net/wireguard: new plugin (#779)

net/wireguard/Makefile

@@ -0,0 +1,8 @@
+PLUGIN_NAME=		wireguard
+PLUGIN_VERSION=		0.1
+PLUGIN_COMMENT=		WireGuard VPN service
+PLUGIN_DEPENDS=		wireguard
+PLUGIN_MAINTAINER=	m.muenz@gmail.com
+PLUGIN_DEVEL=       yes
+
+.include "../../Mk/plugins.mk"

net/wireguard/pkg-descr

@@ -0,0 +1,14 @@
+WireGuard® is an extremely simple yet fast and modern VPN
+that utilizes state-of-the-art cryptography. It aims to be
+faster, simpler, leaner, and more useful than IPSec, while
+avoiding the massive headache. It intends to be considerably
+more performant than OpenVPN. WireGuard is designed as a
+general purpose VPN for running on embedded interfaces and
+super computers alike, fit for many different circumstances.
+Initially released for the Linux kernel, it is now
+cross-platform and widely deployable. It is currently under
+heavy development, but already it might be regarded as the
+most secure, easiest to use, and simplest VPN solution in
+the industry.
+
+WWW: https://www.wireguard.com/

net/wireguard/src/etc/inc/plugins.inc.d/wireguard.inc

@@ -0,0 +1,71 @@
+<?php
+
+/*
+    Copyright (C) 2018 Michael Muenz
+    All rights reserved.
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+function wireguard_enabled()
+{
+    $model = new \OPNsense\Wireguard\General();
+    return (string)$model->enabled == '1';
+}
+
+function wireguard_services()
+{
+    $services = array();
+
+    if (!wireguard_enabled()) {
+        return $services;
+    }
+
+    $services[] = array(
+        'description' => gettext('Wireguard VPN'),
+        'configd' => array(
+            'restart' => array('wireguard restart'),
+            'start' => array('wireguard start'),
+            'stop' => array('wireguard stop'),
+        ),
+        'name' => 'wireguard-go'
+    );
+
+    return $services;
+}
+
+function wireguard_interfaces()
+{
+    $interfaces = array();
+    if (!wireguard_enabled()) {
+        return $interfaces;
+    }
+    $oic = array('enable' => true);
+    $oic['if'] = 'wg';
+    $oic['descr'] = 'WireGuard';
+    $oic['type'] = 'group';
+    $oic['virtual'] = true;
+    $oic['networks'] = array();
+    $interfaces['wg'] = $oic;
+    return $interfaces;
+}
+

net/wireguard/src/etc/rc.d/opnsense-wireguard

@@ -0,0 +1,45 @@
+#!/bin/sh
+#
+# $FreeBSD$
+#
+# PROVIDE: opnsense-wireguard
+# REQUIRE: SERVERS
+# KEYWORD: shutdown
+#
+
+. /etc/rc.subr
+
+name=wireguard
+
+stop_cmd=wireguard_stop
+start_cmd=wireguard_start
+status_cmd=wireguard_status
+rcvar=wireguard_enable
+
+load_rc_config opnsense-wireguard
+command=/usr/local/bin/wg-quick
+
+[ -z "$wireguard_enable" ] && wireguard_enable="NO"
+
+# stop wireguard
+wireguard_stop()
+{
+    echo "stopping wireguard"
+    for STARTER in ${wireguard_config}; do
+        $command down $STARTER
+	ifconfig destroy $STARTER
+	pkill -f wg-quick
+    done
+}
+
+# start wireguard
+wireguard_start()
+{
+    echo "starting wireguard"
+    for STARTER in ${wireguard_config}; do
+        $command up $STARTER
+	ifconfig $STARTER group wireguard
+    done
+}
+
+run_rc_command $1

net/wireguard/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ClientController.php

