nm-" + node.Network + ".conf")
  328. }
  329. return err
  330. }