wireguard.go 9.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362
  1. package logic
  2. import (
  3. "errors"
  4. "fmt"
  5. "os"
  6. "os/exec"
  7. "strconv"
  8. "strings"
  9. "time"
  10. "github.com/gravitl/netmaker/logger"
  11. "github.com/gravitl/netmaker/models"
  12. "github.com/gravitl/netmaker/netclient/ncutils"
  13. "golang.zx2c4.com/wireguard/wgctrl"
  14. "golang.zx2c4.com/wireguard/wgctrl/wgtypes"
  15. )
  16. // RemoveConf - removes a configuration for a given WireGuard interface
  17. func RemoveConf(iface string, printlog bool) error {
  18. var err error
  19. confPath := ncutils.GetNetclientPathSpecific() + iface + ".conf"
  20. err = removeWGQuickConf(confPath, printlog)
  21. return err
  22. }
  23. // == Private Functions ==
  24. // gets the server peers locally
  25. func getSystemPeers(node *models.Node) (map[string]string, error) {
  26. peers := make(map[string]string)
  27. client, err := wgctrl.New()
  28. if err != nil {
  29. return peers, err
  30. }
  31. defer client.Close()
  32. device, err := client.Device(node.Interface)
  33. if err != nil {
  34. return nil, err
  35. }
  36. for _, peer := range device.Peers {
  37. if IsBase64(peer.PublicKey.String()) && peer.Endpoint != nil && CheckEndpoint(peer.Endpoint.String()) {
  38. peers[peer.PublicKey.String()] = peer.Endpoint.String()
  39. }
  40. }
  41. return peers, nil
  42. }
  43. func initWireguard(node *models.Node, privkey string, peers []wgtypes.PeerConfig, hasGateway bool, gateways []string) error {
  44. key, err := wgtypes.ParseKey(privkey)
  45. if err != nil {
  46. return err
  47. }
  48. wgclient, err := wgctrl.New()
  49. if err != nil {
  50. return err
  51. }
  52. defer wgclient.Close()
  53. var ifacename string
  54. if node.Interface != "" {
  55. ifacename = node.Interface
  56. } else {
  57. logger.Log(2, "no server interface provided to configure")
  58. }
  59. if node.Address == "" {
  60. logger.Log(2, "no server address to provided configure")
  61. }
  62. if ncutils.IsKernel() {
  63. logger.Log(2, "setting kernel device", ifacename)
  64. setKernelDevice(ifacename, node.Address)
  65. }
  66. nodeport := int(node.ListenPort)
  67. var conf = wgtypes.Config{
  68. PrivateKey: &key,
  69. ListenPort: &nodeport,
  70. ReplacePeers: true,
  71. Peers: peers,
  72. }
  73. if !ncutils.IsKernel() {
  74. var newConf string
  75. newConf, _ = ncutils.CreateWireGuardConf(node, key.String(), strconv.FormatInt(int64(node.ListenPort), 10), peers)
  76. confPath := ncutils.GetNetclientPathSpecific() + ifacename + ".conf"
  77. logger.Log(1, "writing wg conf file to:", confPath)
  78. err = os.WriteFile(confPath, []byte(newConf), 0644)
  79. if err != nil {
  80. logger.Log(1, "error writing wg conf file to", confPath, ":", err.Error())
  81. return err
  82. }
  83. // spin up userspace + apply the conf file
  84. var deviceiface = ifacename
  85. d, _ := wgclient.Device(deviceiface)
  86. for d != nil && d.Name == deviceiface {
  87. _ = RemoveConf(ifacename, false) // remove interface first
  88. time.Sleep(time.Second >> 2)
  89. d, _ = wgclient.Device(deviceiface)
  90. }
  91. time.Sleep(time.Second >> 2)
  92. err = applyWGQuickConf(confPath)
  93. if err != nil {
  94. logger.Log(1, "failed to create wireguard interface")
  95. return err
  96. }
  97. } else {
  98. ipExec, err := exec.LookPath("ip")
  99. if err != nil {
  100. return err
  101. }
  102. _, err = wgclient.Device(ifacename)
  103. if err != nil {
  104. if os.IsNotExist(err) {
  105. fmt.Println("Device does not exist: ")
  106. fmt.Println(err)
  107. } else {
  108. return errors.New("Unknown config error: " + err.Error())
  109. }
  110. }
  111. err = wgclient.ConfigureDevice(ifacename, conf)
  112. if err != nil {
  113. if os.IsNotExist(err) {
  114. fmt.Println("Device does not exist: ")