@@ -0,0 +1,64 @@
+<?php
+/**
+ *    Copyright (C) 2018 Michael Muenz
+ *
+ *    All rights reserved.
+ *
+ *    Redistribution and use in source and binary forms, with or without
+ *    modification, are permitted provided that the following conditions are met:
+ *
+ *    1. Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *
+ *    2. Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *
+ *    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ *    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ *    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ *    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ *    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ *    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ *    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ *    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ *    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ *    POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+namespace OPNsense\Wireguard\Api;
+
+use \OPNsense\Base\ApiMutableModelControllerBase;
+
+class ClientController extends ApiMutableModelControllerBase
+{
+    static protected $internalModelName = 'client';
+    static protected $internalModelClass = '\OPNsense\Wireguard\Client';
+
+    public function searchClientAction()
+    {
+        return $this->searchBase('clients.client', array("enabled", "name", "pubkey", "tunneladdress", "serveraddress", "serverport"));
+    }
+    public function getClientAction($uuid = null)
+    {
+        $this->sessionClose();
+        return $this->getBase('client', 'clients.client', $uuid);
+    }
+    public function addClientAction()
+    {
+        return $this->addBase('client', 'clients.client');
+    }
+    public function delClientAction($uuid)
+    {
+        return $this->delBase('clients.client', $uuid);
+    }
+    public function setClientAction($uuid)
+    {
+        return $this->setBase('client', 'clients.client', $uuid);
+    }
+    public function toggleClientAction($uuid)
+    {
+        return $this->toggleBase('clients.client', $uuid);
+    }
+}

net/wireguard/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/GeneralController.php

@@ -0,0 +1,39 @@
+<?php
+
+/**
+ *    Copyright (C) 2018 Michael Muenz
+ *
+ *    All rights reserved.
+ *
+ *    Redistribution and use in source and binary forms, with or without
+ *    modification, are permitted provided that the following conditions are met:
+ *
+ *    1. Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *
+ *    2. Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *
+ *    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ *    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ *    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ *    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ *    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ *    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ *    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ *    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ *    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ *    POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+namespace OPNsense\Wireguard\Api;
+
+use OPNsense\Base\ApiMutableModelControllerBase;
+
+class GeneralController extends ApiMutableModelControllerBase
+{
+    static protected $internalModelClass = '\OPNsense\Wireguard\General';
+    static protected $internalModelName = 'general';
+}

net/wireguard/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServerController.php

@@ -0,0 +1,99 @@
+<?php
+/**
+ *    Copyright (C) 2018 Michael Muenz
+ *
+ *    All rights reserved.
+ *
+ *    Redistribution and use in source and binary forms, with or without
+ *    modification, are permitted provided that the following conditions are met:
+ *
+ *    1. Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *
+ *    2. Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *
+ *    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ *    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ *    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ *    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ *    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ *    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ *    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ *    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ *    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ *    POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+namespace OPNsense\Wireguard\Api;
+
+use \OPNsense\Base\ApiMutableModelControllerBase;
+use \OPNsense\Core\Backend;
+
+class ServerController extends ApiMutableModelControllerBase
+{
+    static protected $internalModelName = 'server';
+    static protected $internalModelClass = '\OPNsense\Wireguard\Server';
+
+    public function searchServerAction()
+    {
+        return $this->searchBase('servers.server', array("enabled", "name", "networks", "pubkey", "port", "tunneladdress"));
+    }
+    public function getServerAction($uuid = null)
+    {
+        $this->sessionClose();
+        return $this->getBase('server', 'servers.server', $uuid);
+    }
+    public function addServerAction($uuid = null)
+    {
+        if ($this->request->isPost() && $this->request->hasPost("server")) {
+            if ($uuid != null) {
+                $node = $this->getModel()->getNodeByReference('servers.server.'.$uuid);
+            } else {
+                $node = $this->getModel()->servers->server->Add();
+            }
+            $node->setNodes($this->request->getPost("server"));
+            if (empty((string)$node->pubkey) || empty((string)$node->privkey)) {
+                // generate new keypair
+                $backend = new Backend();
+                $keyspriv = $backend->configdpRun("wireguard genkey", 'private');
+                $keyspub = $backend->configdpRun("wireguard genkey", 'public');
+                $node->privkey = $keyspriv;
+                $node->pubkey = $keyspub;
+            }
+            return $this->validateAndSave($node, 'server');
+        }
+        return array("result"=>"failed");
+    }
+    public function delServerAction($uuid)
+    {
+        return $this->delBase('servers.server', $uuid);
+    }
+    public function setServerAction($uuid = null)
+    {
+        if ($this->request->isPost() && $this->request->hasPost("server")) {
+            if ($uuid != null) {
+                $node = $this->getModel()->getNodeByReference('servers.server.'.$uuid);
+            } else {
+                $node = $this->getModel()->servers->server->Add();
+            }
+            $node->setNodes($this->request->getPost("server"));
+            if (empty((string)$node->pubkey) || empty((string)$node->privkey)) {
+                // generate new keypair
+                $backend = new Backend();
+                $keyspriv = $backend->configdpRun("wireguard genkey", 'private');
+                $keyspub = $backend->configdpRun("wireguard genkey", 'public');
+                $node->privkey = $keyspriv;
+                $node->pubkey = $keyspub;
+            }
+            return $this->validateAndSave($node, 'server');
+        }
+        return array("result"=>"failed");
+    }
+    public function toggleServerAction($uuid)
+    {
+        return $this->toggleBase('servers.server', $uuid);
+    }
+}

net/wireguard/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServiceController.php

@@ -0,0 +1,47 @@
+<?php
+
+/**
+ *    Copyright (C) 2018 Michael Muenz
+ *
+ *    All rights reserved.
+ *
+ *    Redistribution and use in source and binary forms, with or without
+ *    modification, are permitted provided that the following conditions are met:
+ *
+ *    1. Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *
+ *    2. Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *
+ *    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ *    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ *    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ *    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ *    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ *    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ *    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ *    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ *    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ *    POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+namespace OPNsense\Wireguard\Api;
+
+use OPNsense\Base\ApiMutableServiceControllerBase;
+use OPNsense\Core\Backend;
+use OPNsense\Wireguard\General;
+
+/**
+ * Class ServiceController
+ * @package OPNsense\Wireguard
+ */
+class ServiceController extends ApiMutableServiceControllerBase
+{
+    static protected $internalServiceClass = '\OPNsense\Wireguard\General';
+    static protected $internalServiceTemplate = 'OPNsense/Wireguard';
+    static protected $internalServiceEnabled = 'enabled';
+    static protected $internalServiceName = 'wireguard';
+}

net/wireguard/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/GeneralController.php

@@ -0,0 +1,40 @@
+<?php
+
+/*
+    Copyright (C) 2018 Michael Muenz
+    All rights reserved.
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+namespace OPNsense\Wireguard;
+
+class GeneralController extends \OPNsense\Base\IndexController
+{
+    public function indexAction()
+    {
+        $this->view->generalForm = $this->getForm("general");
+        $this->view->formDialogEditWireguardClient = $this->getForm("dialogEditWireguardClient");
+        $this->view->formDialogEditWireguardServer = $this->getForm("dialogEditWireguardServer");
+        $this->view->pick('OPNsense/Wireguard/general');
+    }
+}

net/wireguard/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/dialogEditWireguardClient.xml

@@ -0,0 +1,40 @@
+<form>
+    <field>
+        <id>client.enabled</id>
+        <label>Enabled</label>
+        <type>checkbox</type>
+        <help>This will enable or disable the client config.</help>
+    </field>
+    <field>
+        <id>client.name</id>
+        <label>Name</label>
+        <type>text</type>
+        <help>Set the name for this instance.</help>
+    </field>
+    <field>
+        <id>client.pubkey</id>
+        <label>Public Key</label>
+        <type>text</type>
+        <help>Public key of this instance.</help>
+    </field>
+    <field>
+        <id>client.tunneladdress</id>
+        <label>Tunnel Address</label>
+        <style>tokenize</style>
+        <type>select_multiple</type>
+        <allownew>true</allownew>
+        <help>List of addresses to configure on the tunnel adapter. Please use CIDR notation like 10.0.0.1/24.</help>
+    </field>
+    <field>
+        <id>client.serveraddress</id>
+        <label>Endpoint Address</label>
+        <type>text</type>
+        <help>Set public IP address the endpoint listens to.</help>
+    </field>
+    <field>
+        <id>client.serverport</id>
+        <label>Endpoint Port</label>
+        <type>text</type>
+        <help>Set port the endpoint listens to.</help>
+    </field>
+</form>

net/wireguard/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/dialogEditWireguardServer.xml