  115. fmt.Println(err)
  116. } else {
  117. fmt.Printf("This is inconvenient: %v", err)
  118. }
  119. }
  120. if _, err := ncutils.RunCmd(ipExec+" link set down dev "+ifacename, false); err != nil {
  121. logger.Log(2, "attempted to remove interface before editing")
  122. return err
  123. }
  124. if node.PostDown != "" {
  125. runcmds := strings.Split(node.PostDown, "; ")
  126. _ = ncutils.RunCmds(runcmds, false)
  127. }
  128. // set MTU of node interface
  129. if _, err := ncutils.RunCmd(ipExec+" link set mtu "+strconv.Itoa(int(node.MTU))+" up dev "+ifacename, true); err != nil {
  130. logger.Log(2, "failed to create interface with mtu", strconv.Itoa(int(node.MTU)), "-", ifacename)
  131. return err
  132. }
  133. if node.PostUp != "" {
  134. runcmds := strings.Split(node.PostUp, "; ")
  135. _ = ncutils.RunCmds(runcmds, true)
  136. }
  137. if hasGateway {
  138. for _, gateway := range gateways {
  139. _, _ = ncutils.RunCmd(ipExec+" -4 route add "+gateway+" dev "+ifacename, true)
  140. }
  141. }
  142. if node.Address6 != "" && node.IsDualStack == "yes" {
  143. logger.Log(1, "adding address:", node.Address6)
  144. _, _ = ncutils.RunCmd(ipExec+" address add dev "+ifacename+" "+node.Address6+"/64", true)
  145. }
  146. }
  147. return err
  148. }
  149. func setKernelDevice(ifacename string, address string) error {
  150. ipExec, err := exec.LookPath("ip")
  151. if err != nil {
  152. return err
  153. }
  154. // == best effort ==
  155. ncutils.RunCmd("ip link delete dev "+ifacename, false)
  156. ncutils.RunCmd(ipExec+" link add dev "+ifacename+" type wireguard", true)
  157. ncutils.RunCmd(ipExec+" address add dev "+ifacename+" "+address+"/24", true) // this is a bug waiting to happen
  158. return nil
  159. }
  160. func applyWGQuickConf(confPath string) error {
  161. if _, err := ncutils.RunCmd("wg-quick up "+confPath, true); err != nil {
  162. return err
  163. }
  164. return nil
  165. }
  166. func removeWGQuickConf(confPath string, printlog bool) error {
  167. if _, err := ncutils.RunCmd("wg-quick down "+confPath, printlog); err != nil {
  168. return err
  169. }
  170. return nil
  171. }
  172. func setServerPeers(iface string, keepalive int32, peers []wgtypes.PeerConfig) error {
  173. client, err := wgctrl.New()
  174. if err != nil {
  175. logger.Log(0, "failed to start wgctrl")
  176. return err
  177. }
  178. defer client.Close()
  179. device, err := client.Device(iface)
  180. if err != nil {
  181. logger.Log(1, "failed to parse interface")
  182. return err
  183. }
  184. devicePeers := device.Peers
  185. if len(devicePeers) > 1 && len(peers) == 0 {
  186. logger.Log(1, "no peers pulled")
  187. return err
  188. }
  189. for _, peer := range peers {
  190. if len(peer.AllowedIPs) > 0 {
  191. for _, currentPeer := range devicePeers {
  192. if len(currentPeer.AllowedIPs) > 0 && currentPeer.AllowedIPs[0].String() == peer.AllowedIPs[0].String() &&
  193. currentPeer.PublicKey.String() != peer.PublicKey.String() {
  194. _, err := ncutils.RunCmd("wg set "+iface+" peer "+currentPeer.PublicKey.String()+" remove", true)
  195. if err != nil {
  196. logger.Log(0, "error removing peer", peer.Endpoint.String())
  197. }
  198. }
  199. }
  200. }
  201. udpendpoint := peer.Endpoint.String()
  202. var allowedips string
  203. var iparr []string
  204. for _, ipaddr := range peer.AllowedIPs {
  205. iparr = append(iparr, ipaddr.String())
  206. }
  207. allowedips = strings.Join(iparr, ",")
  208. keepAliveString := strconv.Itoa(int(keepalive))
  209. if keepAliveString == "0" {
  210. keepAliveString = "5"
  211. }
  212. if peer.Endpoint != nil {
  213. _, err = ncutils.RunCmd("wg set "+iface+" peer "+peer.PublicKey.String()+
  214. " endpoint "+udpendpoint+
  215. " persistent-keepalive "+keepAliveString+
  216. " allowed-ips "+allowedips, true)