@@ -0,0 +1,53 @@
+<form>
+    <field>
+        <id>server.enabled</id>
+        <label>Enabled</label>
+        <type>checkbox</type>
+        <help>This will enable or disable the server config.</help>
+    </field>
+    <field>
+        <id>server.name</id>
+        <label>Name</label>
+        <type>text</type>
+        <help>Set the name for this instance.</help>
+    </field>
+    <field>
+        <id>server.instance</id>
+        <label>Instance</label>
+        <type>info</type>
+        <help>Set the instance number needed for interface calculation. It has to be unique for each instance.</help>
+    </field>
+    <field>
+        <id>server.pubkey</id>
+        <label>Public Key</label>
+        <type>info</type>
+        <help>Public key of this instance. After saving you will see here your public key.</help>
+    </field>
+    <field>
+        <id>server.privkey</id>
+        <label>Private Key</label>
+        <type>info</type>
+        <help>Private key of this instance. After saving you will see here your public key, please keep it safe.</help>
+    </field>
+    <field>
+        <id>server.port</id>
+        <label>Listen Port</label>
+        <type>text</type>
+        <help>Set port for this instance to listen on.</help>
+    </field>
+    <field>
+        <id>server.tunneladdress</id>
+        <label>Tunnel Address</label>
+        <style>tokenize</style>
+        <type>select_multiple</type>
+        <allownew>true</allownew>
+        <help>List of addresses to configure on the tunnel adapter. Please use CIDR notation like 10.0.0.1/24.</help>
+    </field>
+    <field>
+        <id>server.peers</id>
+        <label>Peers</label>
+        <type>select_multiple</type>
+        <allownew>true</allownew>
+        <help>List of peers for this server.</help>
+    </field>
+</form>

net/wireguard/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/general.xml

@@ -0,0 +1,8 @@
+<form>
+    <field>
+        <id>general.enabled</id>
+        <label>Enable WireGuard</label>
+        <type>checkbox</type>
+        <help>This will activate WireGuard and start all enabled instances.</help>
+    </field>
+</form>

net/wireguard/src/opnsense/mvc/app/models/OPNsense/Wireguard/ACL/ACL.xml

@@ -0,0 +1,9 @@
+<acl>
+   <page-wireguard-config>
+      <name>VPN: Wireguard</name>
+      <patterns>
+         <pattern>ui/wireguard/*</pattern>
+         <pattern>api/wireguard/*</pattern>
+      </patterns>
+   </page-wireguard-config>
+</acl>

net/wireguard/src/opnsense/mvc/app/models/OPNsense/Wireguard/Client.php

@@ -0,0 +1,31 @@
+<?php
+
+/*
+    Copyright (C) 2018 Michael Muenz
+    All rights reserved.
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+namespace OPNsense\Wireguard;
+
+use OPNsense\Base\BaseModel;
+
+class Client extends BaseModel
+{
+}

net/wireguard/src/opnsense/mvc/app/models/OPNsense/Wireguard/Client.xml

@@ -0,0 +1,36 @@
+<model>
+    <mount>//OPNsense/wireguard/client</mount>
+    <description>Wireguard Client configuration</description>
+    <version>0.0.2</version>
+    <items>
+        <clients>
+            <client type="ArrayField">
+                <enabled type="BooleanField">
+                    <default>1</default>
+                    <Required>Y</Required>
+                </enabled>
+                <name type="TextField">
+                    <default></default>
+                    <Required>Y</Required>
+                    <mask>/^([0-9a-zA-Z]){1,32}$/u</mask>
+                    <ValidationMessage>Should be a string between 1 and 32 characters. Allowed characters are 0-9a-zA-Z</ValidationMessage>
+                </name>
+                <pubkey type="TextField">
+                    <Required>N</Required>
+                </pubkey>
+                <tunneladdress type="NetworkField">
+                    <default></default>
+                    <FieldSeparator>,</FieldSeparator>
+                    <Required>Y</Required>
+                    <asList>Y</asList>
+                </tunneladdress>
+                <serveraddress type="NetworkField">
+                    <Required>N</Required>
+                </serveraddress>
+                <serverport type="PortField">
+                    <Required>N</Required>
+                </serverport>
+            </client>
+        </clients>
+    </items>
+</model>

net/wireguard/src/opnsense/mvc/app/models/OPNsense/Wireguard/General.php

@@ -0,0 +1,35 @@
+<?php
+
+/*
+    Copyright (C) 2018 Michael Muenz
+    All rights reserved.
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+namespace OPNsense\Wireguard;
+
+use OPNsense\Base\BaseModel;
+
+class General extends BaseModel
+{
+}

net/wireguard/src/opnsense/mvc/app/models/OPNsense/Wireguard/General.xml

@@ -0,0 +1,11 @@
+<model>
+    <mount>//OPNsense/wireguard/general</mount>
+    <description>WireGuard configuration</description>
+    <version>0.0.1</version>
+    <items>
+        <enabled type="BooleanField">
+            <default>0</default>
+            <Required>Y</Required>
+        </enabled>
+    </items>
+</model>

net/wireguard/src/opnsense/mvc/app/models/OPNsense/Wireguard/Menu/Menu.xml

@@ -0,0 +1,5 @@
+<menu>
+    <VPN>
+      <WireGuard cssClass="fa fa-lock fa-fw" url="/ui/wireguard/general/index" order="20" />
+    </VPN>
+</menu>

net/wireguard/src/opnsense/mvc/app/models/OPNsense/Wireguard/Server.php

@@ -0,0 +1,31 @@
+<?php
+
+/*
+    Copyright (C) 2018 Michael Muenz
+    All rights reserved.
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+namespace OPNsense\Wireguard;
+
+use OPNsense\Base\BaseModel;
+
+class Server extends BaseModel
+{
+}

net/wireguard/src/opnsense/mvc/app/models/OPNsense/Wireguard/Server.xml

@@ -0,0 +1,55 @@
+<model>
+    <mount>//OPNsense/wireguard/server</mount>
+    <description>Wireguard Server configuration</description>
+    <version>0.0.1</version>
+    <items>
+        <servers>
+            <server type="ArrayField">
+                <enabled type="BooleanField">
+                    <default>1</default>
+                    <Required>Y</Required>
+                </enabled>
+                <name type="TextField">
+                    <default></default>
+                    <Required>Y</Required>
+                    <mask>/^([0-9a-zA-Z]){1,32}$/u</mask>
+                    <ValidationMessage>Should be a string between 1 and 32 characters. Allowed characters are 0-9a-zA-Z</ValidationMessage>
+                </name>
+                <instance type="AutoNumberField">
+                    <MinimumValue>0</MinimumValue>
+                    <MaximumValue>19</MaximumValue>
+                    <ValidationMessage>Maximum number of instances reached</ValidationMessage>
+                    <Required>Y</Required> 
+                </instance>
+                <pubkey type="TextField">
+                    <Required>N</Required>
+                </pubkey>
+                <privkey type="TextField">
+                    <Required>N</Required>
+                </privkey>
+                <port type="PortField">
+                    <default>51820</default>
+                    <Required>Y</Required>
+                </port>
+                <tunneladdress type="NetworkField">
+                    <default></default>
+                    <FieldSeparator>,</FieldSeparator>
+                    <Required>Y</Required>
+                    <asList>Y</asList>
+                </tunneladdress>
+                <peers type="ModelRelationField">
+                    <Model>
+                        <template>
+                            <source>OPNsense.Wireguard.Client</source>
+                            <items>clients.client</items>
+                            <display>name</display>
+                        </template>
+                    </Model>
+                    <Multiple>Y</Multiple>
+                    <Required>N</Required>
+                    <ValidationMessage>Choose an Peer.</ValidationMessage>
+                </peers>
+            </server>
+        </servers>
+    </items>
+</model>