  217. } else {
  218. _, err = ncutils.RunCmd("wg set "+iface+" peer "+peer.PublicKey.String()+
  219. " persistent-keepalive "+keepAliveString+
  220. " allowed-ips "+allowedips, true)
  221. }
  222. if err != nil {
  223. logger.Log(2, "error setting peer", peer.PublicKey.String())
  224. }
  225. }
  226. for _, currentPeer := range devicePeers {
  227. if len(currentPeer.AllowedIPs) > 0 {
  228. shouldDelete := true
  229. for _, peer := range peers {
  230. if len(peer.AllowedIPs) > 0 && peer.AllowedIPs[0].String() == currentPeer.AllowedIPs[0].String() {
  231. shouldDelete = false
  232. }
  233. }
  234. if shouldDelete {
  235. output, err := ncutils.RunCmd("wg set "+iface+" peer "+currentPeer.PublicKey.String()+" remove", true)
  236. if err != nil {
  237. logger.Log(0, output, "error removing peer", currentPeer.PublicKey.String())
  238. }
  239. }
  240. }
  241. }
  242. return nil
  243. }
  244. func setWGConfig(node *models.Node, peerupdate bool) error {
  245. peers, hasGateway, gateways, err := GetServerPeers(node)
  246. if err != nil {
  247. return err
  248. }
  249. privkey, err := FetchPrivKey(node.ID)
  250. if err != nil {
  251. return err
  252. }
  253. if peerupdate {
  254. err = setServerPeers(node.Interface, node.PersistentKeepalive, peers[:])
  255. logger.Log(2, "updated peers on server", node.Name)
  256. } else {
  257. err = initWireguard(node, privkey, peers[:], hasGateway, gateways[:])
  258. logger.Log(3, "finished setting wg config on server", node.Name)
  259. }
  260. peers = nil
  261. return err
  262. }
  263. func setWGKeyConfig(node *models.Node) error {
  264. privatekey, err := wgtypes.GeneratePrivateKey()
  265. if err != nil {
  266. return err
  267. }
  268. privkeystring := privatekey.String()
  269. publickey := privatekey.PublicKey()
  270. node.PublicKey = publickey.String()
  271. err = StorePrivKey(node.ID, privkeystring)
  272. if err != nil {
  273. return err
  274. }
  275. if node.Action == models.NODE_UPDATE_KEY {
  276. node.Action = models.NODE_NOOP
  277. }
  278. return setWGConfig(node, false)
  279. }
  280. func removeLocalServer(node *models.Node) error {
  281. var ifacename = node.Interface
  282. var err error
  283. if err = RemovePrivKey(node.ID); err != nil {
  284. logger.Log(1, "failed to remove server conf from db", node.ID)
  285. }
  286. if ifacename != "" {
  287. if !ncutils.IsKernel() {
  288. if err = RemoveConf(ifacename, true); err == nil {
  289. logger.Log(1, "removed WireGuard interface:", ifacename)
  290. }
  291. } else {
  292. ipExec, err := exec.LookPath("ip")
  293. if err != nil {
  294. return err
  295. }
  296. out, err := ncutils.RunCmd(ipExec+" link del "+ifacename, false)
  297. dontprint := strings.Contains(out, "does not exist") || strings.Contains(out, "Cannot find device")
  298. if err != nil && !dontprint {
  299. logger.Log(1, "error running command:", ipExec, "link del", ifacename)
  300. logger.Log(1, out)
  301. }
  302. if node.PostDown != "" {
  303. runcmds := strings.Split(node.PostDown, "; ")
  304. _ = ncutils.RunCmds(runcmds, false)
  305. }
  306. }
  307. }
  308. home := ncutils.GetNetclientPathSpecific()
  309. if ncutils.FileExists(home + "netconfig-" + node.Network) {
  310. _ = os.Remove(home + "netconfig-" + node.Network)
  311. }
  312. if ncutils.FileExists(home + "nettoken-" + node.Network) {
  313. _ = os.Remove(home + "nettoken-" + node.Network)
  314. }
  315. if ncutils.FileExists(home + "secret-" + node.Network) {
  316. _ = os.Remove(home + "secret-" + node.Network)
  317. }
  318. if ncutils.FileExists(home + "wgkey-" + node.Network) {
  319. _ = os.Remove(home + "wgkey-" + node.Network)
  320. }
  321. if ncutils.FileExists(home + "nm-" + node.Network + ".conf") {
  322. _ = os.Remove(home + "nm-" + node.Network + ".conf")
  323. }
  324. return err
  325. }